Skip to content

Qiniso

by qinisolabs · remote · local (npm) · no sign-in to list tools · v0.5.1 · published by GitHub user qinisolabs

Deterministic fact verification for AI agents — checksums & curated data, not guesses.

Final · 1Changes · 5
CompareRegistry entry

56 tools: 1 do something that can't be undone, 5 change things and 50 only read.

Scanned Oct 21, 2026

2 checks matched something in the tool definitions. No finding is not a safety guarantee. How the checks work.

claude mcp add --transport http qiniso https://qiniso.qinisolabs.workers.dev/mcp

Findings

Matches of fixed checks, with the text they matched.

2 warn
  • Warnvalidate_codice_fiscale

    The server marks "validate_codice_fiscale" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

    Matched text

    annotations: {"readOnlyHint":true}; The name "validate_codice_fiscale" says "validate": a word for reading.

    What this check looks for
  • Warnformat_currency

    The server marks "format_currency" read-only (readOnlyHint: true), and its own name, description or input give the class "irreversible".

    Matched text

    annotations: {"readOnlyHint":true}; The input carries an amount (input.amount) and a currency, so it moves money.

    What this check looks for

Tools

Open a tool for its reasons and full description. Descriptions are the publisher's own words, shown as they are.

56 tools

Can't be undone 1Claude Code: ask
  • format_currencyUSE THIS to format a money amount the way a reader in a locale expects (symbol position, separators) before showing it in a price, invoice or email.1 finding

    Why it is in this group

    • The input carries an amount (input.amount) and a currency, so it moves money.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    Findings

    • Warn

      The server marks "format_currency" read-only (readOnlyHint: true), and its own name, description or input give the class "irreversible".

      Matched text

      annotations: {"readOnlyHint":true}; The input carries an amount (input.amount) and a currency, so it moves money.

      What this check looks for
    Description, as the server wrote it
    USE THIS to format a money amount the way a reader in a locale expects (symbol position, separators) before showing it in a price, invoice or email. e.g. 1234.5 GBP en-GB → '£1,234.50'.

    Annotations the server declares

    • title: Format Currency
    • readOnlyHint: true
Changes things 5Claude Code: ask
  • is_holidayUSE THIS to check whether a date is a public/bank holiday when computing business-day deadlines, delivery SLAs or 'next working day'.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    USE THIS to check whether a date is a public/bank holiday when computing business-day deadlines, delivery SLAs or 'next working day'. Supports ~200 countries (ISO code, e.g. GB, US, ZA, DE, IN); GB defaults to England — pass a subdivision ('SCT'/'WLS'/'NIR', or a US state) to narrow.

    Annotations the server declares

    • title: Is Holiday
    • readOnlyHint: true
  • parse_addressUSE THIS to extract structured {country, postcode, city, state} from a free-text UK or US address — when onboarding a user, running a KYC/fraud check, or storing an address — inste…No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    USE THIS to extract structured {country, postcode, city, state} from a free-text UK or US address — when onboarding a user, running a KYC/fraud check, or storing an address — instead of splitting the string yourself. Returns a confidence flag.

    Annotations the server declares

    • title: Parse Address
    • readOnlyHint: true
  • parse_dateUSE THIS to interpret a human-written date into ISO 8601 (YYYY-MM-DD), especially ambiguous numeric dates like 03/04/2025 which mean different things in the UK (day-first) vs US (m…No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    USE THIS to interpret a human-written date into ISO 8601 (YYYY-MM-DD), especially ambiguous numeric dates like 03/04/2025 which mean different things in the UK (day-first) vs US (month-first). Pass locale 'en-GB' or 'en-US'. Returns valid:false for impossible dates.

    Annotations the server declares

    • title: Parse Date
    • readOnlyHint: true
  • tax_rateUSE THIS before calculating VAT or sales tax on an invoice/quote — never recall the rate from memory, it is DATE-SENSITIVE.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    USE THIS before calculating VAT or sales tax on an invoice/quote — never recall the rate from memory, it is DATE-SENSITIVE. GB returns the UK standard VAT rate that applied on the given date (handles historical/temporary changes). US has no national VAT (returns 0); pass a state code for the state base sales-tax rate. Always pass the invoice date for GB.

    Annotations the server declares

    • title: Tax Rate
    • readOnlyHint: true
  • validate_codice_fiscaleUSE THIS to verify an Italian Codice Fiscale (personal tax code) before relying on it — do not guess the final check letter.1 finding

    Why it is in this group

    • The name "validate_codice_fiscale" says "validate": a word for reading.
    • The input takes a statement or command to run (input.code), which can change anything it can reach.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    Findings

    • Warn

      The server marks "validate_codice_fiscale" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

      Matched text

      annotations: {"readOnlyHint":true}; The name "validate_codice_fiscale" says "validate": a word for reading.

      What this check looks for
    Description, as the server wrote it
    USE THIS to verify an Italian Codice Fiscale (personal tax code) before relying on it — do not guess the final check letter. Checks the 16-character format and the mod-26 check character. Validates structure only; does NOT confirm the code is registered with the Agenzia delle Entrate.

    Annotations the server declares

    • title: Validate Codice Fiscale
    • readOnlyHint: true
Only reads 50Claude Code: allow, ask for 1 outbound
  • next_holidayUSE THIS to find the next public/bank holiday on or after a date (default today) — e.g.No findings

    Why it is in this group

    • The description's first verb is "find": a word for reading.
    Description, as the server wrote it
    USE THIS to find the next public/bank holiday on or after a date (default today) — e.g. to find the next working day. Supports ~200 countries (ISO code, e.g. GB, US, ZA, DE); subdivision narrows to a region.

    Annotations the server declares

    • title: Next Holiday
    • readOnlyHint: true
  • validate_aadhaarUSE THIS to verify the format and checksum of an Indian Aadhaar number — never assume 12 digits are valid.No findings

    Why it is in this group

    • The name "validate_aadhaar" says "validate": a word for reading.
    Description, as the server wrote it
    USE THIS to verify the format and checksum of an Indian Aadhaar number — never assume 12 digits are valid. Checks the Verhoeff check digit and the leading-digit rule. Validates structure only; does NOT look the number up.

    Annotations the server declares

    • title: Validate Aadhaar
    • readOnlyHint: true
  • validate_be_nrnUSE THIS to verify a Belgian National Register Number (Rijksregisternummer / Numéro de Registre National) before relying on it.No findings

    Why it is in this group

    • The name "validate_be_nrn" says "validate": a word for reading.
    Description, as the server wrote it
    USE THIS to verify a Belgian National Register Number (Rijksregisternummer / Numéro de Registre National) before relying on it. Checks the 11-digit form and the mod-97 check (handling the born-from-2000 rule). Validates structure only.

    Annotations the server declares

    • title: Validate Be NRN
    • readOnlyHint: true
  • validate_bg_egnUSE THIS to verify a Bulgarian EGN (Единен граждански номер) before relying on it.No findings

    Why it is in this group

    • The name "validate_bg_egn" says "validate": a word for reading.
    Description, as the server wrote it
    USE THIS to verify a Bulgarian EGN (Единен граждански номер) before relying on it. Checks the 10-digit form and the weighted mod-11 check digit. Validates structure only.

    Annotations the server declares

    • title: Validate BG EGN
    • readOnlyHint: true
  • validate_bsnUSE THIS to verify a Dutch BSN (burgerservicenummer / citizen service number) before relying on it.No findings

    Why it is in this group

    • The name "validate_bsn" says "validate": a word for reading.
    Description, as the server wrote it
    USE THIS to verify a Dutch BSN (burgerservicenummer / citizen service number) before relying on it. Checks the 8–9 digit form and the '11-test' (elfproef) checksum. Validates structure only; does NOT confirm the number is issued.

    Annotations the server declares

    • title: Validate BSN
    • readOnlyHint: true
  • validate_btc_addressUSE THIS to verify a Bitcoin address before sending funds or storing it — do not assume it is valid.No findings

    Why it is in this group

    • The name "validate_btc_address" says "validate": a word for reading.
    Description, as the server wrote it
    USE THIS to verify a Bitcoin address before sending funds or storing it — do not assume it is valid. Checks Base58Check (P2PKH/P2SH, double-SHA256 checksum) and Bech32/Bech32m SegWit (bc1…, incl. Taproot), and returns the address type and network. A bad checksum means a mistyped address.

    Annotations the server declares

    • title: Validate BTC Address
    • readOnlyHint: true
  • validate_cardUSE THIS to check a payment card number's structure before using it — never assume a card number is valid or guess its brand.No findings

    Why it is in this group

    • The name "validate_card" says "validate": a word for reading.
    Description, as the server wrote it
    USE THIS to check a payment card number's structure before using it — never assume a card number is valid or guess its brand. Verifies the Luhn checksum, detects the brand (Visa, Mastercard, Amex, Discover, Diners, JCB, UnionPay) from its BIN, and checks the length. Does NOT check whether the card is real, active or has funds.

    Annotations the server declares

    • title: Validate Card
    • readOnlyHint: true
  • validate_ch_ahvUSE THIS to verify a Swiss social-insurance number (AHV/AVS, 756.…) before relying on it.No findings

    Why it is in this group

    • The name "validate_ch_ahv" says "validate": a word for reading.
    Description, as the server wrote it
    USE THIS to verify a Swiss social-insurance number (AHV/AVS, 756.…) before relying on it. Checks the 13-digit form starting 756 and the EAN-13 check digit. Validates structure only.

    Annotations the server declares

    • title: Validate CH AHV
    • readOnlyHint: true
  • validate_china_ricUSE THIS to verify a Chinese Resident Identity Card number (居民身份证) before relying on it — do not guess the check character.No findings

    Why it is in this group

    • The name "validate_china_ric" says "validate": a word for reading.
    Description, as the server wrote it
    USE THIS to verify a Chinese Resident Identity Card number (居民身份证) before relying on it — do not guess the check character. Checks the 18-character form and the ISO 7064 MOD 11-2 check character (which may be 'X'). Validates structure only; does NOT confirm the number is registered.

    Annotations the server declares

    • title: Validate China RIC
    • readOnlyHint: true
  • validate_cnpjUSE THIS to verify a Brazilian CNPJ (company registration number) instead of trusting 14 digits.No findings

    Why it is in this group

    • The name "validate_cnpj" says "validate": a word for reading.
    Description, as the server wrote it
    USE THIS to verify a Brazilian CNPJ (company registration number) instead of trusting 14 digits. Checks the two mod-11 check digits. Call this for onboarding Brazilian businesses.

    Annotations the server declares

    • title: Validate CNPJ
    • readOnlyHint: true
  • validate_cpfUSE THIS to verify a Brazilian CPF (individual taxpayer ID) before relying on it — never assume 11 digits are valid.No findings

    Why it is in this group

    • The name "validate_cpf" says "validate": a word for reading.
    Description, as the server wrote it
    USE THIS to verify a Brazilian CPF (individual taxpayer ID) before relying on it — never assume 11 digits are valid. Checks the two mod-11 check digits and rejects all-identical sentinels. Call this for KYC/onboarding of Brazilian individuals.

    Annotations the server declares

    • title: Validate CPF
    • readOnlyHint: true
  • validate_cusipUSE THIS to verify a CUSIP (North American securities identifier) instead of trusting 9 characters.No findings

    Why it is in this group

    • The name "validate_cusip" says "validate": a word for reading.
    Description, as the server wrote it
    USE THIS to verify a CUSIP (North American securities identifier) instead of trusting 9 characters. Checks the CUSIP mod-10 check digit and returns the expected digit when it fails.

    Annotations the server declares

    • title: Validate CUSIP
    • readOnlyHint: true
  • validate_cz_rcUSE THIS to verify a Czech or Slovak rodné číslo (birth number) before relying on it.No findings

    Why it is in this group

    • The name "validate_cz_rc" says "validate": a word for reading.
    Description, as the server wrote it
    USE THIS to verify a Czech or Slovak rodné číslo (birth number) before relying on it. Checks the modern 10-digit form's mod-11 rule (9-digit pre-1954 numbers have no check digit). Validates structure only.

    Annotations the server declares

    • title: Validate CZ RC
    • readOnlyHint: true
  • validate_de_steuer_idUSE THIS to verify a German tax ID (Steuer-Identifikationsnummer / IdNr) before relying on it — never assume 11 digits are valid.No findings

    Why it is in this group

    • The name "validate_de_steuer_id" says "validate": a word for reading.
    Description, as the server wrote it
    USE THIS to verify a German tax ID (Steuer-Identifikationsnummer / IdNr) before relying on it — never assume 11 digits are valid. Checks the ISO 7064 product-method check digit. Validates structure only; does NOT confirm it is registered.

    Annotations the server declares

    • title: Validate DE Steuer ID
    • readOnlyHint: true
  • validate_dniUSE THIS to verify a Spanish DNI or NIE before relying on it — do not guess the control letter.No findings

    Why it is in this group

    • The name "validate_dni" says "validate": a word for reading.
    Description, as the server wrote it
    USE THIS to verify a Spanish DNI or NIE before relying on it — do not guess the control letter. Checks the mod-23 control letter and returns whether it is a DNI or NIE.

    Annotations the server declares

    • title: Validate DNI
    • readOnlyHint: true
  • validate_domainUSE THIS to verify a domain name's structure AND that its TLD is a real IANA-delegated suffix — instead of assuming a domain is legitimate.No findings

    Why it is in this group

    • The name "validate_domain" says "validate": a word for reading.
    Description, as the server wrote it
    USE THIS to verify a domain name's structure AND that its TLD is a real IANA-delegated suffix — instead of assuming a domain is legitimate. Catches invalid labels and made-up TLDs (e.g. example.corp). Returns the TLD and whether it is known.

    Annotations the server declares

    • title: Validate Domain
    • readOnlyHint: true
  • validate_ee_isikukoodUSE THIS to verify an Estonian isikukood (personal identification code) before relying on it.No findings

    Why it is in this group

    • The name "validate_ee_isikukood" says "validate": a word for reading.
    Description, as the server wrote it
    USE THIS to verify an Estonian isikukood (personal identification code) before relying on it. Checks the 11-digit form and the two-stage mod-11 check digit. Validates structure only.

    Annotations the server declares

    • title: Validate EE Isikukood
    • readOnlyHint: true
  • validate_emailUSE THIS to check an email address's syntax AND that its domain TLD is real, before saving or sending — instead of trusting raw input.No findings

    Why it is in this group

    • The name "validate_email" says "validate": a word for reading.
    Description, as the server wrote it
    USE THIS to check an email address's syntax AND that its domain TLD is real, before saving or sending — instead of trusting raw input. Validates the local part and domain (RFC 5321/5322 subset) and flags made-up TLDs. Does NOT check deliverability.

    Annotations the server declares

    • title: Validate Email
    • readOnlyHint: true
  • validate_eth_addressUSE THIS to verify an Ethereum address before sending funds or storing it — never trust that a 0x… string is correct.No findings

    Why it is in this group

    • The name "validate_eth_address" says "validate": a word for reading.
    Description, as the server wrote it
    USE THIS to verify an Ethereum address before sending funds or storing it — never trust that a 0x… string is correct. Validates the format and the EIP-55 mixed-case checksum (catches typos), and returns the correctly-checksummed form. A wrong character makes a different address — funds sent there are lost.

    Annotations the server declares

    • title: Validate ETH Address
    • readOnlyHint: true
  • validate_fodselsnummerUSE THIS to verify a Norwegian fødselsnummer (national identity number) before relying on it.No findings

    Why it is in this group

    • The name "validate_fodselsnummer" says "validate": a word for reading.
    Description, as the server wrote it
    USE THIS to verify a Norwegian fødselsnummer (national identity number) before relying on it. Checks the 11-digit form and both mod-11 control digits. Validates structure only; does NOT confirm the number is registered.

    Annotations the server declares

    • title: Validate Fodselsnummer
    • readOnlyHint: true
  • validate_fr_nirUSE THIS to verify a French social-security number (NIR / numéro de sécurité sociale, INSEE) before relying on it — do not guess the key.No findings

    Why it is in this group

    • The name "validate_fr_nir" says "validate": a word for reading.
    Description, as the server wrote it
    USE THIS to verify a French social-security number (NIR / numéro de sécurité sociale, INSEE) before relying on it — do not guess the key. Checks the 13-digit body (Corsica 2A/2B handled) and the mod-97 two-digit key. Validates structure only.

    Annotations the server declares

    • title: Validate FR NIR
    • readOnlyHint: true
  • validate_glnUSE THIS to verify a GLN (GS1 Global Location Number — identifies a company/site/location in supply chains and EDI) before relying on it.No findings

    Why it is in this group

    • The name "validate_gln" says "validate": a word for reading.
    Description, as the server wrote it
    USE THIS to verify a GLN (GS1 Global Location Number — identifies a company/site/location in supply chains and EDI) before relying on it. Checks the 13-digit GS1 mod-10 check digit and returns the GS1 prefix's issuing country. Validates structure only; does not confirm the location is registered.

    Annotations the server declares

    • title: Validate GLN
    • readOnlyHint: true
  • validate_gtinUSE THIS to verify a product barcode — GTIN/EAN/UPC — before trusting it, instead of guessing the check digit.No findings

    Why it is in this group

    • The name "validate_gtin" says "validate": a word for reading.
    Description, as the server wrote it
    USE THIS to verify a product barcode — GTIN/EAN/UPC — before trusting it, instead of guessing the check digit. Handles EAN-8, UPC-A (12), EAN-13 and GTIN-14, verifies the GS1 mod-10 check digit, and returns the barcode type plus the GS1 prefix's issuing country (e.g. 50 = UK, 690-699 = China, 978 = Bookland/ISBN). Validates structure only — it does NOT confirm the barcode maps to a real, registered product.

    Annotations the server declares

    • title: Validate GTIN
    • readOnlyHint: true
  • validate_hetuUSE THIS to verify a Finnish henkilötunnus (HETU / personal identity code) before relying on it — do not guess the check character.No findings

    Why it is in this group

    • The name "validate_hetu" says "validate": a word for reading.
    Description, as the server wrote it
    USE THIS to verify a Finnish henkilötunnus (HETU / personal identity code) before relying on it — do not guess the check character. Checks the DDMMYY + century sign + individual number + mod-31 check character. Validates structure only.

    Annotations the server declares

    • title: Validate Hetu
    • readOnlyHint: true
  • validate_hr_oibUSE THIS to verify a Croatian OIB (Osobni identifikacijski broj / personal identification number) before relying on it.No findings

    Why it is in this group

    • The name "validate_hr_oib" says "validate": a word for reading.
    Description, as the server wrote it
    USE THIS to verify a Croatian OIB (Osobni identifikacijski broj / personal identification number) before relying on it. Checks the 11-digit form and the ISO 7064 MOD 11,10 check digit. Validates structure only.

    Annotations the server declares

    • title: Validate HR Oib
    • readOnlyHint: true
  • validate_ibanUSE THIS to verify an IBAN (international bank account number) before relying on it — instead of guessing whether it looks right.No findings

    Why it is in this group

    • The name "validate_iban" says "validate": a word for reading.
    Description, as the server wrote it
    USE THIS to verify an IBAN (international bank account number) before relying on it — instead of guessing whether it looks right. Checks the country, the country-specific length, and the ISO 7064 mod-97 checksum, and returns the country, check digits and BBAN. Call this whenever a user supplies a bank account for a payment, payout or invoice.

    Annotations the server declares

    • title: Validate IBAN
    • readOnlyHint: true
  • validate_imeiUSE THIS to verify a phone/device IMEI before relying on it — never assume a 15-digit string is valid or guess its check digit.No findings

    Why it is in this group

    • The name "validate_imei" says "validate": a word for reading.
    Description, as the server wrote it
    USE THIS to verify a phone/device IMEI before relying on it — never assume a 15-digit string is valid or guess its check digit. Checks the Luhn check digit (and recognises the 16-digit IMEISV form), and returns the TAC (device-model code). Validates the number only — does NOT check whether the device is real, active, or blocklisted/stolen.

    Annotations the server declares

    • title: Validate IMEI
    • readOnlyHint: true
  • validate_ipUSE THIS to verify an IP address before relying on it — do not assume a dotted or colon string is valid.No findings

    Why it is in this group

    • The name "validate_ip" says "validate": a word for reading.
    Description, as the server wrote it
    USE THIS to verify an IP address before relying on it — do not assume a dotted or colon string is valid. Strictly checks IPv4 (RFC 791, rejects leading zeros / out-of-range octets) and IPv6 (RFC 4291, including '::' compression and embedded IPv4), and returns the version.

    Annotations the server declares

    • title: Validate IP
    • readOnlyHint: true
  • validate_isbnUSE THIS to verify an ISBN-13 book identifier instead of trusting that 13 digits are correct.No findings

    Why it is in this group

    • The name "validate_isbn" says "validate": a word for reading.
    Description, as the server wrote it
    USE THIS to verify an ISBN-13 book identifier instead of trusting that 13 digits are correct. Checks the 978/979 prefix and the mod-10 weighted check digit, and returns the expected check digit when it fails.

    Annotations the server declares

    • title: Validate ISBN
    • readOnlyHint: true
  • validate_isbn10USE THIS to verify an ISBN-10 (older book identifier) instead of trusting 10 characters.No findings

    Why it is in this group

    • The name "validate_isbn10" says "validate": a word for reading.
    Description, as the server wrote it
    USE THIS to verify an ISBN-10 (older book identifier) instead of trusting 10 characters. Checks the mod-11 check digit (which may be 'X'). For 13-digit ISBNs use validate_isbn.

    Annotations the server declares

    • title: Validate ISBN10
    • readOnlyHint: true
  • validate_isinUSE THIS to verify an ISIN (international securities identifier) before relying on it — never assume a 12-character code is valid.No findings

    Why it is in this group

    • The name "validate_isin" says "validate": a word for reading.
    Description, as the server wrote it
    USE THIS to verify an ISIN (international securities identifier) before relying on it — never assume a 12-character code is valid. Checks the format and the ISO 6166 Luhn check digit, and returns the country code. Call this when a user supplies a security/instrument identifier.

    Annotations the server declares

    • title: Validate ISIN
    • readOnlyHint: true
  • validate_issnUSE THIS to verify an ISSN (serial/journal identifier) before relying on it.No findings

    Why it is in this group

    • The name "validate_issn" says "validate": a word for reading.
    Description, as the server wrote it
    USE THIS to verify an ISSN (serial/journal identifier) before relying on it. Checks the mod-11 check digit (which may be 'X') and returns the expected digit when it fails.

    Annotations the server declares

    • title: Validate ISSN
    • readOnlyHint: true
  • validate_leiUSE THIS to verify a Legal Entity Identifier (LEI) before relying on it — do not assume a 20-character code is valid.No findings

    Why it is in this group

    • The name "validate_lei" says "validate": a word for reading.
    Description, as the server wrote it
    USE THIS to verify a Legal Entity Identifier (LEI) before relying on it — do not assume a 20-character code is valid. Checks the ISO 17442 / ISO 7064 MOD 97-10 check digits.

    Annotations the server declares

    • title: Validate LEI
    • readOnlyHint: true
  • validate_mx_curpUSE THIS to verify a Mexican CURP (Clave Única de Registro de Población) before relying on it — do not guess the check digit.No findings

    Why it is in this group

    • The name "validate_mx_curp" says "validate": a word for reading.
    Description, as the server wrote it
    USE THIS to verify a Mexican CURP (Clave Única de Registro de Población) before relying on it — do not guess the check digit. Checks the 18-character format and the base-37 check digit. Validates structure only.

    Annotations the server declares

    • title: Validate MX CURP
    • readOnlyHint: true
  • validate_nif_ptUSE THIS to verify a Portuguese NIF (Número de Identificação Fiscal / tax number) before invoicing or onboarding — never assume 9 digits are valid.No findings

    Why it is in this group

    • The name "validate_nif_pt" says "validate": a word for reading.
    Description, as the server wrote it
    USE THIS to verify a Portuguese NIF (Número de Identificação Fiscal / tax number) before invoicing or onboarding — never assume 9 digits are valid. Checks the mod-11 check digit. For the Spanish tax ID use validate_dni.

    Annotations the server declares

    • title: Validate NIF PT
    • readOnlyHint: true
  • validate_orcidUSE THIS to verify an ORCID researcher identifier instead of trusting 16 digits.No findings

    Why it is in this group

    • The name "validate_orcid" says "validate": a word for reading.
    Description, as the server wrote it
    USE THIS to verify an ORCID researcher identifier instead of trusting 16 digits. Checks the ISO 7064 MOD 11-2 check digit (which may be 'X'); accepts the bare ID or an orcid.org URL.

    Annotations the server declares

    • title: Validate ORCID
    • readOnlyHint: true
  • validate_personnummerUSE THIS to verify a Swedish personnummer (personal identity number) before relying on it — never assume the digits are valid.No findings

    Why it is in this group

    • The name "validate_personnummer" says "validate": a word for reading.
    Description, as the server wrote it
    USE THIS to verify a Swedish personnummer (personal identity number) before relying on it — never assume the digits are valid. Accepts the 10- or 12-digit form and checks the Luhn check digit. Validates structure only; does NOT confirm the number is registered.

    Annotations the server declares

    • title: Validate Personnummer
    • readOnlyHint: true
  • validate_peselUSE THIS to verify a Polish PESEL (national identification number) before relying on it — never assume 11 digits are valid.No findings

    Why it is in this group

    • The name "validate_pesel" says "validate": a word for reading.
    Description, as the server wrote it
    USE THIS to verify a Polish PESEL (national identification number) before relying on it — never assume 11 digits are valid. Checks the weighted mod-10 check digit. Call this for KYC/onboarding of Polish individuals.

    Annotations the server declares

    • title: Validate PESEL
    • readOnlyHint: true
  • validate_phoneUSE THIS to check a phone number is correctly formatted for its country and normalise it to E.164 before saving, dialling or texting.No findings

    Why it is in this group

    • The name "validate_phone" says "validate": a word for reading.
    Description, as the server wrote it
    USE THIS to check a phone number is correctly formatted for its country and normalise it to E.164 before saving, dialling or texting. You MUST pass the ISO country the number ACTUALLY belongs to (e.g. GB, US, ZA) — the result depends on it, so don't reuse an unrelated country field. 'valid' means it conforms to that country's numbering plan (plausible, well-formed), NOT that the line is live or reachable. Returns E.164, national/international formats and line type.

    Annotations the server declares

    • title: Validate Phone
    • readOnlyHint: true
  • validate_ro_cnpUSE THIS to verify a Romanian CNP (Cod Numeric Personal) before relying on it — never assume 13 digits are valid.No findings

    Why it is in this group

    • The name "validate_ro_cnp" says "validate": a word for reading.
    Description, as the server wrote it
    USE THIS to verify a Romanian CNP (Cod Numeric Personal) before relying on it — never assume 13 digits are valid. Checks the weighted mod-11 check digit. Validates structure only.

    Annotations the server declares

    • title: Validate RO CNP
    • readOnlyHint: true
  • validate_routingUSE THIS to verify a US bank routing / ABA transit number before relying on it for a payment or direct deposit.No findings

    Why it is in this group

    • The name "validate_routing" says "validate": a word for reading.
    Description, as the server wrote it
    USE THIS to verify a US bank routing / ABA transit number before relying on it for a payment or direct deposit. Checks the 9-digit weighted (3,7,1) mod-10 checksum. Does NOT check whether the bank or account is real.

    Annotations the server declares

    • title: Validate Routing
    • readOnlyHint: true
  • validate_sa_idUSE THIS to verify a South African ID number before relying on it.No findings

    Why it is in this group

    • The name "validate_sa_id" says "validate": a word for reading.
    Description, as the server wrote it
    USE THIS to verify a South African ID number before relying on it. Checks the Luhn check digit and date-of-birth validity, and returns the date of birth, gender and citizenship status encoded in the number.

    Annotations the server declares

    • title: Validate SA ID
    • readOnlyHint: true
  • validate_sedolUSE THIS to verify a SEDOL (LSE securities identifier) before relying on it.No findings

    Why it is in this group

    • The name "validate_sedol" says "validate": a word for reading.
    Description, as the server wrote it
    USE THIS to verify a SEDOL (LSE securities identifier) before relying on it. Checks the no-vowels alphabet and the weighted mod-10 check digit.

    Annotations the server declares

    • title: Validate SEDOL
    • readOnlyHint: true
  • validate_ssccUSE THIS to verify an SSCC (GS1 Serial Shipping Container Code — identifies a pallet/carton/logistics unit) from a shipping label before relying on it.No findings

    Why it is in this group

    • The name "validate_sscc" says "validate": a word for reading.
    Description, as the server wrote it
    USE THIS to verify an SSCC (GS1 Serial Shipping Container Code — identifies a pallet/carton/logistics unit) from a shipping label before relying on it. Checks the 18-digit GS1 mod-10 check digit and returns the extension digit and GS1 prefix country. Validates structure only.

    Annotations the server declares

    • title: Validate SSCC
    • readOnlyHint: true
  • validate_tcknUSE THIS to verify a Turkish T.C.No findings

    Why it is in this group

    • The name "validate_tckn" says "validate": a word for reading.
    Description, as the server wrote it
    USE THIS to verify a Turkish T.C. Kimlik No (TCKN / national identity number) before relying on it — never assume 11 digits are valid. Checks both algorithmic check digits and the leading-digit rule. Validates structure only; does NOT confirm the number is registered.

    Annotations the server declares

    • title: Validate TCKN
    • readOnlyHint: true
  • validate_tldUSE THIS to check whether a top-level domain is real before trusting a domain or link — do NOT guess whether a TLD like .zip, .corp, .crypto or .web exists.No findings

    Why it is in this group

    • The name "validate_tld" says "validate": a word for reading.
    Description, as the server wrote it
    USE THIS to check whether a top-level domain is real before trusting a domain or link — do NOT guess whether a TLD like .zip, .corp, .crypto or .web exists. Checks the suffix against the authoritative IANA root-zone list (kept current). Returns valid:false for TLDs that are not actually delegated.

    Annotations the server declares

    • title: Validate TLD
    • readOnlyHint: true
  • validate_urlUSE THIS to verify a URL before fetching or storing it — parses it with the WHATWG URL standard and additionally checks that the host's TLD is a real IANA suffix.Can send data outNo findings

    Why it is in this group

    • The name "validate_url" says "validate": a word for reading.

    What it can reach

    • outboundThe input takes a URL (input.url): a request to a URL can carry data to whoever runs it.

    Claude Code: ask, because it is tagged outbound.

    Description, as the server wrote it
    USE THIS to verify a URL before fetching or storing it — parses it with the WHATWG URL standard and additionally checks that the host's TLD is a real IANA suffix. Returns protocol, hostname, port, path and whether the TLD is known.

    Annotations the server declares

    • title: Validate URL
    • readOnlyHint: true
  • validate_uuidUSE THIS to verify a UUID and read its version/variant instead of guessing — e.g.No findings

    Why it is in this group

    • The name "validate_uuid" says "validate": a word for reading.
    Description, as the server wrote it
    USE THIS to verify a UUID and read its version/variant instead of guessing — e.g. to tell a v4 (random) from a v7 (time-ordered) UUID. Checks the canonical 8-4-4-4-12 form and returns version, variant and whether it is the nil UUID.

    Annotations the server declares

    • title: Validate UUID
    • readOnlyHint: true
  • validate_vatUSE THIS to verify an EU/EFTA VAT registration number's format and checksum before invoicing or onboarding a business — instead of trusting it looks right.No findings

    Why it is in this group

    • The name "validate_vat" says "validate": a word for reading.
    Description, as the server wrote it
    USE THIS to verify an EU/EFTA VAT registration number's format and checksum before invoicing or onboarding a business — instead of trusting it looks right. Covers all EU members plus UK/EFTA. Pass the full number incl. country prefix (e.g. DE136695976) or the digits plus a country code. NOTE: checks format+checksum only; does NOT confirm the number is live-registered (that is a VIES lookup).

    Annotations the server declares

    • title: Validate VAT
    • readOnlyHint: true
  • validate_vinUSE THIS to verify a vehicle VIN before acting on it — do not assume a 17-character string is a valid VIN.No findings

    Why it is in this group

    • The name "validate_vin" says "validate": a word for reading.
    Description, as the server wrote it
    USE THIS to verify a vehicle VIN before acting on it — do not assume a 17-character string is a valid VIN. Checks the allowed alphabet (no I/O/Q) and the ISO 3779 transliteration check digit in position 9, and returns the expected check digit when it fails.

    Annotations the server declares

    • title: Validate VIN
    • readOnlyHint: true

This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.

Exfil surface

Which tools read private data, which read text someone else can write, and which can send data out. One of each is a path a prompt injection can use.

No private-data, untrusted-input, outbound path in this server alone: no tool is tagged private-data or untrusted-input.

Reads private data0
Reads files, mail, messages, databases, secrets, calendars or repositories.
Reads text others write0
Brings in text someone else can write: web pages, inbound email, messages, issues and comments.
Can send data out1
Can carry data to people or systems: it sends, posts or publishes, or takes a recipient, channel or URL.

Other servers in the same agent add their own tools to these paths. Audit your whole setup to see them together.

Remote posture

What anyone on the internet sees at the remote endpoint: an anonymous initialize and tools/list, and the public OAuth metadata.

Looked at Oct 22, 2026, 15:04 UTC, unchanged since Oct 22, 2026. No credentials were sent and no tool was called. What is looked at.

Reachable
yes
HTTP status of an anonymous initialize
200
tools/list served without credentials
yes
Tools that change things, listed without credentials
6
Protocol version
2025-06-18
WWW-Authenticate on 401
not observed
resource_metadata in WWW-Authenticate
none
RFC 9728 protected resource metadata
none
Authorization servers
none
Legacy HTTP+SSE transport
no
Dynamic client registration
not observed
Client ID metadata documents
not observed
  • HighThe whole server

    The endpoint served tools/list without credentials, and the list has 6 tools that change things (1 irreversible, 5 write). Whether a call also works without credentials was not tested: tools are never called.

    Matched text

    https://qiniso.qinisolabs.workers.dev/mcp: tools/list returned 56 tools to an anonymous client, including format_currency (irreversible), validate_codice_fiscale (write), parse_date (write), is_holiday (write), tax_rate (write) and 1 more

    What this check looks for

Install

Pinned to version 0.5.1. Values in angle brackets are yours to fill in.

claude mcp add --transport http qiniso https://qiniso.qinisolabs.workers.dev/mcp

Run in a terminal.

Claude Code permissions

Allow the reads, ask before a change or a way out, deny the deletes. Paste into .claude/settings.json.

.claude/settings.json
{
  "permissions": {
    "allow": [
      "mcp__qiniso__validate_iban",
      "mcp__qiniso__validate_card",
      "mcp__qiniso__validate_isbn",
      "mcp__qiniso__validate_vin",
      "mcp__qiniso__validate_gtin",
      "mcp__qiniso__validate_imei",
      "mcp__qiniso__validate_gln",
      "mcp__qiniso__validate_sscc",
      "mcp__qiniso__validate_tld",
      "mcp__qiniso__validate_domain",
      "mcp__qiniso__validate_ip",
      "mcp__qiniso__validate_uuid",
      "mcp__qiniso__validate_email",
      "mcp__qiniso__validate_isin",
      "mcp__qiniso__validate_cusip",
      "mcp__qiniso__validate_sedol",
      "mcp__qiniso__validate_lei",
      "mcp__qiniso__validate_routing",
      "mcp__qiniso__validate_eth_address",
      "mcp__qiniso__validate_btc_address",
      "mcp__qiniso__validate_cpf",
      "mcp__qiniso__validate_cnpj",
      "mcp__qiniso__validate_sa_id",
      "mcp__qiniso__validate_dni",
      "mcp__qiniso__validate_aadhaar",
      "mcp__qiniso__validate_pesel",
      "mcp__qiniso__validate_bsn",
      "mcp__qiniso__validate_be_nrn",
      "mcp__qiniso__validate_personnummer",
      "mcp__qiniso__validate_fodselsnummer",
      "mcp__qiniso__validate_hetu",
      "mcp__qiniso__validate_nif_pt",
      "mcp__qiniso__validate_tckn",
      "mcp__qiniso__validate_china_ric",
      "mcp__qiniso__validate_de_steuer_id",
      "mcp__qiniso__validate_fr_nir",
      "mcp__qiniso__validate_ch_ahv",
      "mcp__qiniso__validate_mx_curp",
      "mcp__qiniso__validate_hr_oib",
      "mcp__qiniso__validate_ro_cnp",
      "mcp__qiniso__validate_bg_egn",
      "mcp__qiniso__validate_ee_isikukood",
      "mcp__qiniso__validate_cz_rc",
      "mcp__qiniso__validate_isbn10",
      "mcp__qiniso__validate_issn",
      "mcp__qiniso__validate_orcid",
      "mcp__qiniso__validate_phone",
      "mcp__qiniso__next_holiday",
      "mcp__qiniso__validate_vat"
    ],
    "ask": [
      "mcp__qiniso__validate_url",
      "mcp__qiniso__validate_codice_fiscale",
      "mcp__qiniso__parse_date",
      "mcp__qiniso__format_currency",
      "mcp__qiniso__is_holiday",
      "mcp__qiniso__tax_rate",
      "mcp__qiniso__parse_address"
    ],
    "deny": []
  }
}

Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. A read that can send data out (it takes a URL, say) asks first too. It assumes the server is installed as qiniso. Review it before you use it.

Capability tags behind 1 rule
  • mcp__qiniso__validate_url outbound