
Research
/Security News
Popular npm Packages in the keyv and Cacheable Namespaces Compromised in Active Supply Chain Attack
Popular npm packages keyv and cacheable compromised.
@validatefin/mcp
Advanced tools
MCP server to validate SEPA, UBL/Peppol, XRechnung, camt.052/053/054, ACH/NACHA files, IBANs and US ABA routing numbers, and convert MT940 and BAI2 to camt.053, locally with ValidateFin.
MCP server to validate SEPA, UBL/Peppol, camt.052/053/054 and ACH/NACHA e-invoice / payment files — 100% locally, no data leaves your machine. Powered by ValidateFin.
validate_sepa — SEPA Credit Transfer (pain.001) & Direct Debit (pain.008): validates against the official ISO 20022 XSD schemas and the EPC Rulebook business rules (IBAN mod-97, BIC, SEPA character set, mandates, Creditor Scheme Identifier, control sums).validate_ubl — UBL / Peppol BIS Billing 3.0: runs the official EN 16931 + Peppol BIS 3.0 Schematron — the same rule sets used by the official European e-invoicing validators — and returns the failed business rules with their official IDs (BR-, BR-CO-, Peppol rules). Accepts both the UBL and CII syntaxes (auto-detected).validate_xrechnung — German XRechnung (the German CIUS of EN 16931, mandatory for B2G): runs the official EN 16931 core Schematron + the KoSIT XRechnung BR-DE rules — the same rule sets as the official German validator. Accepts UBL and CII. Returns failed rules with their IDs (BR-, BR-DE-).validate_camt — ISO 20022 camt cash-management file — camt.053 (bank-to-customer statement), camt.052 (account report / intraday) or camt.054 (debit/credit notification), versions .02/.06/.08/.10/.11: extracts account, balances and entries (camt.053 also validated against the official ISO 20022 XSD schema).convert_mt940 — convert a legacy SWIFT MT940 bank statement (Customer Statement Message) to an ISO 20022 camt.053.001.02 XML statement: parses the balances and transactions, checks that opening balance + turnover = closing balance (RC/RD reversals handled), and returns the camt.053 XML.validate_ach — US ACH / NACHA file (fixed-width Nacha format): validates the 94-character record structure (File Header, Batch Header, Entry Detail, Addenda, Batch/File Control), the ABA routing-number check digit (3-7-1), the entry hash, and all batch & file control totals (debits, credits, entry/addenda count, block count).validate_iban — IBAN (mod-97 checksum, country & length).generate_camt_test — generate a camt.053 test statement from a pain.001 / pain.008 file.The XML validation tools take the file content as xml (a string) and return the
result (valid/invalid, errors, summary) as JSON. validate_ach and convert_mt940
take the raw file as content, validate_iban takes an iban string, and
generate_camt_test and convert_mt940 return the generated camt.053 XML.
Add this to your MCP client configuration (Claude Desktop, Cursor, etc.):
{
"mcpServers": {
"validatefin": { "command": "npx", "args": ["-y", "@validatefin/mcp"] }
}
}
Then ask your assistant to validate a SEPA, UBL/Peppol, camt.052/053/054 or ACH/NACHA file.
Validation runs entirely on your machine. No file or data is ever uploaded to a server — the same privacy guarantee as the ValidateFin website.
The MCP server code is MIT. It bundles third-party components under their own licenses:
ValidateFin is an independent tool and is not certified or endorsed by OpenPEPPOL, the European Commission, or any Peppol Authority. "Official" refers to the rule sets/schemas used, not to any accreditation of this tool.
FAQs
MCP server to validate SEPA, UBL/Peppol, XRechnung, KSeF FA(3), Romanian RO e-Factura (CIUS-RO), camt.052/053/054, ACH/NACHA, Canadian CPA-005/AFT, Belgian CODA and French CFONB 120 files, SEPA (EPC) and Swiss QR codes, IBANs and US ABA routing numbers, a
The npm package @validatefin/mcp receives a total of 29 weekly downloads. As such, @validatefin/mcp popularity was classified as not popular.
We found that @validatefin/mcp demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
Popular npm packages keyv and cacheable compromised.

Security News
A misconfiguration gave three Anthropic models internet access, and one, believing it was in a simulation, shipped a credential-stealing package to PyPI.

Security News
/Company News
Socket has joined the new Composer and Packagist sponsorship program as a launch sponsor, supporting the team that keeps PHP's package ecosystem secure.