
Security News
Deno Goes the Way of the Dinosaur
Cloudflare is acquiring Deno’s team, which will provide another year of bug fixes and security updates before ending support for the runtime.
mcp-server-taxcode
Advanced tools
Enterprise-grade Model Context Protocol (MCP) server for Federal, Territorial, and Multi-State Tax Law.
Reference statutory catalog covering United States Federal (IRC/CFR), Puerto Rico (Act 60/Ley 1), and all 50 US States + District of Columbia with computational residency and capital gains models.
[!WARNING] NOT TAX OR LEGAL ADVICE / NO CONSTITUYE ASESORAMIENTO CONTRIBUTIVO NI LEGAL
EN: This software and its tools provide computational models, heuristic checks, and unofficial summaries for informational and research purposes only. Nothing returned by this server constitutes formal legal or tax advice, an official legal opinion, or audit representation. Unofficial translations and summaries are non-binding; official statutory and administrative sources in their enacted language control.
ES: Este software y sus herramientas proporcionan modelos computacionales, verificaciones heurísticas y resúmenes no oficiales únicamente para fines informativos y de investigación. Ninguna respuesta emitida por este servidor constituye asesoramiento legal o contributivo formal, una opinión legal oficial ni representación ante auditorías. Las traducciones y resúmenes no oficiales no son vinculantes; los textos estatutarios y administrativos oficiales promulgados en su idioma original prevalecen.
graph TD
Client["AI Agent / MCP Host<br>(Claude, Cursor, Antigravity, Snowflake Cortex)"]
Gateway["FastMCP Root Gateway<br>(stdio / streamable-http)"]
ParentMW["Parent Middleware<br>(Audit Logging, Timing, Secret Redaction, ReadOnly Gate)"]
SysSub["System Sub-server (mount: 'system')<br>• system_get_health_status<br>• taxcode://system/reference/capabilities"]
StatSub["Statutes Sub-server (mount: 'statutes')<br>• statutes_lookup_statute<br>• statutes_search_tax_code<br>• statutes_list_publications"]
CompSub["Compliance Sub-server (mount: 'compliance')<br>• compliance_evaluate_pr_bona_fide_residency<br>• compliance_calculate_built_in_gain_sourcing<br>• compliance_evaluate_georgia_residency<br>• compliance_evaluate_state_residency"]
DuckDB["DuckDB In-Memory & File Engine<br>(117 Statutes, 18 Publications, Full-Text Search, Temporal Versions)"]
Client <-->|"JSON-RPC (tools/list, tools/call)"| Gateway
Gateway --> ParentMW
ParentMW --> SysSub
ParentMW --> StatSub
ParentMW --> CompSub
StatSub <-->|"Point-in-Time & Full-Text Queries"| DuckDB
CompSub <-->|"Deterministic Statutory Calculations"| DuckDB
US): IRC § 1, § 24, § 32, § 61, § 62, § 63, § 865, § 911, § 933, § 937, § 957, § 1411, § 6012, § 6688, 26 CFR § 1.937-1/2/3, and IRS publications (Pub. 17, Pub. 54, Pub. 501, Pub. 505, Pub. 570, Pub. 1321).PR): Act 60-2019 (Resident Individual Investors, Export Services & Opportunity Zone definitions, Sec. 6020.10 annual reports), Ley 1-2011 (including Sec. 1031.02 exemptions and Sec. 1062.01 wage withholding and Sec. 1062.03 withholding on payments for services), Act 22-2012 predecessor versions, and administrative publications (CC RI 21-10, CC RI 25-12, CC RI 26-13, DA 21-04, DA 23-04, BI RI 26-02).statutes_search_tax_code matches and ranks on the full text but returns a short snippet (up to 300 characters around the first matched term) plus each result's id, citation, title, jurisdiction, year, validity and content labels. Pass an id to statutes_lookup_statute as citation_or_section for the full text.superseded_year filtering and descending historical ordering (tax_year parameter).evaluate_pr_bona_fide_residency: Evaluates IRC § 937 presence (183-day, 549-day 3-year, 90-day US), tax home, and closer connection tests.calculate_built_in_gain_sourcing: Allocates Section 937 / Act 60 capital gains across pre-move and post-move holding periods.evaluate_state_residency: Multi-state statutory presence day-counter, permanent place of abode (PPA), domicile audit risk flags, and tax liability computation across all 50 US states and District of Columbia (51 jurisdictions total).full, system, statutes, compliance, readonly.researcher (statutes + circulars), advisor (cross-border residency + BIG calculations).readOnlyHint=True).| Variable | CLI Flag | Default | Description |
|---|---|---|---|
TAXCODE_API_KEY | — | "" | Service API token for authentication |
TAXCODE_BASE_URL | — | https://api.example.com | Upstream REST API base URL |
TAXCODE_MCP_READONLY | — | 0 | Restrict server execution strictly to safe read-only inspection tools |
TAXCODE_MCP_PROFILE | --profile | full | Server profile: full, system, statutes, compliance, readonly, researcher, advisor |
TAXCODE_MCP_ENABLE_TOOL_SEARCH | --enable-tool-search | 0 | Replace flat catalog with dynamic search meta-tools (profile=full only) |
TAXCODE_MCP_ENABLE_CODE_MODE | --enable-code-mode | 0 | Experimental Code Mode on full (requires code-mode extra) |
TAXCODE_MCP_AUTH_TOKEN | — | "" | Shared bearer token for HTTP transports (streamable-http, sse) |
TAXCODE_MCP_ALLOW_UNAUTHENTICATED_BIND | — | 0 | Set to 1 (or true/yes/on) to let an HTTP transport bind a host other than 127.0.0.1, ::1 or localhost with no token. Without it, such a bind exits at startup |
Stdio is the default and needs no token. The HTTP transports follow the MCP guidance that a local server binds only to localhost and authenticates every connection:
127.0.0.1, ::1 or localhost (the --host default is 127.0.0.1), HTTP runs with or without TAXCODE_MCP_AUTH_TOKEN; without it, a warning says requests are not authenticated.0.0.0.0, ::, a LAN address), the server refuses to start unless TAXCODE_MCP_AUTH_TOKEN is set, or TAXCODE_MCP_ALLOW_UNAUTHENTICATED_BIND=1 accepts an unauthenticated bind (logged as a warning), for example behind a gateway that authenticates for you.Authorization: Bearer <token>; a missing or wrong token gets HTTP 401.session_idle_timeout (on http_app()) or FASTMCP_HTTP_SESSION_IDLE_TIMEOUT (seconds, or none to never expire); see the FastMCP 4.1.0 release and #5229.# Local HTTP, loopback only
taxcode-mcp --transport streamable-http
# Public HTTP with a token
TAXCODE_MCP_AUTH_TOKEN="$(openssl rand -hex 32)" \
taxcode-mcp --transport streamable-http --host 0.0.0.0 --allowed-host mcp.example.com
The image's default command is stdio, so it works as a stdio server out of the box:
docker run -i --rm -e TAXCODE_API_KEY=your-api-key ghcr.io/christianclaudio/mcp-server-taxcode:latest
To serve Streamable HTTP from the container, bind 0.0.0.0 inside it and pass a token:
docker run --rm -p 8000:8000 \
-e TAXCODE_API_KEY=your-api-key \
-e TAXCODE_MCP_AUTH_TOKEN=your-long-random-token \
ghcr.io/christianclaudio/mcp-server-taxcode:latest \
--transport streamable-http --host 0.0.0.0 --port 8000 --allowed-host mcp.example.com
This server works out-of-the-box with all major AI assistants, IDEs, and CLI tools via standard stdio or streamable-http.
The server is published on PyPI as mcp-server-taxcode, so you can run it directly with uvx mcp-server-taxcode without cloning or manually managing environments. Alternatively, run from a local clone with uv run --directory /path/to/mcp-server-taxcode taxcode-mcp.
Add to ~/Library/Application Support/Claude/claude_desktop_config.json (macOS) or %APPDATA%\Claude\claude_desktop_config.json (Windows):
{
"mcpServers": {
"taxcode": {
"command": "uvx",
"args": ["mcp-server-taxcode"]
}
}
}
For local development from a clone:
{
"mcpServers": {
"taxcode": {
"command": "uv",
"args": ["run", "--directory", "/absolute/path/to/mcp-server-taxcode", "taxcode-mcp"]
}
}
}
For Claude Code CLI:
claude mcp add taxcode -- uvx mcp-server-taxcode
Add to .agents/mcp_config.json (or global ~/.gemini/config/mcp_config.json):
{
"mcpServers": {
"taxcode": {
"command": "uvx",
"args": ["mcp-server-taxcode"]
}
}
}
Add to ~/.snowflake/cortex/mcp.json:
{
"mcpServers": {
"taxcode": {
"command": "uvx",
"args": ["mcp-server-taxcode"]
}
}
}
Add to ~/.cursor/mcp.json:
{
"mcpServers": {
"taxcode": {
"command": "uvx",
"args": ["mcp-server-taxcode"]
}
}
}
Add to cline_mcp_settings.json:
{
"mcpServers": {
"taxcode": {
"command": "uvx",
"args": ["mcp-server-taxcode"]
}
}
}
When developing, hardening, or extending MCP servers, consult the official framework and protocol references:
https://gofastmcp.com/llms.txt — Server composition (mount), hierarchical middleware, transforms (ToolTransform, ToolSearch), lifespans, and in-memory test clients.https://modelcontextprotocol.io/llms.txt — Official Spec (2026-07-28), wire-level JSON-RPC schemas, annotations, and transport framing.Connect your AI coding agent directly to live documentation servers:
https://gofastmcp.com/mcp (Tools: search_fast_mcp, query_docs_filesystem_fast_mcp, submit_feedback)https://modelcontextprotocol.io/mcp (Tools: search_model_context_protocol, query_docs_filesystem_model_context_protocol, submit_feedback){
"mcpServers": {
"fastmcp-docs": { "type": "sse", "url": "https://gofastmcp.com/mcp" },
"mcp-official-docs": { "type": "sse", "url": "https://modelcontextprotocol.io/mcp" }
}
}
# 1. Install dependencies from the lockfile
uv sync --locked --extra dev
# 2. Run unit tests with 100% coverage requirement
uv run pytest
# 3. Static type checks & linting
uv run mypy --strict src/
uv run ruff check .
uv run ruff format --check .
# 4. Tool contract, protocol & drift assertions
uv run python scripts/check_tool_contract.py
uv run python scripts/check_openapi_drift.py
uv run pytest tests/test_protocol.py
uv run pytest tests/test_e2e_live.py -m e2e # on demand; default CI uses -m 'not e2e'
./scripts/check_conformance.sh
# 5. AI code review gate (CodeRabbit)
coderabbit review --agent --uncommitted
Licensed under the Apache License 2.0. See LICENSE for details.
FAQs
Enterprise Model Context Protocol (MCP) server for Tax Code
We found that mcp-server-taxcode demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
Cloudflare is acquiring Deno’s team, which will provide another year of bug fixes and security updates before ending support for the runtime.

Security News
Anthropic’s free OSS Scanner uses Mythos and other Claude models to find open source vulnerabilities and send maintainers reports with proposed fixes.

Security News
On Front Lines’ Early Adopters: CISO podcast, Andrew Becherer shares lessons from Datadog, weighs the long-term costs of AI-built tools, and explains how founders can actually gain a CISO’s trust.