Sponsor MCPSafe10 founding slots
Registry/ato-mcp

ato-mcp

v2.2.1
Verified

Your AI agent, fluent in Australian tax. MCP server with cited answers from 34,500+ ATO documents, the income tax and GST Acts and 4,900+ rulings, plus deduction, depreciation, BAS and audit-risk tools that know your tax profile.

AGPL-3.0-only
typescript
developer tools
930.5Kdownloads
Scanned Oct 2, 2026
WebsiteRepositoryNPM
Automated scan (limited checks) · 2026-10-02

This grade comes from an automated MCPSafe scan of the server's JavaScript, TypeScript and Python source on 2026-10-02. It read the whole repository (11 files). It checks for leaked credentials, shell or code injection from function inputs, unsafe deserialization, malware signatures, install-time scripts, and weak password handling. It does not check for path traversal, server-side request forgery, prompt injection in tool descriptions, network exposure, SQL injection, cross-site scripting, or vulnerable dependencies. It has not been manually reviewed, and the code may have changed since the scan.

A+100%
Scanned 1w ago

Excellent Security

Vulnerabilities Found
0Crit
0High
0Med
0Low
0Info

Trust Score 82

Usable with caution
Trust grade B

Trust is stricter than security: it combines reviewed security, MCP capability risk, supply-chain metadata, quality, popularity, freshness, and penalties for unknowns.

Security
100
MCP risk
56
Supply chain
100
Maintenance
71
Docs
100
Freshness
80
Risk traits
Runs shell commands
Network/API access
Requires secrets
Remote transport
Why it scores well
  • • No reviewed severe vulnerabilities published
  • • Strong project quality signals
  • • Healthy maintenance cadence
  • • Good documentation surface
  • • Solid supply-chain metadata
What reduces confidence
  • • MCP risk traits: Runs shell commands, Network/API access, Requires secrets

Security ScoreA+

100
out of 100

Vulnerabilities Found

0
Crit
0
High
0
Medi
0
Low
0
Info
Last scanned: 10/2/2026

Quality ScoreB

75
out of 100
71
Maint.
45
Popular
100
Docs
78
Compat
Maintenance71%
Popularity45%
Documentation100%
Compatibility78%

Maintenance71

Unknown
Commit Frequency65%
Release Frequency70%
Issue Response80%

Popularity45

0
Stars
930.5K
Downloads
0
Forks
Stars Score0%
Downloads Score100%
Forks Score0%

Documentation100

README Quality100%

Available Documentation

API DocsExamplesChangelog

Compatibility78

MCP Spec Compliance80%
Transport Support75%

Features

TypeScript

Vulnerabilities(0)

This grade comes from an automated scan. Individual findings from automated scans are not published.

READMEato-mcp

View source

<div align="center">

Australian Tax MCP Server

The Australian tax knowledge base for AI agents.

Connect your AI agent to 34,500+ ATO documents (guidance, legislation, and

public rulings) and get cited answers to the tax questions you'd otherwise pay

your accountant to answer.

ato-mcp.com.au · Tool reference · Changelog

![CI](https://github.com/william-laverty/ato-mcp/actions/workflows/ci.yml)

![npm](https://www.npmjs.com/package/ato-mcp)

![License: AGPL-3.0](https://github.com/william-laverty/ato-mcp/blob/main/LICENSE)

![Node 22+](https://nodejs.org)

</div>

Quick start

Add the MCP Server to the client you already use.

Standard config works with most tools that run stdio servers:

json
{
  "mcpServers": {
    "ato": {
      "command": "npx",
      "args": ["-y", "ato-mcp"]
    }
  }
}
bash
npm install -g ato-mcp   # optional, npx works without installing

For hosts that natively support remote MCP servers, connect your client directly:

<details>

<summary><b>Claude Code</b></summary>

bash
claude mcp add --scope user --transport http ato https://api.ato-mcp.com.au/mcp

Then run /mcp inside Claude Code, select ato, and choose Authenticate.

Your browser opens to sign in.

</details>

<details>

<summary><b>Codex CLI</b></summary>

bash
codex mcp add ato --url https://api.ato-mcp.com.au/mcp
codex mcp login ato

codex mcp login opens your browser to sign in.

</details>

<details>

<summary><b>Gemini CLI</b></summary>

bash
gemini mcp add --scope user --transport http ato https://api.ato-mcp.com.au/mcp

Gemini CLI detects the auth challenge on first use and opens your browser

automatically.

</details>

<details>

<summary><b>VS Code (Copilot)</b></summary>

<img src="https://img.shields.io/badge/VS_Code-VS_Code?style=flat-square&label=Install%20Server&color=0098FF" alt="Install in VS Code"> <img alt="Install in VS Code Insiders" src="https://img.shields.io/badge/VS_Code_Insiders-VS_Code_Insiders?style=flat-square&label=Install%20Server&color=24bfa5">

Or from the command line:

bash
code --add-mcp '{"name":"ato","type":"http","url":"https://api.ato-mcp.com.au/mcp"}'

VS Code prompts to authenticate in your browser when the server first connects.

</details>

<details>

<summary><b>Cursor</b></summary>

<img src="https://cursor.com/deeplink/mcp-install-dark.svg" alt="Install in Cursor">

Or add to ~/.cursor/mcp.json:

json
{
  "mcpServers": {
    "ato": {
      "url": "https://api.ato-mcp.com.au/mcp"
    }
  }
}

Cursor shows a "Needs login" prompt on the server. Click it to sign in via your

browser.

</details>

<details>

<summary><b>Windsurf</b></summary>

Add to ~/.codeium/windsurf/mcp_config.json:

json
{
  "mcpServers": {
    "ato": {
      "type": "streamable-http",
      "serverUrl": "https://api.ato-mcp.com.au/mcp"
    }
  }
}

If Windsurf doesn't open a sign-in window, use the standard npm config at the top

of this section instead; it handles the browser sign-in itself.

</details>

<details>

<summary><b>Claude.ai / Claude Desktop</b></summary>

  1. Open Settings → Connectors
  2. Add custom connector
  3. Paste https://api.ato-mcp.com.au/mcp
  4. Click Connect and sign in when the browser window appears

Available on paid Claude plans. Claude Desktop can alternatively use the standard

npm config at the top of this section in claude_desktop_config.json.

</details>

<details>

<summary><b>ChatGPT</b></summary>

  1. Settings → Apps & Connectors → enable Developer Mode
  2. New connector → paste https://api.ato-mcp.com.au/mcp
  3. Choose OAuth and sign in when prompted

Requires a plan with connector support.

</details>

<details>

<summary><b>Other (OpenCode, Zed, etc)</b></summary>

Use the standard npm config at the top of this section. This package bridges any

stdio host to the hosted server with the same browser sign-in.

</details>

Full instructions: [ato-mcp.com.au/install](https://ato-mcp.com.au/install)

What's in the corpus

Everything the ATO publishes, in one searchable place, refreshed monthly:

| Source | Contents |

|---|---|

| ato.gov.au | 23,000+ guidance pages, forms & instructions, occupation guides, myTax help |

| Legislation | ITAA 1997, ITAA 1936 and the GST Act: 6,468 sections + 2,310 statutory definitions (point-in-time aware) |

| ATO public rulings | 4,900+ rulings across 10 types (TR, TD, GSTR, GSTD, PR, CR, LCR, PCG, MT, FTR), withdrawn rulings flagged |

| Cross-references | 64,217 links between rulings and legislation |

| Thresholds | Time-keyed values (instant asset write-off, GST registration, CGT discount, super caps, …) |

34,500+ documents (286,000+ searchable passages), refreshed monthly and

served from the hosted platform.

The 13 tools

Workflows are the reason this exists:

"Here's my bank transactions, what can I claim this year? How do I write off my new laptop? Is anything in my return risky?"

| Tool | What it does |

|---|---|

| deduction_discovery | Surfaces every deduction category that plausibly applies to your profile: a curated, cited taxonomy branched across sole traders, companies, trusts, partnerships, investors and SMSF members |

| depreciation_helper | Deterministic prime-cost / diminishing-value / instant-write-off / small-business-pool / Div 43 schedules for any asset, with the live IAWO threshold |

| bas_prep_checklist | A tiered, cited BAS checklist for your reporting period: which labels apply, what evidence to gather, the gotchas |

| audit_risk_check | Flags the patterns the ATO scrutinises in a draft return (WRE vs income, rental anomalies, unreported crypto, …) with risk bands and the guidance behind each flag |

Every workflow tool returns **structured data and resolvable ATO citations,

never advice in its own voice**.

Personal context: get_user_facts, 25 facts captured once at onboarding

(business structure, GST registration, investments, super type, residency, …)

so the agent never re-asks.

Retrieval: search (keyword and semantic retrieval), get_chunks,

get_doc, get_doc_anchors (cross-references), get_definition (statutory,

point-in-time), get_threshold (time-keyed values), fetch (live page fetch),

stats.

See the full tool reference.

Disclaimer

This service is provided as information infrastructure, not tax advice. It

does not consider your full financial circumstances and it is not a registered

tax agent service. Confidence ratings and risk bands are guides, not

professional judgement. Verify material decisions with a registered tax agent.

ato-mcp is an independent service. It is not affiliated with or endorsed by

the Australian Taxation Office. ATO content remains subject to ATO publication

terms. Legislation text is reproduced from the Federal Register of Legislation

under its open licensing.

See the Terms of Service &

Privacy Policy for more details.


License [AGPL-3.0](https://github.com/william-laverty/ato-mcp/blob/main/LICENSE) © William Laverty

The hosted platform and corpus are proprietary. Commercial licensing available on request.

Embed Security Badge

Add this badge to your README or documentation

ato-mcp MCPSafe Security
[![ato-mcp MCPSafe Security](https://api.mcpsafe.org
/api/badge/ato-mcp.svg)](https://mcpsafe.org/registry/ato-mcp)
Need more customization options?Badge Documentation

Server Information

Source
NPM
Package
ato-mcp
Version
2.2.1
Language
typescript
License
AGPL-3.0-only
Added
Aug 30, 2026
Updated
Sep 27, 2026