# RiskWatch (https://riskwatch.pl)

> RiskWatch is a B2B API and monitoring platform for Polish counterparty risk. It continuously monitors Polish public registers — the Ministry of Finance VAT Whitelist (official API `wykazpodatnikowvat.mf.gov.pl`), the National Court Register KRS (official API `api-krs.ms.gov.pl`), and KRZ (Krajowy Rejestr Zadłużonych) — public court portal krz.ms.gov.pl, read by an automated reader; no official API exists — and turns material register changes into weighted risk scores (`0..100`, banded `LOW` / `MEDIUM` / `HIGH` / `CRITICAL`) and HMAC-SHA256 signed webhooks.

## Key Links

- [Product Overview](https://riskwatch.pl/): Continuous monitoring of Polish counterparties by 10-digit NIP.
- [Pricing & Plan Limits](https://riskwatch.pl/pricing): Free (0 PLN, VAT, 25 NIPs), Starter (99 PLN/month, VAT + KRS, 250 NIPs), Pro (399 PLN/month, VAT + KRS + KRZ, 2,000 NIPs), Enterprise (1,499 PLN/month, VAT + KRS + KRZ, 25,000 NIPs).
- [API Documentation](https://riskwatch.pl/docs.md): Bearer authentication (`rw_live_` and `rw_test_` sandbox fixtures), required `Idempotency-Key` on mutating endpoints, one-shot checks (`/v1/checks/vat`, `/v1/checks/bank-account`, `/v1/checks/vies`, `/v1/checks/sanctions` for MSWiA/EU FSF/OFAC SDN), cursor pagination, and stable error codes.
- [Getting Started Guide](https://riskwatch.pl/docs/getting-started.md): Quickstart cURL examples for sandbox (`rw_test_`), Free VAT watchlist monitoring, and Starter+ KRS/webhooks.
- [Polish VAT Whitelist & MF API Migration Guide](https://riskwatch.pl/docs/vat-whitelist.md): Technical guide to the MF VAT Whitelist API (`https://wykazpodatnikowvat.mf.gov.pl/api`, legacy host retiring 1.12.2026), rate limits (`search` 100/day, `check` 5,000/day), and NRB checks.
- [Webhooks & HMAC Verification](https://riskwatch.pl/docs/webhooks.md): Verifying `X-RiskWatch-Signature` (`t=<unix>,v1=<hex>`) with 300s replay window, `occurrence_id` deduplication, and Node.js / n8n recipe.
- [OpenAPI & SDK](https://riskwatch.pl/docs/openapi.md): Downloading the OpenAPI 3.1 contract and installing the TypeScript SDK.
- [OpenAPI 3.1 Specification](https://api.riskwatch.pl/v1/openapi.json): Machine-readable OpenAPI 3.1 contract for `https://api.riskwatch.pl/v1`.
- [AI Connectors & Remote MCP Server](https://riskwatch.pl/docs/ai.md): Streamable HTTP MCP server (`https://api.riskwatch.pl/mcp`) with OAuth 2.1 + PKCE (`S256`) for Anthropic Claude, OpenAI ChatGPT, Google Gemini CLI / Antigravity and Gemini Enterprise (Agent Registry). Remote MCP only: the portal registers no WebMCP tools and there is no A2A endpoint.
- [Full LLM Reference](https://riskwatch.pl/llms-full.txt): Complete technical reference of registers, risk scoring weights, plans, and API endpoints.

## Optional

- [Full LLM Reference](https://riskwatch.pl/llms-full.txt): Registers, scoring weights, plans and endpoints in one file.
- [OpenAPI 3.1 JSON](https://api.riskwatch.pl/v1/openapi.json): The REST contract.
- [TypeScript SDK + riskwatch CLI](https://riskwatch.pl/sdk/riskwatch-sdk-1.0.0.tgz): `npm install` tarball; `npm exec --package=<tarball> riskwatch check <NIP>`.
- [Postman collection](https://riskwatch.pl/riskwatch.postman_collection.json): Collection Format v2.1 generated from the OpenAPI document.
- [Agent Registry tool spec](https://riskwatch.pl/agent-registry/toolspec.json): MCP tool schemas for Google Agent Registry registration.