Asic Lookup

io.github.keitaemsden-labPublished by GitHub account keitaemsden-labv0.1.0Updated Oct 24, 2026

Look up any Australian company by ABN, ACN or name. USD 0.01 per lookup, paid in USDC via x402.

VerifiedSTDIODesktop onlyFinanceBusiness & Commerce

Overview

AI-generated overview

Looks up Australian companies in the ASIC Company Register by ABN, ACN or name, paying USD 0.01 per successful lookup in USDC from a wallet you configure.

What you can do
Look up a company by ABN, ACN or name prefix, with an optional result limit for name searches, and get back registered name, ACN or ARBN, ABN, status, entity type and class, registration and deregistration dates, previous state, state registration number and former names. Each result also reports the lookup cost, the Base settlement transaction hash and the running total against your spend cap.
When to use it
Useful when an assistant needs basic Australian company registration details — identity, status, entity type, dates and former names — for due diligence, onboarding checks or research, and you are willing to pay a small per-lookup fee from a crypto wallet.
Requirements
Runs locally via npx with Node.js. Needs a Base mainnet wallet holding USDC, supplied as PRIVATE_KEY_FILE (preferred) or PRIVATE_KEY, plus a required SPEND_CAP_USD. Optional settings include MAX_PRICE_USD_PER_CALL, REQUEST_TIMEOUT_MS, EXPECTED_PAY_TO, MAX_AUTHORISATION_SECONDS and API_BASE_URL. No account or API key; network access to the lookup endpoint is required.
Before you install
It spends real money: each successful lookup costs USD 0.01 in USDC, signed automatically from your wallet. The wallet private key is a secret and should go in a protected key file rather than a synced client config. The spend cap is per process and resets on restart. Lookups that fail after a signature is made are still charged, and the same query is refused until that authorisation expires. Data is a weekly snapshot, not the official register.

Installation

In SourceWeft

  1. Open Asic Lookup in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Desktop only via STDIO. STDIO servers start a local process, so they need the SourceWeft desktop host.

Other MCP clients

Follow the launch instructions in the repository.

README

asic-lookup-mcp

An MCP server that looks up Australian companies by ABN, ACN or company name against the ASIC Company Register — about 4 million companies.

It spends your money. USD 0.01 per successful lookup, paid automatically from a wallet you configure. A lookup that matches nothing is free, and so is a malformed one. There is no account and no API key: the payment is the credential, under the x402 protocol, in USDC on Base mainnet.

The server will not start until you have told it a total spend cap.

Install

Nothing to install. Point your MCP client at it with npx and it fetches on first run.

npx @nightshiftbuilds/asic-lookup-mcp is how it runs.

You need a Base mainnet wallet holding a little USDC. You do not need ETH: x402 exact payments are an off-chain EIP-3009 signature settled by a facilitator, so your wallet signs and pays no gas.

Claude Desktop

~/Library/Application Support/Claude/claude_desktop_config.json on macOS, %APPDATA%\Claude\claude_desktop_config.json on Windows:

json
{  "mcpServers": {    "asic-lookup": {      "command": "npx",      "args": ["-y", "@nightshiftbuilds/asic-lookup-mcp"],      "env": {        "SPEND_CAP_USD": "1.00",        "PRIVATE_KEY_FILE": "/Users/you/.config/asic-lookup/key"      }    }  }}

Cursor

.cursor/mcp.json in a project, or ~/.cursor/mcp.json globally:

json
{  "mcpServers": {    "asic-lookup": {      "command": "npx",      "args": ["-y", "@nightshiftbuilds/asic-lookup-mcp"],      "env": {        "SPEND_CAP_USD": "1.00",        "PRIVATE_KEY_FILE": "/Users/you/.config/asic-lookup/key"      }    }  }}

Claude Code

bash
claude mcp add asic-lookup \  --env SPEND_CAP_USD=1.00 \  --env PRIVATE_KEY_FILE=$HOME/.config/asic-lookup/key \  -- npx -y @nightshiftbuilds/asic-lookup-mcp

The key file

PRIVATE_KEY_FILE is preferred over PRIVATE_KEY because a client config file is not a good home for a wallet key — it gets synced, backed up and shared in screenshots.

bash
mkdir -p ~/.config/asic-lookupprintf '0x%s' "$YOUR_KEY_WITHOUT_0X" > ~/.config/asic-lookup/keychmod 600 ~/.config/asic-lookup/key

Configuration

VariableRequiredDefaultWhat it does
SPEND_CAP_USDyesnoneTotal USD this server may spend before it refuses every further lookup. Roughly 100 lookups per dollar. There is deliberately no default.
PRIVATE_KEY_FILEone of these two—Path to a file containing the wallet's private key.
PRIVATE_KEYone of these two—The key itself, 0x + 64 hex characters.
MAX_PRICE_USD_PER_CALLno0.01The most one lookup may cost. A 402 asking for more is refused, not paid.
REQUEST_TIMEOUT_MSno45000How long to wait for the API, per network attempt. The paid retry gets its own budget rather than the leftovers of the unpaid one, so a paid lookup's worst case is roughly twice this. 1000–300000.
EXPECTED_PAY_TOnothe endpoint's published payeeThe only address this server will sign a transfer to. Change it only with API_BASE_URL, and only deliberately.
MAX_AUTHORISATION_SECONDSno600The longest a signature this server produces may stay spendable. A 402 asking for more is refused. 30–3600.
API_BASE_URLnohttps://api.nightshiftbuilds.comOverride the endpoint. Must be https.

The cap is counted per server process. Restarting the server resets it, which is worth knowing if your client restarts servers often.

The tool

lookup_australian_company — give exactly one of:

ArgumentMeaning
abnAustralian Business Number, 11 digits. Spaces and hyphens are ignored.
acnAustralian Company Number, 9 digits. Spaces and hyphens are ignored.
nameCompany name, matched as a prefix, case insensitive.
limitMaximum results for a name search, 1–25. Does not change the price.

They are alternative ways to identify one company, not filters that combine, so passing two is an error rather than a narrower search.

Returns, per match: registered name, ACN or ARBN, ABN, registration status, entity type and class, registration and deregistration dates, previous state of registration, state registration number, and former names. Plus what the lookup cost, the Base settlement transaction hash, and your running total against the cap.

What it does not have

Asking for these will not work, because the underlying dataset does not contain them:

  • GST registration status, business address, state or postcode — those live in the Australian Business Register extract, a different dataset
  • directors, officeholders or shareholders
  • trading names, financial data
  • anything about a sole trader or partnership that is not a registered company

It is also a weekly snapshot, not the official register. ASIC Connect is authoritative for anything that matters legally.

How the money works

Every lookup is one HTTP request that comes back 402 Payment Required with a price, a payee and a token. The server signs an EIP-3009 authorisation for exactly that amount and retries. A facilitator settles it on Base and the answer comes back with the transaction hash.

Five separate limits sit in front of your signing key:

  1. Only Base mainnet. No scheme client is registered for any other chain, so a 402 naming one has nothing that could sign it.
  2. Only USDC, only the exact scheme, only an EIP-3009 transfer, and only up to MAX_PRICE_USD_PER_CALL — checked against what the endpoint actually asked for, not against what it asked for last time. A 402 is free to demand any number it likes; the number inside the signature is the one that leaves your wallet, so that is the number that gets checked. A 402 that tries to steer the signature onto Permit2 or an escrow flow is refused rather than signed.
  3. Only EXPECTED_PAY_TO. The payee is pinned, not merely checked for being a well-formed address, so a hijacked endpoint cannot redirect your payments to itself within the ceiling.
  4. Only for MAX_AUTHORISATION_SECONDS. A signature is spendable until its validBefore, and the 402 names that. Unbounded, a 402 can obtain an authorisation valid for centuries; here anything over ten minutes is refused.
  5. SPEND_CAP_USD in total, counted against signatures rather than settlements. The reservation is taken before the request is sent, so concurrent lookups cannot collectively overrun it.

On the accounting. What leaves a wallet is a signature, not a settlement, so that is what the cap counts. A 404 costs nothing — but the authorisation it signed is still in the payee's hands and still settleable, so the amount stays held against the cap until its validBefore passes, and the spend line says so. Ten thousand "free" misses cannot hand out more live authorisations than your cap. Anything that ends after a signature exists — a timeout, a dropped body, a 409, a 503 of unknown outcome — is charged, not released, because a signature in someone else's hands is not a refund. After one of those, the identical query is refused until the authorisation expires: retrying it would sign a second one.

Nothing is broadcast from your machine, and the key is never logged, never returned in a tool result and never included in an error message.

Data licence and attribution

The data this server returns contains ASIC Company Register data sourced from data.gov.au, © Australian Securities and Investments Commission, licensed under CC BY 3.0 AU.

That attribution is a condition of the licence, not decoration. It ships in every tool result so it travels with the data. Keep it if you redistribute what you get back.

The full dataset is free to download from data.gov.au. This is a lookup service, not a way to obtain the dataset, and there is no cheaper path to a bulk copy through it.

Development

bash
npm installnpm test          # 139 tests: no wallet needed, no money spentnpm run build

The suite mocks the 402 handshake with a challenge recorded from the live endpoint and asserts what actually gets signed — the amount, the payee, the token, the chain, the authorisation lifetime, and that the signature recovers to the configured wallet. Both wire versions are exercised end to end. The accounting tests run against a fetch that really signs, so they can tell "nothing was charged" from "nothing was signed"; every spend-safety fix has a test that fails when the fix is reverted. One test hits the real API unpaid to read its published price, which is free by design; set SKIP_LIVE_TESTS=1 to skip it offline.

Links

MIT licensed. See LICENSE.

Source: README.md at commit dad14cc

Tools

0
SourceWeft has not started this package in its sandbox yet, so its tools are not known.

Version history

1
  1. v0.1.0LatestSep 16, 2026

Score

40% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 days25 pts

    Keep the endpoint answering the MCP handshake; SourceWeft probes it every 30 days.

  • Auth declared10 pts

    Declare the credential headers in the registry entry, or keep the endpoint answering the probe so its auth can be classified.

  • Tools listed15 pts

    Answer tools/list without a credential, or ship a package that starts in a sandbox without one.

  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts

    Declare a license in the repository or the registry entry.