MODEL CONTEXT PROTOCOL
VATFind MCP.
Company facts for agents.
Give an MCP-compatible client a small, typed set of VATFind tools without copying API keys into prompts or configuration files.
https://mcp.vatfind.com/mcpAdd this URL as a custom MCP server. Your client discovers VATFind OAuth, opens the VATFind sign-in and consent screen, and receives a short-lived token scoped to your workspace.
In ChatGPT, add a custom MCP connection and paste the endpoint above. In Claude or another compatible client, create a remote HTTP MCP server with the same URL and choose OAuth when prompted. Exact menu labels vary by client version.
OAuth and permissions
VATFind uses authorization code flow with PKCE S256 and resource-bound bearer tokens. The authorization issuer is https://vatfind.com; the protected resource is exactly https://mcp.vatfind.com/mcp. Clients can discover metadata from the standard well-known URLs.
Protected resource metadata
https://mcp.vatfind.com/.well-known/oauth-protected-resource/mcp
Authorization server metadata
https://vatfind.com/.well-known/oauth-authorization-serverVATFind supports Client ID Metadata Documents and retains public-client dynamic registration as a compatibility fallback. Redirect URLs must use HTTPS, except HTTP loopback URLs for native clients. Access tokens expire after one hour, refresh tokens rotate automatically, and every invocation is checked against the requested resource and scopes. MCP currently runs against live processing; use REST with a vf_test_… key for deterministic sandbox fixtures.
Tool catalogue
| Tool | OAuth scope | Purpose |
|---|---|---|
check_vat_number | checks:run | Check VAT format and exact company-record association. |
find_vat_number | companies:search | Find company candidates from name or registration number. |
check_tax_identifier | checks:run | Check a non-VAT tax identifier without applying VAT claims. |
get_check | checks:read | Retrieve a prior result by check ID. |
get_country_capabilities | coverage:read | Read formats and supported verification dimensions. |
get_usage | usage:read | Read current-period usage and remaining live allowance. |
Useful prompts include “Check whether GB123456789 is associated with a company record,” “Find VAT candidates for Northstar Components in GB,” and “Explain which parts of a German VAT check VATFind supports.” The client—not VATFind—decides when to call a tool.
Agent-safe result semantics
Check tools return the same structured content as REST. They also include a concise text summary for clients that do not yet consume structured output.
The server instructs models to keep format_status, registry_match_status, tax_authority_status, and company_legal_status separate. A model must not call a VAT registration active when tax_authority_status is not_supported or not_checked.
Billable MCP calls use the same workspace credits and usage ledger as live REST calls. Read-only retrieval, coverage, and usage tools do not consume a credit. Check and search tools require an idempotency_key; reuse the same value when retrying the same operation within 24 hours.
Protocol and client compatibility
The endpoint uses stateless Streamable HTTP and implements MCP revision 2026-07-28 with per-request metadata, mirrored HTTP headers, server/discover, typed results, and cache hints. It also accepts the 2025-11-25 initialization flow for clients still completing the transition. There is no persistent MCP session, standalone GET event stream, or deprecated HTTP+SSE endpoint.
VATFind validates browser Origin headers, orders tools deterministically, defines strict JSON schemas, and checks tool scopes on every call. Tool invocation is limited to 60 calls per minute per connection and 120 per minute per workspace. Missing or expired credentials return 401 with protected-resource discovery; insufficient scopes return 403 with the scope required for step-up authorization.