Skip to content
verify mcp Beta VerifyMCP is currently in beta. If you notice any issues, email [email protected] and we’ll put it right.

io.github.vatnode/vatnode-mcp

NPM · VATNODE-MCP · SCANNED AUG 3

Official MCP server: EU VAT validation via VIES, plus offline rates and format checks.

Available components

+36 this week 79 Trust /100
Trust breakdown (6 categories)

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score →

Supply Chain Security90
  • No malware found by supply-chain analysis.Pass
  • Only part of the dependency tree could be resolved (96 of 100), so this covers what we could see, not the whole tree.Partial
  • No install/post-install scripts declared.Pass
  • Only part of the dependency tree could be resolved (96 of 100), so this covers what we could see, not the whole tree. View diagnostics → Partial
Provenance & Transparency97
  • Source repository is publicly reachable at the declared URL. View diagnostics → Pass
  • Cryptographically verified build provenance (signed, bound to vatnode/vatnode-mcp). View diagnostics → Pass
  • Clear OSI-approved license (MIT).Pass
  • Actively maintained (last published 0 days ago).Pass
  • Disclosure check failed: no security disclosure policy was found in the source repository. See how to fix → Fail
Schema Quality & AI Usability71
  • AI-judged instruction clarity (excellent).Pass
  • Context-footprint check failed: tool/resource definitions use about 1014 tokens (~202/item across 5 items; 5 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
  • Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management23
  • Stability observed for 7 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage100
  • 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
  • 100% of tool parameters carry a description.Pass
Capabilities100
  • Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
Install

Add this component to your MCP client. Where a client-specific snippet is available, pick your client below and copy it straight into your config; otherwise use the connection detail shown.

npm · vatnode-mcp

# add to Claude Code
claude mcp add vatnode-vatnode-mcp -- npx -y vatnode-mcp
# add to Codex CLI
codex mcp add vatnode-vatnode-mcp -- npx -y vatnode-mcp
// opencode.json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "vatnode-vatnode-mcp": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "vatnode-mcp"
      ],
      "enabled": true
    }
  }
}
# add to OpenClaw
openclaw mcp add vatnode-vatnode-mcp --command npx --arg -y --arg vatnode-mcp
# ~/.hermes/config.yaml
mcp_servers:
  vatnode-vatnode-mcp:
    command: "npx"
    args: ["-y", "vatnode-mcp"]
// mcp.json
{
  "mcpServers": {
    "vatnode-vatnode-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "vatnode-mcp"
      ]
    }
  }
}
Changelog

Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.

  • 3 Aug 26 +1
    • Package version: 1.0.0 → 1.1.0 functional
  • 2 Aug 26 +41
    • Provenance: pass → unverified security
    • Install scripts: pass → unverified security
    • Known CVEs: unverified → partial security
    • Malware scan: unverified → pass security
    • The attested source repository moved: vatnode/vatnode-mcp security
    • Security disclosure: fail → unverified functional
    • License: pass → unverified functional
    • Tool coverage: 100 → unverified functional
    • Maintenance: pass → unverified functional
    • MCP protocol: unverified → pass functional
    • Stability: unverified → 0.20 functional
    • Dependency health: unverified → partial functional
    • Schema quality: unverified → excellent functional
    • Licence: MIT functional
  • 1 Aug 26 +32
    • Install scripts: unverified → pass security
    • Provenance: unverified → pass security
    • The attested source repository moved: vatnode/vatnode-mcp security
    • License: unverified → pass functional
    • Tool coverage: unverified → 100 functional
    • Maintenance: unverified → pass functional
    • Licence: MIT functional
  • 31 Jul 26 −20
    • We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
  • 30 Jul 26 −18
    • Malware scan: pass → unverified security
  • 27 Jul 26 43

    First indexed and scored.

Diagnostics

Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.

Captured 3 Aug 2026 · Analysed npm/[email protected]

Provenance verified

Ecosystem: npm · Outcome: verified

Reason: verified

Source repo:
vatnode/vatnode-mcp
Certificate issuer:
https://token.actions.githubusercontent.com
Certificate SAN:
https://github.com/vatnode/vatnode-mcp/.github/workflows/release.yml@refs/tags/v1.1.0
Rekor log index:
2336893086
Predicate type:
https://slsa.dev/provenance/v1
Subject digest:
sha512:80bf8441d27566a6dc3b6419fdcce8cfcfd91a96aa64c2f3d8037019516a1b4800acc62c652ef508ad0727e7372dfc0410898407a768fc669ff3eb671
Discovery method:
attestation_endpoint
Dependencies 96 packages

96 packages in the resolved dependency tree · 61 deprecated · 29 stale.

The dependency tree was only partially resolved, so these counts may be incomplete.

MCP tools — 5 exposed · ~1,014 tokens

The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability.

Tool Tokens
check_vat_format ~176

Performs an offline syntactic check of a VAT number against the country-specific regex pattern. Read-only and offline: no network call, no API key, no rate limit, no side effects. Does NOT verify the VAT with VIES (a valid format does not mean the VAT is real or active) — use validate_vat_number for that. Output: { input, normalized, countryCode, validFormat (boolean), error }; countryCode is null when the prefix is unknown. Use when the user wants a quick sanity check on the shape of a VAT ID without burning a quota call. Free, no API key required.

NameTypeReqDescription
vatIdstringyesA VAT number, with or without spaces/dashes, with or without country prefix (e.g. "DE123456789", "IE 6388047 V").

No output schema declared.

No examples provided.

get_country_vat_rates ~227

Returns the standard, reduced, super-reduced and parking VAT rates for a single European country, plus the VAT number format and regex. Read-only and offline: no network call, no API key, no rate limit, no side effects. Accepts ISO 3166-1 alpha-2 codes (DE, FR, IT, …); also covers non-EU European jurisdictions where available (NO, CH, GB, UA, TR, …). Output: { countryCode, countryName, vatName, vatAbbr, currency, standardRate, reducedRates[], superReducedRate, parkingRate, vatNumberFormat, vatNumberPattern, updatedAt }; rates are percentages and may be null where not applicable. Returns an error if the country code is unknown. Use when the user asks "what is the VAT rate in X" or needs the VAT number format for a country. Free, no API key required.

NameTypeReqDescription
countryCodestringyesISO 3166-1 alpha-2 country code, e.g. "DE", "FR", "IT".

No output schema declared.

No examples provided.

list_eu_vat_rates ~169

Returns current VAT rates for all EU member states (plus XI for Northern Ireland). Read-only and offline: no network call, no API key, no rate limit, no side effects. Takes no arguments. Output: { rates: Array<{ countryCode, countryName, vatName, vatAbbr, currency, standardRate, reducedRates[], superReducedRate, parkingRate, vatNumberFormat, vatNumberPattern, updatedAt }>, count, updatedAt }. Rates are percentages (e.g. 25.5). Use when the user asks for an overview, a comparison across countries, or "all EU VAT rates". For a single country prefer get_country_vat_rates. Data is sourced from the EU Commission TEDB and updated daily. Free, no API key required.

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

list_supported_countries ~163

Returns every country the vatnode server has VAT data for (EU-27 + XI for Northern Ireland + ~17 other European jurisdictions such as NO, CH, GB, UA, TR). Read-only and offline: no network call, no API key, no rate limit, no side effects. Takes no arguments. Output: { countries: Array<{ countryCode, countryName, isEUMember, viesValidationSupported }>, count, euCount, updatedAt }, sorted by countryCode. `viesValidationSupported: true` means validate_vat_number can do live VIES verification; non-EU jurisdictions are rate-lookup only. Use to discover coverage or to pick a valid countryCode before calling get_country_vat_rates or validate_vat_number.

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

validate_vat_number ~279

Verifies an EU VAT number against the official VIES service and returns validity, company name, address, registration date and other metadata. The audit-grade VIES consultation number (`consultationNumber`) is produced when a requester VAT is configured once in the vatnode dashboard Settings — a one-time account setup, not a per-call parameter. With a requester configured, every response is either a success with a non-null `consultationNumber` or an error; without one, `consultationNumber` is null and national-registry fallback stays enabled. Use whenever the user wants to confirm a VAT is real, look up the company behind a VAT, or needs evidence for accounting/compliance. Side effects: makes an authenticated network call to api.vatnode.dev (which queries the EU VIES service) and consumes one request from your monthly quota; it is read-only (verifies, never mutates) and safe to retry. Requires a vatnode API key (free tier available; set VATNODE_API_KEY). Only EU-27 + XI (Northern Ireland) are supported by VIES; other countries return an error.

NameTypeReqDescription
vatIdstringyesEU VAT number, with country prefix. Spaces and dashes are stripped. Examples: "DE123456789", "IE6388047V", "FR12345678901".

No output schema declared.

No examples provided.