SponsorFinder MCP Server
An authless, read-only remote MCP server that lets AI assistants (Claude, ChatGPT, Cursor, …) check whether a company holds a UK or Netherlands work-visa sponsorship licence. It proxies the public SponsorFinder API, shaping responses into clean verdicts, and keeps the upstream API key server-side so clients connect with no credentials.
What it does
SponsorFinder tracks two official government registers of licensed work-visa sponsors:
- UK — the Home Office register of licensed sponsors, rebuilt from the CSVs the Home Office publishes (checked daily). Carries routes (e.g. Skilled Worker), ratings (A/B) and locations.
- Netherlands — the IND public register of recognised sponsors, checked daily. Lists recognised sponsors and their sponsor type (WORK / EXCHANGE / STUDY / RESEARCH); much thinner than the UK data — no routes, ratings, or locations.
This MCP server exposes that data as four tools. It is read-only and authless for clients: the upstream x-api-key is a server-side secret that MCP clients never see. There is no OAuth, no per-user state, and no write tools.
Tools
| Tool | Title | What it does | Key inputs |
|---|---|---|---|
check_sponsor_license | Check Sponsorship Licence | Primary tool. Resolves a company by name (typo-tolerant) and returns a verdict — licensed, formerly_licensed, ambiguous, or not_found — with routes, ratings, locations and register dates. Refuses to guess on weak matches. | company_name (2–100 chars, typos OK), country (uk | nl | both, default both) |
search_sponsors | Search Sponsor Register | Exploratory list search with optional filters. Returns a compact list plus a total count. For one specific company, prefer check_sponsor_license. | query?, country (uk | nl, default uk), city? (UK), route? (UK), sponsor_type? (NL: WORK | EXCHANGE | STUDY | RESEARCH), limit (1–20, default 10) |
get_sponsor_details | Get Sponsor Details | Full record for one organization by id: routes/ratings/locations/dates (UK) or sponsor type + KvK number (NL). Optionally includes register change history. | org_id (int), country (uk | nl, default uk), include_history (bool, default false) |
get_register_info | About the Sponsor Registers | Register statistics, data freshness, a terminology glossary, and the legal disclaimer. Use it to explain what a licence, route, rating, or sponsor type means. | none |
Every tool is annotated readOnlyHint: true and returns both a human-readable text block and structuredContent, each stamped with the data-freshness date and a source note.
Example prompts
Natural-language things you can ask an assistant once the server is connected:
- "Does Google hold a UK sponsorship licence?"
- "Is ASML a recognised sponsor in the Netherlands?"
- "Search UK Skilled Worker sponsors in Manchester."
- "List Dutch WORK-type sponsors matching 'shell'."
- "What does a B rating mean?"
A note on name matching. The fuzzy match tolerates typos (e.g. googel uk), but it needs a reasonably complete name to resolve confidently — "Google UK" or "Google UK Limited" resolves cleanly, whereas a single bare word can match many companies. The server deliberately refuses to guess on weak or tied matches: instead of silently picking one, it returns an ambiguous verdict with the candidate list and asks you to disambiguate (or to call get_sponsor_details with the right id). Absence from a register is itself a meaningful answer: it means the company cannot currently sponsor that visa type.
Use it (hosted)
The server is hosted at:
https://mcp.sponsorfinder.io/mcp
Claude Code
claude mcp add --transport http sponsorfinder https://mcp.sponsorfinder.io/mcp
claude.ai — Settings → Connectors → Add custom connector → paste the URL above. No authentication is required.
ChatGPT — Settings → Connectors (or a custom GPT's Actions) → Add a custom/remote MCP connector and paste the URL above.
Any MCP client that speaks Streamable HTTP can connect the same way — point it at https://mcp.sponsorfinder.io/mcp.
Run locally
Prerequisites: Node.js 24 and pnpm 11.
pnpm install
cp .env.example .env
# then edit .env and fill in:
# SPONSORFINDER_API_BASE e.g. https://api.sponsorfinder.io
# SPONSORFINDER_API_KEY your upstream x-api-key (server-side secret)
Run one of the two transports in watch mode:
pnpm dev:stdio # stdio transport (Claude Desktop / Claude Code / MCP Inspector)
pnpm dev:http # Streamable HTTP on http://localhost:3001/mcp
Add the local stdio build to Claude Code:
pnpm build
claude mcp add sponsorfinder -- node dist/entry/stdio.js
Inspect the tools interactively with the MCP Inspector against either transport:
npx @modelcontextprotocol/inspector
Configuration
All configuration is via environment variables (see .env.example):
| Name | Required | Default | Description |
|---|---|---|---|
SPONSORFINDER_API_BASE | yes | — | Base URL of the upstream SponsorFinder API, no trailing slash (e.g. https://api.sponsorfinder.io). |
SPONSORFINDER_API_KEY | yes | — | Upstream x-api-key header value. Server-side secret — never exposed to MCP clients, tool output, errors, or logs. |
PORT | no | 3001 | HTTP port for the Node entry (src/entry/node.ts). Ignored by stdio and Cloudflare Workers. |
UPSTREAM_TIMEOUT_MS | no | 10000 | Upstream request timeout in milliseconds (aborted via AbortSignal.timeout()). |
SPONSORFINDER_API_KEY is the one true secret. MCP clients connect authless; the key lives only on the server (a Docker env var or a Cloudflare Workers secret) and is never surfaced to clients.
Self-host / deploy
The Web-standard core runs on both Node and Cloudflare Workers; only the entry file differs.
Docker (primary) — image ghcr.io/alirezahamid/sponsor-finder-mcp, config in Dockerfile and docker-compose.yml:
docker compose up -d
Put a reverse proxy (Caddy/nginx) in front of mcp.sponsorfinder.io and pass POST, GET and DELETE through to /mcp. Streamable HTTP needs response buffering off (proxy_buffering off; in nginx; Caddy's defaults are fine).
Cloudflare Workers — config in wrangler.jsonc:
wrangler secret put SPONSORFINDER_API_KEY
pnpm deploy:worker
Development
| Script | What it does |
|---|---|
pnpm typecheck | Type-check with tsc --noEmit. |
pnpm lint | Lint with ESLint. |
pnpm test | Run unit tests (excludes smoke tests). |
pnpm test:smoke | Integration smoke tests against the real staging API (needs secrets). |
pnpm build | Bundle to dist/ with tsup. |
pnpm check | typecheck + lint + test in one go. |
Analytics (optional)
The server can report usage to Google Analytics 4 via the server-side Measurement Protocol. Because an MCP server has no browser, a GA/GTM JavaScript tag cannot run in it — the server sends events over HTTP instead. It works on both Node and Cloudflare Workers.
Analytics are off unless both GA_MEASUREMENT_ID and GA_API_SECRET are set.
Each tool call emits one mcp_tool_call event with categorical parameters —
tool, status, verdict, country, mcp_client, latency_bucket, error_kind.
By default no company names or free-text queries are sent to GA; the searched name
is only included (as the query param) if you opt in with CAPTURE_QUERY_NAMES — see below.
Setup:
- Create a GA4 property (free) and a Web data stream.
- In Admin → Data streams → your stream → Measurement Protocol API secrets, create a
secret. Copy the stream's Measurement ID (
G-XXXXXXXXXX) and the secret value. - Set
GA_MEASUREMENT_IDandGA_API_SECRET(env / Docker /wrangler secret). - In GA4, register the event params above as custom dimensions
(Admin → Custom definitions) so they appear in reports. Use
GA_DEBUG=trueto send to GA's validation endpoint while testing.
Unmet-demand analysis: setting CAPTURE_QUERY_NAMES=true records the searched company
name to the server's structured logs and sends it to GA4 as the query event param
(register a query custom dimension to see it). Off by default. Caveats: raw names are
high-cardinality in GA (bucketed as (other)) and person-named queries may count as PII
under GA's terms — a private log store is usually the better home for this, and you should
add a privacy-policy line before enabling it.
How it works
The server is a thin, stateless proxy with response shaping. An MCP client connects over stdio or stateless Streamable HTTP; a small Hono app (with @hono/mcp) constructs an MCP server per request, calls the SponsorFinder API with the server-side key, validates every response with zod (a contract-drift guard), and shapes it into a compact verdict. Register stats and filter values are cached in-process with a short TTL. Because the core uses only Web-standard APIs (fetch, URL), the same code runs on Node and Cloudflare Workers — only src/entry/* differs.
MCP client (Claude / ChatGPT / Cursor)
│ stdio or stateless Streamable HTTP
▼
SponsorFinder MCP server (Hono + @hono/mcp)
• 4 read-only tools, zod-validated
• x-api-key added server-side
• cached /status + /filters
│ HTTPS (x-api-key)
▼
SponsorFinder API → UK Home Office register + Dutch IND register
Data & disclaimer
The data comes from the official UK gov.uk register of licensed sponsors and the Dutch IND public register of recognised sponsors, refreshed daily.
This tool is informational only and is not legal advice. Register data can lag official publications, and a licence does not guarantee a company will sponsor any given role. Always verify against the official sources before making decisions.
Contributing
Issues and pull requests are welcome at github.com/alirezahamid/sponsor-finder-mcp. Please run pnpm check before opening a PR.
Publishing note:
server.jsonis the manifest for the official MCP registry. Before runningmcp-publisher publish, confirm the exact$schemaURL against the current registry.modelcontextprotocol.io docs — the schema version pinned here may have moved on.
License
MIT © 2026 Alireza Hamid