Skip to content
verify mcp Beta VerifyMCP is currently in beta. If you notice any issues, email [email protected] and we’ll put it right.

io.github.vatnode/vatnode-mcp

NPM · VATNODE-MCP · SCANNED AUG 3

Official MCP server: EU VAT validation via VIES, plus offline rates and format checks.

Available components

npm · vatnode-mcp 78
+35 this week 78 Trust /100
Trust breakdown (6 categories)

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score →

Supply Chain Security87
  • No malware found by supply-chain analysis.Pass
  • Only part of the dependency tree could be resolved (96 of 100), so this covers what we could see, not the whole tree.Partial
  • No install/post-install scripts declared.Pass
  • Only part of the dependency tree could be resolved (96 of 100), so this covers what we could see, not the whole tree. View diagnostics → Partial
Provenance & Transparency97
  • Source repository is publicly reachable at the declared URL. View diagnostics → Pass
  • Cryptographically verified build provenance (signed, bound to vatnode/vatnode-mcp). View diagnostics → Pass
  • Clear OSI-approved license (MIT).Pass
  • Actively maintained (last published 2 days ago).Pass
  • Disclosure check failed: no security disclosure policy was found in the source repository. See how to fix → Fail
Schema Quality & AI Usability71
  • AI-judged instruction clarity (excellent).Pass
  • Context-footprint check failed: tool/resource definitions use about 1030 tokens (~206/item across 5 items; 5 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
  • Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management23
  • Stability observed for 7 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage100
  • 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
  • 100% of tool parameters carry a description.Pass
Capabilities100
  • Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
Install

Add this component to your MCP client. Where a client-specific snippet is available, pick your client below and copy it straight into your config; otherwise use the connection detail shown.

npm · vatnode-mcp

# add to Claude Code
claude mcp add vatnode-vatnode-mcp -- npx -y vatnode-mcp
# add to Codex CLI
codex mcp add vatnode-vatnode-mcp -- npx -y vatnode-mcp
// opencode.json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "vatnode-vatnode-mcp": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "vatnode-mcp"
      ],
      "enabled": true
    }
  }
}
# add to OpenClaw
openclaw mcp add vatnode-vatnode-mcp --command npx --arg -y --arg vatnode-mcp
# ~/.hermes/config.yaml
mcp_servers:
  vatnode-vatnode-mcp:
    command: "npx"
    args: ["-y", "vatnode-mcp"]
// mcp.json
{
  "mcpServers": {
    "vatnode-vatnode-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "vatnode-mcp"
      ]
    }
  }
}
Changelog

Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.

  • 2 Aug 26 +41
    • Provenance: pass → unverified ▼ security
    • Install scripts: pass → unverified ▼ security
    • Known CVEs: unverified → partial ▲ security
    • Malware scan: unverified → pass ▲ security
    • The attested source repository moved: vatnode/vatnode-mcp security
    • Security disclosure: fail → unverified ▼ functional
    • License: pass → unverified ▼ functional
    • Tool coverage: 100 → unverified ▼ functional
    • Maintenance: pass → unverified ▼ functional
    • MCP protocol: unverified → pass ▲ functional
    • Stability: unverified → 0.20 ▲ functional
    • Dependency health: unverified → partial ▲ functional
    • Schema quality: unverified → excellent ▲ functional
    • Licence: MIT functional
  • 1 Aug 26 +32
    • Provenance: unverified → pass ▲ security
    • Install scripts: unverified → pass ▲ security
    • The attested source repository moved: vatnode/vatnode-mcp security
    • Tool coverage: unverified → 100 ▲ functional
    • License: unverified → pass ▲ functional
    • Maintenance: unverified → pass ▲ functional
    • Licence: MIT functional
  • 31 Jul 26 −20
    • We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
  • 30 Jul 26 −18
    • Malware scan: pass → unverified ▼ security
  • 27 Jul 26 43

    First indexed and scored.

Diagnostics

Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.

Captured 3 Aug 2026 · Analysed npm/[email protected]

Provenance verified

Ecosystem: npm · Outcome: verified

Reason: verified

Source repo:
vatnode/vatnode-mcp
Certificate issuer:
https://token.actions.githubusercontent.com
Certificate SAN:
https://github.com/vatnode/vatnode-mcp/.github/workflows/release.yml@refs/tags/v1.0.0
Rekor log index:
2300242055
Predicate type:
https://slsa.dev/provenance/v1
Subject digest:
sha512:bf9ff2427eb2f70dbdb7d821545d95d5972e3c865e029d8d2e40606647f1e9f743159b35eb4a5b1df63ba67024a22ccf0d264c4718bd406c15472bdb9
Discovery method:
attestation_endpoint
Dependencies 96 packages

96 packages in the resolved dependency tree · 95 deprecated · 29 stale.

The dependency tree was only partially resolved, so these counts may be incomplete.

MCP tools — 5 exposed · ~1,030 tokens

The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability.

Tool Tokens
check_vat_format ~176

Performs an offline syntactic check of a VAT number against the country-specific regex pattern. Read-only and offline: no network call, no API key, no rate limit, no side effects. Does NOT verify the VAT with VIES (a valid format does not mean the VAT is real or active) — use validate_vat_number for that. Output: { input, normalized, countryCode, validFormat (boolean), error }; countryCode is null when the prefix is unknown. Use when the user wants a quick sanity check on the shape of a VAT ID without burning a quota call. Free, no API key required.

NameTypeReqDescription
vatIdstringyesA VAT number, with or without spaces/dashes, with or without country prefix (e.g. "DE123456789", "IE 6388047 V").

No output schema declared.

No examples provided.

get_country_vat_rates ~227

Returns the standard, reduced, super-reduced and parking VAT rates for a single European country, plus the VAT number format and regex. Read-only and offline: no network call, no API key, no rate limit, no side effects. Accepts ISO 3166-1 alpha-2 codes (DE, FR, IT, …); also covers non-EU European jurisdictions where available (NO, CH, GB, UA, TR, …). Output: { countryCode, countryName, vatName, vatAbbr, currency, standardRate, reducedRates[], superReducedRate, parkingRate, vatNumberFormat, vatNumberPattern, updatedAt }; rates are percentages and may be null where not applicable. Returns an error if the country code is unknown. Use when the user asks "what is the VAT rate in X" or needs the VAT number format for a country. Free, no API key required.

NameTypeReqDescription
countryCodestringyesISO 3166-1 alpha-2 country code, e.g. "DE", "FR", "IT".

No output schema declared.

No examples provided.

list_eu_vat_rates ~169

Returns current VAT rates for all EU member states (plus XI for Northern Ireland). Read-only and offline: no network call, no API key, no rate limit, no side effects. Takes no arguments. Output: { rates: Array<{ countryCode, countryName, vatName, vatAbbr, currency, standardRate, reducedRates[], superReducedRate, parkingRate, vatNumberFormat, vatNumberPattern, updatedAt }>, count, updatedAt }. Rates are percentages (e.g. 25.5). Use when the user asks for an overview, a comparison across countries, or "all EU VAT rates". For a single country prefer get_country_vat_rates. Data is sourced from the EU Commission TEDB and updated daily. Free, no API key required.

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

list_supported_countries ~163

Returns every country the vatnode server has VAT data for (EU-27 + XI for Northern Ireland + ~17 other European jurisdictions such as NO, CH, GB, UA, TR). Read-only and offline: no network call, no API key, no rate limit, no side effects. Takes no arguments. Output: { countries: Array<{ countryCode, countryName, isEUMember, viesValidationSupported }>, count, euCount, updatedAt }, sorted by countryCode. `viesValidationSupported: true` means validate_vat_number can do live VIES verification; non-EU jurisdictions are rate-lookup only. Use to discover coverage or to pick a valid countryCode before calling get_country_vat_rates or validate_vat_number.

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

validate_vat_number ~295

Verifies an EU VAT number against the official VIES service and returns validity, company name, address, registration date and other metadata. When the requester (your own VAT) is configured on the vatnode account, also returns a VIES consultation number — audit-grade proof of validation. Use whenever the user wants to confirm a VAT is real, look up the company behind a VAT, or needs evidence for accounting/compliance. Side effects: makes an authenticated network call to api.vatnode.dev (which queries the EU VIES service) and consumes one request from your monthly quota; it is read-only (verifies, never mutates) and safe to retry. Requires a vatnode API key (free tier available; set VATNODE_API_KEY). Only EU-27 + XI (Northern Ireland) are supported by VIES; other countries return an error.

NameTypeReqDescription
requesterCountryCodestring—Optional: 2-letter country code of the party doing the check. Together with requesterVatNumber, asks VIES to issue an audit consultation number.
requesterVatNumberstring—Optional: VAT number of the party doing the check. Pair with requesterCountryCode to get a consultation number.
vatIdstringyesEU VAT number, with country prefix. Spaces and dashes are stripped. Examples: "DE123456789", "IE6388047V", "FR12345678901".

No output schema declared.

No examples provided.