Skip to content

Untax

io.untax/untaxuntax.iostreamable-httpv0.4.2Scanned

Source-backed property assessment research and draft assessment comparisons for supported pilot j...

20 tools: 1 can delete or cancel things, 7 change things and 12 only read.

Tools: 1 delete, 0 irreversible, 7 write, 12 read.
  • Reads private data · 0
  • Reads text others write · 18
  • Can send data out · 0
  • 1 finding

Anlyon alternative

8 of these tools change something. Run those as governed actions.

Declare what an action changes, and Anlyon puts it under a shared limit, binds every approval to the exact request, and grades the outcome. It works on any HTTPS API you can describe as an action.

Anlyon does not run, proxy or govern this MCP server. A tool your own code calls directly is not routed through Anlyon and is not governed by it.

Import an OpenAPI spec →

Tools

Grouped by what each tool does, most consequential first. Open one for its reasons and full description; descriptions are the publisher's own words.

20 tools

Deletes or cancels 1Claude Code: deny
  • disconnect_va_connectionDisconnect only this assistant's access to this account's shared VA verification when the user requests it.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Disconnect only this assistant's access to this account's shared VA verification when the user requests it. Requires owner:va. The saved account verification remains until the owner removes it in Account. Does not disconnect another account or assistant, submit a claim or alter VA records.

    Annotations the server declares

    • destructiveHint: true
    • idempotentHint: true
    • openWorldHint: false
    • readOnlyHint: false
Changes things 7Claude Code: ask
  • audit_microtransactionResearch an explicitly selected property and identify evidence requirements for a requested property-record service.Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Research an explicitly selected property and identify evidence requirements for a requested property-record service. Returns source observations and service capabilities; does not establish savings, quote a payable fee, inspect payment methods, charge, generate a filing packet or submit a correction. Sandbox checkout uses separate authenticated sandbox tools.

    Annotations the server declares

    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
    • readOnlyHint: true
  • complete_tax_sandbox_orderVerify fresh Stripe TEST payment for your own sandbox order and release its hash-bound draft packet and receipt.Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Verify fresh Stripe TEST payment for your own sandbox order and release its hash-bound draft packet and receipt. Records a simulated submission only; never submits a real appeal or changes county records. Requires owner:sandbox sign-in and a completed test checkout. Show the returned test checkout link when payment is pending. When an order_id is known, read the same order after checkout or an uncertain failure before retrying. If starting checkout fails before an order_id is returned, retry start_tax_sandbox with the original idempotency_key; do not create a new key for the same attempt. get_tax_sandbox_order and complete_tax_sandbox_order take only order_id. Report test payment, draft generation, download availability and external delivery as separate observed states. Do not claim the draft is available until the order confirms its artifact is available; a payment or download URL alone is not proof. A sandbox receipt or simulated submission is not county filing, external email delivery or permission for live payments.

    Annotations the server declares

    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
    • readOnlyHint: false
  • generate_veteran_packetGenerate a real free private Veteran REVIEW/DRAFT PDF from an explicitly selected saved review.1 finding

    Why it is in this group

    • The name "generate_veteran_packet" says "generate": a word for a change.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    Findings

    • Warn

      The server marks "generate_veteran_packet" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

      Matched text

      annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The name "generate_veteran_packet" says "generate": a word for a change.

      What this check looks for
    Description, as the server wrote it
    Generate a real free private Veteran REVIEW/DRAFT PDF from an explicitly selected saved review. Requires owner:read. Missing answers remain visible review questions; no VA connection is required. Supplemental answers remain reported and are not saved to the customer review. Optional connected VA facts require additional owner:va permission and explicit use for this applicant. Returns an expiring authenticated download of exact compiled bytes, not an official application, eligibility decision, savings estimate or filing.

    Annotations the server declares

    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
    • readOnlyHint: true
  • recheck_property_opportunitiesRecheck possible tax-reduction routes against current retained property records and a few owner-reported categories.Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Recheck possible tax-reduction routes against current retained property records and a few owner-reported categories. Returns research and next questions; answers never establish eligibility, verified evidence, savings, owner authority, payment or filing readiness. Do not send exact income, ages, identifiers, documents or a caller-supplied audit. For a property audit or a request to find tax-reduction routes, review opportunity_screen before concluding. A weak or held comparable-property analysis does not rule out independent relief, record corrections or billing research. Ask the next relevant unanswered targeted_questions item one at a time; use available_questions for relevant follow-ups. Accept none, not sure or skip, and do not repeat answered or skipped questions in this conversation unless the user changes the facts. After an answer, call recheck_property_opportunities for the same selected property and county with the accumulated explicit owner_answers and skipped_question_ids. Rechecks are stateless: resend still-applicable prior answers, preserve explicit false and empty arrays, and omit unknown or skipped fields instead of sending null or inventing a negative answer. Resend stable skipped_question_ids until the user supplies an answer or asks to revisit the question. Skips suppress prompts only and leave requirements unresolved. Do not transfer property-specific answers or skips to another property. When the user is done or skips the remaining questions, summarize supported research routes and missing evidence without treating unknowns as a denial. For a fact-only lookup, answer the requested fact and offer relevant screening without requiring an unrelated intake. Owner answers do not verify eligibility, savings, authority, payment or filing readiness.

    Annotations the server declares

    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
    • readOnlyHint: true
  • review_veteran_requirementsContinue a property-specific requirements conversation with accumulated explicit answers and, only when requested, the connected applicant's saved VA verification.Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Continue a property-specific requirements conversation with accumulated explicit answers and, only when requested, the connected applicant's saved VA verification. Requires owner:va. Disclose va_source.verified_at and freshness; a saved snapshot is not a current provider check. Ask returned questions one at a time; accept unknown or skip, preserve explicit false, and never reuse property-specific answers for another property. No eligibility decision, savings, generated application or filing.

    Annotations the server declares

    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
    • readOnlyHint: true
  • start_tax_sandboxStart an explicitly requested test-only appeal or property-record service checkout for one source-backed property.Reads text others writeNo findings

    Why it is in this group

    • The name "start_tax_sandbox" says "start": a word for a change.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Start an explicitly requested test-only appeal or property-record service checkout for one source-backed property. Requires owner:sandbox sign-in. Uses Stripe TEST mode and isolated orders; does not establish ownership, eligibility, savings or an open appeal window. Never charges real money or files with a county. Show the returned test checkout link when payment is pending. When an order_id is known, read the same order after checkout or an uncertain failure before retrying. If starting checkout fails before an order_id is returned, retry start_tax_sandbox with the original idempotency_key; do not create a new key for the same attempt. get_tax_sandbox_order and complete_tax_sandbox_order take only order_id. Report test payment, draft generation, download availability and external delivery as separate observed states. Do not claim the draft is available until the order confirms its artifact is available; a payment or download URL alone is not proof. A sandbox receipt or simulated submission is not county filing, external email delivery or permission for live payments.

    Annotations the server declares

    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
    • readOnlyHint: false
  • start_va_connectionStart an explicitly requested VA connection for this signed-in account and assistant.Reads text others writeNo findings

    Why it is in this group

    • The name "start_va_connection" says "start": a word for a change.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Start an explicitly requested VA connection for this signed-in account and assistant. Requires owner:va permission. Show connection_url to confirm the account and selected fields, review an existing saved verification or complete a new official VA sign-in, and approve this app's sharing separately. Verification is saved to the account only after approval. Return to this conversation and call get_va_connection afterward. The link itself grants no access; never request passwords, tokens, SSNs or full VA documents in chat.

    Annotations the server declares

    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: true
    • readOnlyHint: false
Only reads 12Show 12 read-only tools
  • find_va_facilitiesFind official VA facilities in an explicit state, optionally filtered by city and facility type.Reads text others writeNo findings

    Why it is in this group

    • The name "find_va_facilities" says "find": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Find official VA facilities in an explicit state, optionally filtered by city and facility type. Public information only. If location is missing, ask the returned question; do not infer a state or treat a VA facility as a county tax office or accredited VSO. Sandbox results are sample data.

    Annotations the server declares

    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
    • readOnlyHint: true
  • find_va_formsFind official VA forms by an explicit form number or search text.Reads text others writeNo findings

    Why it is in this group

    • The name "find_va_forms" says "find": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Find official VA forms by an explicit form number or search text. Ask what form or purpose is needed when query is missing. Show returned revision information and official PDF links; this does not complete or submit a claim.

    Annotations the server declares

    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
    • readOnlyHint: true
  • get_appeal_lifecycleRead a general assessment-review checklist.Reads text others writeNo findings

    Why it is in this group

    • The name "get_appeal_lifecycle" says "get": a word for reading.

    What it can reach

    • untrusted-inputThe description's first sentence says "read" and "review": it reads comments, which other people can write.
    Description, as the server wrote it
    Read a general assessment-review checklist. Takes no property inputs and does not check a filing window, deadline, fee, eligibility or outcome. Personal procedures require official property, jurisdiction and year review.

    Annotations the server declares

    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
    • readOnlyHint: true
  • get_microtransactions_catalogInspect an evidence-gated research inventory of property-tax review routes and actual session tool availability.Reads text others writeNo findings

    Why it is in this group

    • The name "get_microtransactions_catalog" says "get": a word for reading.

    What it can reach

    • untrusted-inputThe description's first sentence says "inspect" and "review": it reads comments, which other people can write.
    Description, as the server wrote it
    Inspect an evidence-gated research inventory of property-tax review routes and actual session tool availability. Each route reports held/unavailable/evidence_required and not_screened applicability; no eligibility, pricing, savings, automatic refund or filing readiness is established.

    Annotations the server declares

    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
    • readOnlyHint: true
  • get_owner_review_detailsRead one explicitly selected saved property review using the same source-bound service as the website.Reads text others writeNo findings

    Why it is in this group

    • The name "get_owner_review_details" says "get": a word for reading.

    What it can reach

    • untrusted-inputThe name "get_owner_review_details" says "get" and "review": it reads comments, which other people can write.
    • untrusted-inputThe description's first sentence says "read" and "review": it reads comments, which other people can write.
    Description, as the server wrote it
    Read one explicitly selected saved property review using the same source-bound service as the website. Requires both identifiers from get_owner_workspace and a live owner:read grant. Honor source_context_current and reconfirmation_required; never silently reuse stale previous_owner_answers. Ask relevant unanswered questions without repeating current answered or skipped items. User reports remain separate from county facts; changes and sensitive evidence belong in the protected browser review.

    Annotations the server declares

    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
    • readOnlyHint: true
  • get_owner_workspaceRead the signed-in owner's actual saved property reviews with a revocable owner:read grant.Reads text others writeNo findings

    Why it is in this group

    • The name "get_owner_workspace" says "get": a word for reading.

    What it can reach

    • untrusted-inputThe description's first sentence says "read" and "review": it reads comments, which other people can write.
    Description, as the server wrote it
    Read the signed-in owner's actual saved property reviews with a revocable owner:read grant. Returns explicit property and review identifiers; no active property is assumed. Ask the user to select a review when the target is ambiguous. Does not establish ownership, benefit eligibility, savings or filing authority.

    Annotations the server declares

    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
    • readOnlyHint: true
  • get_property_assessmentGet retained county assessment observations and source provenance for a supported address or parcel ID.Reads text others writeNo findings

    Why it is in this group

    • The name "get_property_assessment" says "get": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Get retained county assessment observations and source provenance for a supported address or parcel ID. Missing facts stay unavailable; commercial source area is not finished living area. Any comparison is a draft with evidence holds and does not establish personal tax savings or filing readiness. For a property audit or a request to find tax-reduction routes, review opportunity_screen before concluding. A weak or held comparable-property analysis does not rule out independent relief, record corrections or billing research. Ask the next relevant unanswered targeted_questions item one at a time; use available_questions for relevant follow-ups. Accept none, not sure or skip, and do not repeat answered or skipped questions in this conversation unless the user changes the facts. After an answer, call recheck_property_opportunities for the same selected property and county with the accumulated explicit owner_answers and skipped_question_ids. Rechecks are stateless: resend still-applicable prior answers, preserve explicit false and empty arrays, and omit unknown or skipped fields instead of sending null or inventing a negative answer. Resend stable skipped_question_ids until the user supplies an answer or asks to revisit the question. Skips suppress prompts only and leave requirements unresolved. Do not transfer property-specific answers or skips to another property. When the user is done or skips the remaining questions, summarize supported research routes and missing evidence without treating unknowns as a denial. For a fact-only lookup, answer the requested fact and offer relevant screening without requiring an unrelated intake. Owner answers do not verify eligibility, savings, authority, payment or filing readiness.

    Annotations the server declares

    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
    • readOnlyHint: true
  • get_tax_sandbox_orderRead your own isolated Untax test order.Reads text others writeNo findings

    Why it is in this group

    • The name "get_tax_sandbox_order" says "get": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Read your own isolated Untax test order. Requires owner:sandbox sign-in. Payment and draft delivery statuses are separate from production eligibility or county filing. Show the returned test checkout link when payment is pending. When an order_id is known, read the same order after checkout or an uncertain failure before retrying. If starting checkout fails before an order_id is returned, retry start_tax_sandbox with the original idempotency_key; do not create a new key for the same attempt. get_tax_sandbox_order and complete_tax_sandbox_order take only order_id. Report test payment, draft generation, download availability and external delivery as separate observed states. Do not claim the draft is available until the order confirms its artifact is available; a payment or download URL alone is not proof. A sandbox receipt or simulated submission is not county filing, external email delivery or permission for live payments.

    Annotations the server declares

    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
    • readOnlyHint: true
  • get_va_connectionRead the dated, minimized VA verification explicitly shared with this account and assistant.Reads text others writeNo findings

    Why it is in this group

    • The name "get_va_connection" says "get": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Read the dated, minimized VA verification explicitly shared with this account and assistant. Requires owner:va and live sharing permission; browser sign-in alone does not grant access. The saved account snapshot survives provider-session expiry and server restart. Disclose verified_at and freshness; saved facts are not a live provider check and may need reverification. Expired or revoked app permission stops sharing. These facts do not establish property ownership, primary residence, tax eligibility or filing authority.

    Annotations the server declares

    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
    • readOnlyHint: true
  • get_va_facilityRead one official VA facility selected by its returned id.Reads text others writeNo findings

    Why it is in this group

    • The name "get_va_facility" says "get": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Read one official VA facility selected by its returned id. Returns available address, telephone and website information with source and environment. No Veteran records or eligibility determination.

    Annotations the server declares

    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
    • readOnlyHint: true
  • get_va_formLook up an explicit VA form number, such as 21-0966, and return available title, revision information and official PDF link.Reads text others writeNo findings

    Why it is in this group

    • The name "get_va_form" says "get": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Look up an explicit VA form number, such as 21-0966, and return available title, revision information and official PDF link. Use form_name from search results for this lookup; the separate catalog id is not a form number. If form_name is missing, ask for the form number. A form link is not a completed application, submission or proof of eligibility.

    Annotations the server declares

    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
    • readOnlyHint: true
  • suggest_addressesSearch retained county-roll address candidates for partial queries and typos.Reads text others writeNo findings

    Why it is in this group

    • The description's first verb is "search": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Search retained county-roll address candidates for partial queries and typos. If the intended property is ambiguous, show the relevant candidates and ask the user to select one before continuing with property-specific conclusions or actions. Similarity scores and is_auto_match are matching hints, not a user selection, verified owner authority or financial eligibility.

    Annotations the server declares

    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
    • readOnlyHint: true

This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.

Exfil surface

Which tools read private data, which read text someone else can write, and which can send data out. One of each is a path a prompt injection can use.

No private-data, untrusted-input, outbound path in this server alone: no tool is tagged private-data or outbound.

Reads private data0
Reads files, mail, messages, databases, secrets, calendars or repositories.
Can send data out0
Can carry data to people or systems: it sends, posts or publishes, or takes a recipient, channel or URL.

Other servers in the same agent add their own tools to these paths. Audit your whole setup to see them together.

Findings

Matches of fixed checks, with the text they matched.

1 warn
  • The server marks "generate_veteran_packet" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

    Matched text

    annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The name "generate_veteran_packet" says "generate": a word for a change.

    What this check looks for

History

Changes to its tool definitions and to its remote endpoint, newest first.

No change seen yet. Its tools are rescanned every day, and a remote endpoint is looked at once a week.

Install

Pinned to version 0.4.2. Values in angle brackets are yours to fill in.

claude mcp add --transport http untax https://untax.io/api/v1/mcp
claude mcp add --transport http untax https://untax.io/api/v1/mcp

Run in a terminal.

Claude Code permissions

Allow the reads, ask before a change or a way out, deny the deletes. Paste into .claude/settings.json.

.claude/settings.json
{
  "permissions": {
    "allow": [
      "mcp__untax__suggest_addresses",
      "mcp__untax__get_property_assessment",
      "mcp__untax__get_owner_workspace",
      "mcp__untax__get_owner_review_details",
      "mcp__untax__find_va_facilities",
      "mcp__untax__get_va_facility",
      "mcp__untax__find_va_forms",
      "mcp__untax__get_va_form",
      "mcp__untax__get_va_connection",
      "mcp__untax__get_microtransactions_catalog",
      "mcp__untax__get_appeal_lifecycle",
      "mcp__untax__get_tax_sandbox_order"
    ],
    "ask": [
      "mcp__untax__recheck_property_opportunities",
      "mcp__untax__start_va_connection",
      "mcp__untax__review_veteran_requirements",
      "mcp__untax__generate_veteran_packet",
      "mcp__untax__audit_microtransaction",
      "mcp__untax__start_tax_sandbox",
      "mcp__untax__complete_tax_sandbox_order"
    ],
    "deny": [
      "mcp__untax__disconnect_va_connection"
    ]
  }
}

Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. A read that can send data out (it takes a URL, say) asks first too. It assumes the server is installed as untax. Review it before you use it.

Capability tags behind 18 rules
  • mcp__untax__suggest_addresses untrusted-input
  • mcp__untax__get_property_assessment untrusted-input
  • mcp__untax__recheck_property_opportunities untrusted-input
  • mcp__untax__get_owner_workspace untrusted-input
  • mcp__untax__get_owner_review_details untrusted-input
  • mcp__untax__find_va_facilities untrusted-input
  • mcp__untax__get_va_facility untrusted-input
  • mcp__untax__find_va_forms untrusted-input
  • mcp__untax__get_va_form untrusted-input
  • mcp__untax__start_va_connection untrusted-input
  • mcp__untax__get_va_connection untrusted-input
  • mcp__untax__review_veteran_requirements untrusted-input
  • mcp__untax__get_microtransactions_catalog untrusted-input
  • mcp__untax__audit_microtransaction untrusted-input
  • mcp__untax__get_appeal_lifecycle untrusted-input
  • mcp__untax__start_tax_sandbox untrusted-input
  • mcp__untax__get_tax_sandbox_order untrusted-input
  • mcp__untax__complete_tax_sandbox_order untrusted-input

Pin

Keep the decision: fail CI when the tools change, follow every change, or show a badge.

Pin in CI

Fail a build when the tools you reviewed are not the tools the server serves today.

curl -s "https://anlyon.dev/api/v1/servers/io.untax/untax/verify?hash=87f808efaa24f539b3aa734616955b85e1bd266c252c2175f98ae586b76ea6c6" | jq -e '.changed == false'

Pinned hash 87f808efaa24, from Oct 26, 2026, 14:18 UTC.

Watch

Get told when its tools change: a new tool, a new description, a new class.

https://anlyon.dev/servers/io.untax/untax/changes.xml

An Atom feed. Works in any feed reader or Slack's RSS app.

Badge

anlyon.dev badge for io.untax/untax
[![anlyon.dev](https://anlyon.dev/badge/io.untax/untax.svg)](https://anlyon.dev/servers/io.untax/untax)

Source: MCP Registry · repository. Synced Oct 26, 2026, 14:18 UTC.