Skip to content

Taggun MCP by usefulapi

by usefulapi.io · remote · no sign-in to list tools · v1.3.3 · published by io.usefulapi

Scan receipts with Taggun OCR from a URL or file and read receipt-validation campaigns.

Changes · 3
CompareRegistry entry

6 tools: 3 change things and 3 only read.

Scanned Oct 21, 2026

1 check matched something in the tool definitions. No finding is not a safety guarantee. How the checks work.

claude mcp add --transport http taggun https://taggun.usefulapi.io/mcp

Findings

Matches of fixed checks, with the text they matched.

1 info

Tools

Open a tool for its reasons and full description. Descriptions are the publisher's own words, shown as they are.

6 tools

Changes things 3Claude Code: ask
  • taggun_scan_receipt_base64WRITE: this scan counts against YOUR Taggun quota and plan (free for the first 30 days or 1,000 scans, then billed per scan by Taggun), even if the receipt fails validation; it is …No findings

    Why it is in this group

    • The description's first verb is "write": a word for a change.
    Description, as the server wrote it
    WRITE: this scan counts against YOUR Taggun quota and plan (free for the first 30 days or 1,000 scans, then billed per scan by Taggun), even if the receipt fails validation; it is never retried automatically. Document content is not logged by this server. Extract structured data from a receipt or invoice sent as base64 (JPEG, PNG, GIF, HEIF/HEIC or PDF; the base64 text is capped at 2,000,000 characters, about 1.5 MB of file; for larger files use taggun_scan_receipt_url). POST /api/receipt/v1/{simple|verbose}/encoded.

    Annotations the server declares

    • title: Scan a receipt or invoice from base64 data
    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: true
  • taggun_scan_receipt_urlWRITE: this scan counts against YOUR Taggun quota and plan (free for the first 30 days or 1,000 scans, then billed per scan by Taggun), even if the receipt fails validation; it is …1 finding

    Why it is in this group

    • The description's first verb is "write": a word for a change.

    Findings

    • Info

      The description mentions "credentials".

      Matched text

      description: "...P addresses, localhost, internal names, credentials or non-default ports. POST /api/receipt..."

      What this check looks for
    Description, as the server wrote it
    WRITE: this scan counts against YOUR Taggun quota and plan (free for the first 30 days or 1,000 scans, then billed per scan by Taggun), even if the receipt fails validation; it is never retried automatically. Document content is not logged by this server. Extract structured data (merchant, date, total, tax, and in verbose mode line items) from a receipt or invoice at a public https URL (JPEG, PNG, GIF, HEIF/HEIC or PDF up to 5 pages, max 20 MiB). The URL must be a public host name: no IP addresses, localhost, internal names, credentials or non-default ports. POST /api/receipt/v1/{simple|verbose}/url.

    Annotations the server declares

    • title: Scan a receipt or invoice from a URL
    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: true
  • taggun_validate_receipt_campaign_urlWRITE: this scan counts against YOUR Taggun quota and plan (free for the first 30 days or 1,000 scans, then billed per scan by Taggun), even if the receipt fails validation; it is …No findings

    Why it is in this group

    • The name "taggun_validate_receipt_campaign_url" says "validate": a word for reading.
    • The description's first verb is "write": a word for a change.
    Description, as the server wrote it
    WRITE: this scan counts against YOUR Taggun quota and plan (free for the first 30 days or 1,000 scans, then billed per scan by Taggun), even if the receipt fails validation; it is never retried automatically. Document content is not logged by this server. Scan a receipt at a public https URL and check it against the rules of a campaign stored on your Taggun account (dates, merchants, products, balance owing, fraud checks). Returns pass/fail with reasons. Needs the Campaign Validation feature on your Taggun plan; use taggun_list_campaigns for the ids. Same URL rules as taggun_scan_receipt_url. POST /api/validation/v1/campaign/receipt-validation/url.

    Annotations the server declares

    • title: Validate a receipt against a stored campaign
    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: true
Only reads 3Claude Code: allow
  • taggun_export_reference_dataRead the reference data stored on your Taggun account as CSV: product_categories (the category taxonomy), known_merchants (merchant names and locations used for matching) or produc…No findings

    Why it is in this group

    • The description's first verb is "read": a word for reading.
    Description, as the server wrote it
    Read the reference data stored on your Taggun account as CSV: product_categories (the category taxonomy), known_merchants (merchant names and locations used for matching) or product_codes (expected product codes). Read-only; does not use a scan. The text is cut at 40,000 characters. GET /api/account/v1/{product-categories|known-merchants|known-product-codes}/export.

    Annotations the server declares

    • title: Export account reference data
    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: true
  • taggun_get_campaignThe stored validation rules of one campaign (dates, merchants, products, fraud checks, SmartValidate prompts).No findings

    Why it is in this group

    • The name "taggun_get_campaign" says "get": a word for reading.
    Description, as the server wrote it
    The stored validation rules of one campaign (dates, merchants, products, fraud checks, SmartValidate prompts). Does not use a scan. GET /api/validation/v1/campaign/settings/{campaignId}.

    Annotations the server declares

    • title: Get a validation campaign's rules
    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: true
  • taggun_list_campaignsList the ids of the receipt-validation campaigns stored on your Taggun account (an empty list is normal).No findings

    Why it is in this group

    • The name "taggun_list_campaigns" says "list": a word for reading.
    Description, as the server wrote it
    List the ids of the receipt-validation campaigns stored on your Taggun account (an empty list is normal). Does not use a scan. Needs the Campaign Validation feature; without it Taggun answers that the feature must be enabled. GET /api/validation/v1/campaign/settings/list.

    Annotations the server declares

    • title: List validation campaigns
    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: true

This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.

Install

Pinned to version 1.3.3. Values in angle brackets are yours to fill in.

claude mcp add --transport http taggun https://taggun.usefulapi.io/mcp

Run in a terminal.

Claude Code permissions

Allow the reads, ask before a change, deny the deletes. Paste into .claude/settings.json.

.claude/settings.json
{
  "permissions": {
    "allow": [
      "mcp__taggun__taggun_list_campaigns",
      "mcp__taggun__taggun_get_campaign",
      "mcp__taggun__taggun_export_reference_data"
    ],
    "ask": [
      "mcp__taggun__taggun_scan_receipt_url",
      "mcp__taggun__taggun_scan_receipt_base64",
      "mcp__taggun__taggun_validate_receipt_campaign_url"
    ],
    "deny": []
  }
}

Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. It assumes the server is installed as taggun. Review it before you use it.