D&B Risk Analytics MCP server icon

D&B Risk Analytics

by D&B Risk Analytics

HIPAA CompliantSOC2 ReadyISO 27001 Ready
Finance39 tools

Run KYB, sanctions and PEP screening, UBO mapping and supplier risk workflows from an AI agent. One dispatcher tool fronts 39 internal capabilities, including writes to your portfolio and screening decisions. OAuth 2.1 PKCE or client credentials, mcp.read and mcp.write scopes.

Verified connector

Listed by Anthropic as a partner connector in its Connectors Directory.

Connection checked by Agentman on .

Anthropic states this reflects the level of review a connector received, not a security audit.

Connect D&B Risk Analytics via MCP

https://agents.riskanalytics.dnb.com/mcp

Works in any MCP-compatible client. In Agentman Studio it is one click — no config file to edit.

D&B Risk Analytics Tools & Capabilities (39)

Tool names from Anthropic's directory listing. This server requires sign-in, so we could not read tool descriptions or parameter schemas.

Limits

  • The verb census is meaningless on this server. One dispatcher fronts 39 operations, so a tool-name allowlist restricts nothing. Governance has to live in D&B's entitlements and in the OAuth scope, not in your client's tool policy.
  • The scope boundary does not fall where it matters. mcp.read and mcp.write are real, named and enforceable — better than the identity-only scopes many connectors ship. But mcp.write is a single grant covering the free write, the metered write, the compliance adjudication and the user-administration capability alike. Nothing separates updating a tag from adding a user or from dispositioning a sanctions match. These are advertised scopes; we could not observe enforcement without credentials.
  • Two operations consume entitlement. RACreateEntity and RAScreeningMgmtTool are marked Y for RUM usage. Everything else is marked N.
  • The directory under-lists by six. Anthropic's snapshot carries 33 of D&B's 39, missing RAScreeningAdjudicationTool, RAAddCounterPartiesTool, RADocumentManagementTool, RAAllowDenyListTool, RAPolicyHistoryTool and RAScreeningPolicyTool.
  • What you can reach depends on your contract, not the protocol. D&B's domain sheet splits data blocks by licensed domain — Supply or Compliance — and by package tier (SI Core, SI Core+, CI Core, CI Core+), with several blocks marked "if entitled by customer". Two different customers on the same endpoint reach different data. Any capability list, ours included, is an upper bound.
  • The output is licensed, not yours to pass on. D&B's terms of use forbid reproducing, retransmitting, distributing, selling, sub-licensing or publishing information received through the Service without prior written consent, and separately forbid using it to prepare a database furnished to a third party. Piping tool output into a system that shares it outward is exactly the shape that restriction addresses.
  • D&B's standard general terms restrict the use this connector is for, and we found no public carve-out. Clause 3.13.2 of the US/Canada General Terms & Conditions says the Information and any Derivative Information may not, without D&B's prior approval, be used "in or with proprietary or third party generative Artificial Intelligence Technology (including ChatGPT and Gemini for Google Workspace), including to train, ground, prompt, or tune large language models". Sending D&B data to an LLM is what an MCP connector does. The connector entitlement presumably supplies the approval that clause requires — but no public document states it, and the two texts read against each other as published. Confirm your own contract terms with D&B before building on this; we are describing a documented tension, not advising on it.
  • Scores are opinions and may be estimates. D&B's analytics statement says analytics for a business may be "estimated based on benchmark data derived from appropriate peer groups" where its actual data is unavailable, and disclaims all warranties. Nothing in a tool response marks which figures are estimated.
  • D&B's documentation disagrees with its own server in two places. The guide's sample resource-metadata response shows scopes_supported with mcp.read and mcp.write; the live descriptor at /.well-known/oauth-protected-resource/mcp omits scopes_supported entirely and the scopes appear on the authorization server instead. The guide's sample also lists authorization_code as the only grant type, while the live metadata advertises refresh_token and client_credentials too. The live server wins; both were read on 2026-08-22.
  • code_challenge_method=plain is accepted. The authorization server advertises both S256 and plain, and D&B documents the plain behaviour as comparing the verifier to the challenge directly. Plain offers no protection against code interception. Use S256.
  • No dynamic client registration. /register returns 404. Credentials must be created inside the Risk Analytics product first.
  • Only three redirect hosts are allowed, so self-hosted and local-callback clients are outside the documented flow.
  • We could not read tool schemas or annotations. The endpoint returned 401 to an anonymous request, so no parameter-level detail, readOnlyHint or destructiveHint is published here.
  • Support documentation is not publicly readable. support.dnb.com/robots.txt is a blanket Disallow: / for all crawlers, so the support portal D&B links for troubleshooting could not be consulted for this page.

Frequently asked questions

One, by D&B's own account. Its tools reference carries a column headed Tool Exposed via MCP whose single value is RiskAnalyticsAgent, and describes that agent as a single MCP entry point that accepts natural language risk requests and picks the workflow. The 39 RA-prefixed names are what the agent calls internally, not what your client sees.

Yes. D&B documents the server as supporting read and authorized write operations, naming entity creation, screening initiation, record updates, tag and custom field management, workflow configuration and portfolio management. Internal capabilities also cover adding and removing users and changing their roles, and writing screening adjudication decisions back to the audit trail.

Two operations are marked as metered. D&B's tools sheet carries a RUM Usage column set to Y on exactly RACreateEntity and RAScreeningMgmtTool, and N on the other 37. Those are the tools that add a record to your portfolio and initiate or rescreen a screening workflow, so an agent adding an entity consumes entitlement.

Named individuals at companies, not just company records. Internal capabilities cover ultimate beneficial owners, control and ownership, principals and contacts, and counterparties with roles such as PSC, director and shareholder. D&B's Professional Contact Data statement lists names, job titles, business addresses, professional email addresses and mobile telephone numbers among the elements it holds.

No, not without written consent. D&B's terms of use state you agree not to reproduce, copy, retransmit, distribute, disseminate, sell, sub-license, publish, broadcast or circulate information received through the Service to anyone without prior written consent, and separately forbid using it to build a comparison database furnished to a third party.

With a client ID you generate in your Risk Analytics workspace. D&B documents two routes: OAuth 2.1 with PKCE and the authorization code grant, or client credentials. The server publishes no dynamic client registration endpoint, so a client that expects to register itself automatically cannot; you must create credentials in the product first.

Three host domains only. D&B's quick start guide names claude.ai, global.consent.azure-apim.net and vertexaisearch.cloud.google.com as the allowed redirect hosts on the authorize endpoint. A self-hosted client or a local callback is therefore not covered by the documented allowlist, which constrains which MCP clients can complete the browser flow.

D&B says they are opinions, not facts. Its analytics transparency statement calls the models, ratings, scores and predictors statements of opinion as of the date expressed, notes they may be estimated from peer-group benchmarks where a business's own data is missing, and disclaims all warranties of fitness for a particular purpose.

Sources

Use in Agentman

Connect once and your agents call these tools on their own — on a schedule, in a workflow, with nobody at the keyboard.

Open in Agentman Studio

Server Info

Category
Finance
Developer
D&B Risk Analytics
Tools
39
Domain
agents.riskanalytics.dnb.com

Using Claude Desktop or another MCP client? Setup docs — the connection URL above works anywhere.