MCP server¶

The Consumer Intelligence MCP server lets AI assistants and other Model Context Protocol (MCP) clients look up persons through Consumer Intelligence. It exposes the same data as the Find API, and uses the same client credentials as the REST API.

Environment	MCP server URL
Sandbox	`https://sandbox-api.bisnode.com/consumer-intelligence/mcp/v1/mcp`
Production	`https://api.bisnode.com/consumer-intelligence/mcp/v1/mcp`

The server uses the Streamable HTTP transport.

Authentication differs from most MCP servers

Most MCP clients expect to sign in through an interactive OAuth flow. This server does not support that flow. You obtain an access token yourself, using the OAuth 2.0 client credentials grant, and configure your MCP client to send it as a static Authorization: Bearer header. Read how authentication works.

Before you start¶

Prerequisites

A client ID and client secret for the environment you want to use. See Applying for access.
MCP access enabled on your client. The bci:mcp scope is not granted by default. See Request MCP access.
An MCP client that can send a custom Authorization header, or that can be used together with the mcp-remote bridge. See Connect your client.

Request MCP access¶

Access to the MCP server is controlled by the bci:mcp scope. The scope must be requested by you, and is added to your client manually by D&B.

Make sure you already have a client for the environment you want to use. If you do not, apply for access first.
Request the bci:mcp scope for your client, through either of the following channels:
- your Key Account Manager, or
- a support email, as described in Contact us.
D&B adds the scope to your client. This is a manual step, and it is not completed immediately.
Once access is confirmed, request a new access token. A token issued before the scope was added does not include it.

Example support email

To: Nordic2ndLine_support_api@dnb.com
Subject: Request MCP access for Consumer Intelligence V3 client
Body:
Hi!

I would like the bci:mcp scope to be added to my Consumer Intelligence V3 client.
- Client ID: <your_client_id>
- Environment: <sandbox | production>
- Company: <your_company> <your_company_organization_number>
Regards,
<your_name>
<your_phonenumber>

Never send your client secret

Do not include your client secret or an access token in an email or any other message. We only need your client ID.

Sandbox and production

Sandbox and production are separate environments, and each client belongs to exactly one of them. Use the sandbox environment to evaluate the MCP server with mocked persons. Access to the MCP server in production requires a separate agreement. Your Key Account Manager can help you with this.

How authentication works¶

The MCP specification describes an interactive OAuth flow, where the MCP client registers itself and asks you to sign in through a browser. The Consumer Intelligence MCP server does not currently support that flow. Instead, it accepts the same kind of access token as the REST API. You obtain the token with your client credentials, and your MCP client sends it with every request.

Aspect	Typical MCP server (interactive OAuth)	Consumer Intelligence MCP server
Who signs in	A person, through a browser	Nobody. Your client credentials identify your client
How the token is obtained	The MCP client, during a consent flow	You, with the OAuth 2.0 client credentials grant
Client registration	Dynamic, done by the MCP client	Not supported. Your client is provisioned by D&B
Token lifetime	Refreshed by the MCP client	3600 seconds. There is no refresh token
Required scope	Chosen on a consent screen	`bci:mcp`, added to your client by D&B
What the token represents	An individual user	Your client application, not an individual user
Header	`Authorization: Bearer <token>`	`Authorization: Bearer {YOUR_ACCESS_TOKEN}`

Every request to the MCP server must carry this header:

Authorization header

Authorization: Bearer {YOUR_ACCESS_TOKEN}

Limitations¶

No interactive sign-in. If your MCP client offers an "Authenticate" or "Connect" action for this server, it will not complete. Configure the Authorization header instead, as described in Connect your client.
Tokens expire after 3600 seconds. There is no refresh token. When the token expires, requests fail until you request a new token and update your client configuration. See Renewing the token.
Static header support differs between clients. Some clients, such as Claude Desktop custom connectors, only support OAuth and offer no way to set a static header. For these, use the mcp-remote bridge.
The token identifies your client, not an end user. Anyone who can use an MCP client configured with your token acts with the permissions of your client. See Security and data protection.

Step 1: Get an access token¶

Request an access token with the OAuth 2.0 client credentials grant, exactly as described in Accessing the API, but include the bci:mcp scope.

Environment	OAuth token URL
Sandbox	`https://login.bisnode.com/sandbox/v1/token.oauth2`
Production	`https://login.bisnode.com/as/token.oauth2`

Token request example (sandbox)

curl https://login.bisnode.com/sandbox/v1/token.oauth2 \
    -X POST \
    -H "Content-Type: application/x-www-form-urlencoded" \
    -d "grant_type=client_credentials&scope=bci%20bci:mcp" \
    -u "{YOUR_CLIENT_ID}:{YOUR_CLIENT_SECRET}"

Verify that the scope value of the response includes bci:mcp. If it does not, MCP access has not yet been enabled for your client. See Request MCP access.

Token response example

{
  "access_token": "{YOUR_ACCESS_TOKEN}",
  "expires_in": 3600,
  "scope": "bci bci:mcp",
  "token_type": "bearer"
}

Renewing the token¶

The token is valid for 3600 seconds (one hour). The examples in the next step read the token from an environment variable named CIA_MCP_TOKEN. The following example requests a new token and stores it in that variable. It requires jq.

Store a token in an environment variable

export CIA_MCP_TOKEN=$(curl -s https://login.bisnode.com/sandbox/v1/token.oauth2 \
    -X POST \
    -H "Content-Type: application/x-www-form-urlencoded" \
    -d "grant_type=client_credentials&scope=bci%20bci:mcp" \
    -u "{YOUR_CLIENT_ID}:{YOUR_CLIENT_SECRET}" | jq -r .access_token)

After renewing the token, restart your MCP client so that it picks up the new value.

Step 2: Connect your client¶

The examples below use the sandbox URL. Replace it with the production URL when you use your production client.

Claude CodeVS CodeCursorClaude Desktop (mcp-remote)MCP Inspector and curl

Add the server to the .mcp.json file of your project, so that the token is read from an environment variable and is never written to the file:

.mcp.json

{
  "mcpServers": {
    "cia-sandbox": {
      "type": "http",
      "url": "https://sandbox-api.bisnode.com/consumer-intelligence/mcp/v1/mcp",
      "headers": {
        "Authorization": "Bearer ${CIA_MCP_TOKEN}"
      }
    }
  }
}

Alternatively, add the server with the command line. Note that this stores the token value in your local Claude Code configuration, so use it for short-lived tokens only.

Add the server with the command line

claude mcp add --transport http cia-sandbox \
    https://sandbox-api.bisnode.com/consumer-intelligence/mcp/v1/mcp \
    --header "Authorization: Bearer $CIA_MCP_TOKEN"

Add the server to .vscode/mcp.json in your workspace. VS Code prompts you for the token when the server starts, and does not store it in the file.

.vscode/mcp.json

{
  "inputs": [
    {
      "type": "promptString",
      "id": "cia-mcp-token",
      "description": "Consumer Intelligence access token",
      "password": true
    }
  ],
  "servers": {
    "cia-sandbox": {
      "type": "http",
      "url": "https://sandbox-api.bisnode.com/consumer-intelligence/mcp/v1/mcp",
      "headers": {
        "Authorization": "Bearer ${input:cia-mcp-token}"
      }
    }
  }
}

Add the server to .cursor/mcp.json in your project, or to ~/.cursor/mcp.json for all projects. The token is read from an environment variable.

.cursor/mcp.json

{
  "mcpServers": {
    "cia-sandbox": {
      "url": "https://sandbox-api.bisnode.com/consumer-intelligence/mcp/v1/mcp",
      "headers": {
        "Authorization": "Bearer ${env:CIA_MCP_TOKEN}"
      }
    }
  }
}

Claude Desktop custom connectors only support OAuth, and cannot send a static header. Use the mcp-remote bridge instead. It requires Node.js.

Add the following to your claude_desktop_config.json file, and restart Claude Desktop. Replace {YOUR_ACCESS_TOKEN} with your access token.

claude_desktop_config.json

{
  "mcpServers": {
    "cia-sandbox": {
      "command": "npx",
      "args": [
        "-y",
        "mcp-remote",
        "https://sandbox-api.bisnode.com/consumer-intelligence/mcp/v1/mcp",
        "--header",
        "Authorization:${AUTH_HEADER}"
      ],
      "env": {
        "AUTH_HEADER": "Bearer {YOUR_ACCESS_TOKEN}"
      }
    }
  }
}

This file contains your access token in plain text. Do not share it, and do not commit it to a repository. The token expires after 3600 seconds, so you must update the file and restart Claude Desktop when it does.

Use these to verify your token and the connection before you configure a client.

With MCP Inspector:

Start MCP Inspector

npx @modelcontextprotocol/inspector

Select the Streamable HTTP transport, enter the MCP server URL, and add a header named Authorization with the value Bearer {YOUR_ACCESS_TOKEN}.

With curl:

Initialize request

curl https://sandbox-api.bisnode.com/consumer-intelligence/mcp/v1/mcp \
    -X POST \
    -H "Authorization: Bearer $CIA_MCP_TOKEN" \
    -H "Content-Type: application/json" \
    -H "Accept: application/json, text/event-stream" \
    -d '{
      "jsonrpc": "2.0",
      "id": 1,
      "method": "initialize",
      "params": {
        "protocolVersion": "2025-06-18",
        "capabilities": {},
        "clientInfo": { "name": "curl", "version": "1.0" }
      }
    }'

A successful response contains the server's name, Consumer Intelligence MCP Server. An invalid or missing token results in an HTTP 401 response.

Verify the connection¶

Once your client is connected, list the tools of the server. The list should contain the Find tool described in the next section. Then ask your assistant to look up a person, for example using one of the example prompts.

Tools and resources¶

Find¶

Finds a person in a market, given consumer data. This corresponds to the Find API.

Parameter	Type	Required	Description
`market`	string	Yes	The market to search in: `DK`, `FI`, `NO` or `SE`. Any other value returns an error.
`consumerData`	object	Yes	The data used to identify the person, for example a legal ID, or a name. See the request body of the Find API.

The tool returns the matching person as JSON. If no person matches, it returns an empty JSON object, {}.

Your client needs Onboarding permissions to the market, in the same way as for the REST API. See Sandbox for the persons that are available in the sandbox environment.

OpenAPI specification¶

The server exposes the V3 OpenAPI specification as the resource openapi://consumer-intelligence-v3. Assistants can read it to learn the structure of the consumerData parameter and of the response.

Example prompts¶

The following prompts show how an assistant can use the Find tool. Replace the placeholders with values of persons available in the sandbox environment.

Use sandbox data for evaluation

Only use sandbox persons while evaluating the MCP server. Responses from the production environment contain real personal data. See Security and data protection.

Find a person from a single identifier

Find details of the person with legal id {SANDBOX_LEGAL_ID}.

Find a person from incomplete information

Find details of the person with first name {SANDBOX_FIRST_NAME} and family name {SANDBOX_FAMILY_NAME} in Sweden.

Find where to contact a person

How do I contact the person with legal id {SANDBOX_LEGAL_ID}?

Check whether a person can be contacted

The response indicates whether a person has protected or restricted data. Use a sandbox person with protected data to see this.

How do I contact the person with legal id {SANDBOX_PROTECTED_LEGAL_ID}?

Handle a person that is not found

When no person matches, the tool returns an empty response, {}, and the assistant reports that no person was found.

Find a person with first name {SANDBOX_FIRST_NAME} and family name NonExistingExample in Sweden.

Troubleshooting¶

Symptom	Cause	Resolution
HTTP `401` with `{"status":401,"statusText":"Authorization Required", ...}`	The token is missing, expired or malformed.	Request a new token, restart your client, and check that the header is `Authorization: Bearer <token>`, with a single space.
The client starts an OAuth flow, or shows "authentication required"	The client does not support static headers, or the header is not configured.	Configure the `Authorization` header as described in Connect your client, or use `mcp-remote`.
Access is denied although the token is valid	The `bci:mcp` scope is not enabled for your client, or the token was issued before it was added.	Request MCP access, then request a new token. The `scope` of the token response must include `bci:mcp`.
It worked for about an hour, and then stopped	The token expired after 3600 seconds.	Request a new token, update your client configuration and restart your client. See Renewing the token.
The tool result is `Invalid market: <value>`	The `market` is not one of `DK`, `FI`, `NO` or `SE`.	Use one of the supported market codes.
The tool result is `Failed to execute tool.`	The request could not be completed.	Contact us and include the details listed there.

The MCP server does not currently enforce rate limits. This may change in the future.

Security and data protection¶

Protect the access token and the client secret. Do not commit them to a repository, and do not share them in messages. Use environment variables or a secret store. Keep the client secret on your servers or on the machine of the developer it belongs to.
The token grants the permissions of your client. Anyone using an MCP client configured with your token can look up persons through your client. Giving a token to other people is your decision, and your responsibility. See also Building a backend.
Responses contain personal data. In production, the Find tool returns data about real persons. The assistant and the model provider you use process this data, and it may be stored by the MCP client. You are responsible for having a legal basis for the processing, for limiting the data to what you need, and for how the data is handled once it has been returned. See also Identifying persons. This page provides information only, and is not legal advice. Consult your data protection officer or legal counsel about your use.

Support¶

If you need help, contact us.