Back to Browse

Validation Suite MCP Server

Developer ToolsModerate5.2MCP RegistryLocalRemote
Free

Server data from the Official MCP Registry

Validation suite: EU VAT (VIES), IBAN mod-97, email (MX+disposable), geo place lookup, VIN decode.

About

Validation suite: EU VAT (VIES), IBAN mod-97, email (MX+disposable), geo place lookup, VIN decode.

Remote endpoints: streamable-http: https://valid.fabtally.com/mcp

Security Report

5.2
Moderate5.2Moderate Risk

This is a well-designed MCP server that fronts a paid validation API without holding any private keys or sensitive credentials. The code is clean, properly structured with good error handling, and all network calls are appropriately scoped to the backend API. The primary design is stdio-based with an optional HTTP transport. No authentication vulnerabilities, malicious patterns, or dangerous code execution risks were identified. Supply chain analysis found 3 known vulnerabilities in dependencies (0 critical, 3 high severity).

5 files analyzed · 6 issues found

Security scores are indicators to help you make informed decisions, not guarantees. Always review permissions before connecting any MCP server.

Permissions Required

This plugin requests these system permissions. Most are normal for its category.

HTTP Network Access

Connects to external APIs or services over the internet.

env_vars

Check that this permission is expected for this type of plugin.

How to Install & Connect

Available as Local & Remote

This plugin can run on your machine or connect to a hosted endpoint. during install.

Documentation

View on GitHub

From the project's GitHub README.

FabTally Valid — MCP server

A developer validation suite — the per-call utilities incumbents charge for (Vatstack $0.01–0.09/call) or lock behind subscriptions, unified. Fronts the Valid HTTP API at https://valid.fabtally.com. Holds no private key.

Tools (all paid; a call with no payment returns the decoded x402 402 challenge)

ToolPriceWhat it does
validate_vat$0.003Flagship. EU/EEA VAT: {country_code, vat_number} → per-country format + checksum pre-check AND a live VIES lookup, returning valid/registered plus the registered company name & address when VIES has them (cached ~1h to shield the flaky VIES).
validate_iban$0.001{iban} → ISO 13616 length + mod-97 checksum, country, human-formatted grouping, and bank identifier (German Bankleitzahl, UK bank code + sort code, …) extracted from the BBAN where derivable. Pure-offline.
validate_email$0.002{email} → RFC-ish syntax + live MX-record (DNS) existence + disposable/throwaway-domain detection (bundled blocklist) + role-address flag (info@, admin@). Stateless & non-PII: the address is never stored and no SMTP mailbox is probed.
geo_lookup$0.002{query:"Munich, Bavaria, Germany"} or {country,state,city} → normalized names, ISO 3166-1/-2 codes, country→subdivision→city hierarchy, population and coordinates, over a bundled open dataset (no per-day API limits).
decode_vin$0.002{vin} → 17-char format + North-American check-digit validation and a full NHTSA vPIC decode: make, model, year, body class, engine, plant country. VIN-only (never plate→owner).

Every tool also accepts an optional x_payment (base64 x402 payload) that is forwarded as the X-PAYMENT header to settle the call and return the real result. Humans can instead prepay by card and use an X-FabTally-Key credit key against the HTTP API.

Transports

  • stdio (portable): npx fabtally-valid-mcp (bin: fabtally-valid-mcp)
  • streamable-http (hosted): https://valid.fabtally.com/mcp

Config: FABTALLY_VALID_BASE (default https://valid.fabtally.com).

Read-only, keyless, stateless, non-PII. Operated by Sunstone Soft (fabtally.com). Not legal, tax, or financial advice.

Reviews

No reviews yet

Be the first to review this server!