
Security News
Anthropic Identifies Biased Reasoning and Recklessness as Drivers of Claude’s PyPI Attack
Anthropic found biased reasoning and recklessness drove Claude Mythos 5 to publish malware on PyPI and compromise a security vendor.
@madtaco/mcp
Advanced tools
MCP server for the MadTaco verification API — tax IDs, IBANs, Chilean indicators, and more.
Verification & utility API for AI agents. Tax-ID validation, sanctions screening, company verification, and more — one API, prepaid credits, priced per call. Failed checks cost $0.
The MadTaco API is live. This package exposes it as MCP tools for Claude, Cursor, and any MCP-compatible agent.
npx @madtaco/mcp
No API key required for the tools in v1.0.0 — they map to MadTaco's free endpoints (50 requests/day per IP on the API). Set MADTACO_API_KEY later when paid tools ship in 1.1+ for higher limits.
| Tool | API endpoint | Description |
|---|---|---|
validate_tax_id | POST /v1/validate/tax-id | Format/checksum — CL RUT, MX RFC |
validate_iban | POST /v1/validate/iban | IBAN checksum and parsing |
get_cl_indicator | GET /v1/data/cl/{indicator} | UF, UTM, USD, EUR, IPC (CMF source) |
Every response includes credits_charged (always 0 for these tools).
Coming in 1.1+ (same package, grows with the API): create_account, verify_account, get_balance, get_usage, screen_sanctions, verify_company, inspect_domain, validate_email, validate_phone, screen, propose_check.
Add to claude_desktop_config.json:
macOS: ~/Library/Application Support/Claude/claude_desktop_config.json
Windows: %APPDATA%\Claude\claude_desktop_config.json
{
"mcpServers": {
"madtaco": {
"command": "npx",
"args": ["-y", "@madtaco/mcp"]
}
}
}
Restart Claude Desktop. You should see madtaco under MCP tools with the three validators above.
Validate the Chilean RUT
11.111.111-1using MadTaco.
Check whether IBAN
DE89 3704 0044 0532 0130 00is valid.
What's today's UF value in Chile?
Get the UF for 2026-07-01.
Claude will call validate_tax_id, validate_iban, or get_cl_indicator and return the JSON from the API.
Add to .cursor/mcp.json in your project (or global Cursor MCP settings):
{
"mcpServers": {
"madtaco": {
"command": "npx",
"args": ["-y", "@madtaco/mcp"]
}
}
}
| Variable | Required | Default | Description |
|---|---|---|---|
MADTACO_API_BASE | No | https://api.madtaco.dev/v1 | API base URL (override for staging) |
MADTACO_API_KEY | No | — | Optional X-Api-Key header; not needed for v1.0.0 tools |
Example with a custom base (local/staging):
{
"mcpServers": {
"madtaco": {
"command": "npx",
"args": ["-y", "@madtaco/mcp"],
"env": {
"MADTACO_API_BASE": "https://api.madtaco.dev/v1"
}
}
}
}
git clone https://github.com/madtaco-dev/mcp.git
cd mcp
npm install
npm run build
npm test
npm start
Stdio transport only. The server calls the public MadTaco HTTP API — no database, no secrets beyond an optional API key.
New tools ship as minor releases (1.1, 1.2, …) as the API grows. See llms.txt for the current tool list.
MIT © 🌮 MadTaco · Built for agents, literally.
FAQs
MadTaco MCP server — verification and trust checks for AI agents
The npm package @madtaco/mcp receives a total of 62 weekly downloads. As such, @madtaco/mcp popularity was classified as not popular.
We found that @madtaco/mcp demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
Anthropic found biased reasoning and recklessness drove Claude Mythos 5 to publish malware on PyPI and compromise a security vendor.

Research
/Security News
Malicious Chrome and Firefox extensions target Axiom Trade and Padre users, stealing session tokens and wallet data.

Security News
GPT-6 Astra hits 100% on ExploitBench and finds zero-days autonomously, while independent tests reveal scope violations and monitoring gaps.