MadTaco

dev.madtacoPublished by madtaco.devv1.1.0Updated Oct 24, 2026

Verification and trust checks for AI agents: validate, screen, propose, accounts, usage.

VerifiedSTDIODesktop onlyFinance Security & Monitoring Business & Commerce

Server details

Identifier: dev.madtaco/mcp
Transport: STDIO
Runtime: Desktop only
Trust: Verified
Published: Sep 16, 2026

Security note

MCP servers receive tool arguments from a conversation and may perform external actions. Review what a server can do before you enable it, and give it only the access it needs.

The registry verified that this server's namespace belongs to madtaco.dev. It runs from a package rather than a hosted endpoint, so there is no endpoint to match against that domain.

SourceWeft's checks cover whether the listing is complete and the endpoint answered; they do not review the server's code or what its tools do.

Add a badge to your README

Show readers this MCP server is listed on SourceWeft. The badge links to this page.

[![Listed on SourceWeft](https://sourceweft.com/badge/mcp/dev.madtaco%2Fmcp.svg)](https://sourceweft.com/mcp/dev.madtaco%2Fmcp?utm_source=readme&utm_medium=badge)

Overview

AI-generated overview

MadTaco is a local stdio MCP server that lets an assistant validate tax IDs, IBANs, emails and phones, screen sanctions, verify companies and inspect domains.

What you can do: Validate identifiers: tax IDs, IBANs, email addresses and phone numbers, plus look up financial instruments by ticker and exchange (free tools). Run paid trust checks: sanctions screening, company verification, domain inspection, and a combined screen that polls for results. Manage an account: create and verify an account, check usage and credit balance, and propose new checks. Every response reports credits charged, and failed checks are not billed.
When to use it: Use it when an assistant needs to check business or financial identifiers, screen a party against sanctions, verify a company or inspect a domain, and you are willing to pay per check from prepaid credits. Free validation tools work without an account.
Requirements: Runs locally via npx with Node.js; desktop only. Optional MADTACO_API_KEY for authenticated and paid tools; MADTACO_API_BASE overrides the API base URL. Paid screening and full email/phone modes need a funded account topped up through billing. Network access to the MadTaco API. Rate limits apply per IP or key.

Before you install

Paid checks draw down prepaid USD credits (for example sanctions screening, company verification, domain inspection); propose_check places a pledge hold. The API key is a secret sent as X-Api-Key and should be kept out of shared configs. Account creation requires an email and a verification code. Requests and the data being checked are sent to the third-party MadTaco API.

Installation

In SourceWeft

Open MadTaco in the dashboard and add it to a workspace.
Enable the server for the chats that should use its tools.

Desktop only via STDIO. STDIO servers start a local process, so they need the SourceWeft desktop host.

Other MCP clients

Follow the launch instructions in the repository.

README

🌮 MadTaco — MCP Server

npm: @madtaco/mcp

[smithery badge]

Verification and utility API for AI agents. Validate tax IDs, screen sanctions, verify companies, inspect domains — prepaid USD credits. Failed checks are never charged.

This package is a stdio MCP server that wraps the public MadTaco API at https://api.madtaco.dev/v1. Every response includes credits_charged (0 for free operations). Prefer remote HTTP instead? See HTTP MCP below.

Docs

madtaco.dev — product site
Setup guide — Cursor, Claude, Smithery
API docs — OpenAPI reference
Agent skill — integration guide (MCP + REST)
llms.txt — full endpoint catalog
pricing.json — per-operation prices
Health — API status
Server card — tool metadata

Quick start (stdio)

Claude Desktop / Cursor

Claude Desktop config: ~/Library/Application Support/Claude/claude_desktop_config.json (macOS) or %APPDATA%\Claude\claude_desktop_config.json (Windows).
Cursor: .cursor/mcp.json in your project or global MCP settings.

json

{  "mcpServers": {    "madtaco": {      "command": "npx",      "args": ["-y", "@madtaco/mcp"],      "env": {        "MADTACO_API_KEY": "your_api_key_here"      }    }  }}

{  "mcpServers": {    "madtaco": {      "command": "npx",      "args": ["-y", "@madtaco/mcp"],      "env": {        "MADTACO_API_KEY": "your_api_key_here"      }    }  }}

Without an API key: validate_tax_id, validate_iban, lookup_instrument, validate_email (syntax), validate_phone (format), create_account, verify_account.

With an API key (tier registered): get_usage, propose_check.

Funded account required (tier 2): paid screening/verification tools and validate_email/validate_phone full modes. Top up via POST /v1/billing/checkout or madtaco.dev billing.

Rate limits: 50 req/day anonymous (per IP), 100 req/day registered (per API key), 500/day included once funded — see llms.txt.

Try it

Validate the Chilean RUT 11.111.111-1 using MadTaco.

Check whether IBAN DE89370400440532013000 is valid.

Look up ticker CMG on exchange US.

Remote HTTP

Streamable HTTP MCP on the API subdomain — no npm install required:

json

{  "mcpServers": {    "madtaco": {      "url": "https://api.madtaco.dev/mcp",      "headers": { "X-Api-Key": "your_api_key_here" }    }  }}

{  "mcpServers": {    "madtaco": {      "url": "https://api.madtaco.dev/mcp",      "headers": { "X-Api-Key": "your_api_key_here" }    }  }}

Authenticate with X-Api-Key or Authorization: Bearer. Same 13 tools as this stdio package.

Environment

Override for staging or local dev:

Tools

All paths are relative to MADTACO_API_BASE (default https://api.madtaco.dev/v1).

Tool	API endpoint	Credits
`validate_tax_id`	`POST /validate/tax-id`	0
`validate_iban`	`POST /validate/iban`	0
`lookup_instrument`	`POST /lookup/instrument`	0
`validate_email`	`POST /validate/email`	0 (syntax) / 0.005 (full, tier 2)
`validate_phone`	`POST /validate/phone`	0 (format) / 0.005 (full, tier 2)
`screen_sanctions`	`POST /screen/sanctions`	0.10
`verify_company`	`POST /verify/company`	0.15
`inspect_domain`	`POST /inspect/domain`	0.05
`screen`	`POST /screen` + optional `GET /screens/{id}?wait=60`	sum of completed checks
`propose_check`	`POST /propose`	pledge hold only
`create_account`	`POST /accounts`	0
`verify_account`	`POST /accounts/verify`	0
`get_usage`	`GET /usage`	0

Not in MCP (REST only)

Call these directly against the API — see llms.txt:

GET /data/cl/{indicator} — Chilean indicators (UF, UTM, USD, EUR, IPC)
GET /balance — credit balance (get_usage includes balance)
GET /evidence/{id} — signed evidence URLs
GET /health — uptime check

Agent onboarding flow

create_account with an email → account_id + pending_verification
Human or agent reads the 6-digit code from email
verify_account → api_key (tier registered)
Fund the account via madtaco.dev billing or POST /v1/billing/checkout
Set MADTACO_API_KEY and run paid checks

Credentials never transit through MCP responses for human dashboard access — use POST /v1/accounts/invite-human when needed.

Development

Stdio transport only — this server calls the public HTTP API; no database or secrets beyond an optional API key.

bash

git clone https://github.com/madtaco-dev/mcp.gitcd mcpnpm installnpm testnpm run buildMADTACO_API_KEY=... npm run dev

git clone https://github.com/madtaco-dev/mcp.gitcd mcpnpm installnpm testnpm run buildMADTACO_API_KEY=... npm run dev

New tools ship as minor npm releases as the API grows. See llms.txt for the current tool list.

License

Source: README.md at commit cb3c202

Tools

SourceWeft has not started this package in its sandbox yet, so its tools are not known.

Version history

v1.1.0LatestSep 16, 2026

Score

50% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

Reached in the last 30 days25 pts
Keep the endpoint answering the MCP handshake; SourceWeft probes it every 30 days.
Auth declared10 pts
Declare the credential headers in the registry entry, or keep the endpoint answering the probe so its auth can be classified.
Tools listed15 pts
Answer tools/list without a credential, or ship a package that starts in a sandbox without one.
DescriptionRequired15 pts
Logo10 pts
Documentation15 pts
License10 pts

Variable	Required	Default
`MADTACO_API_KEY`	For authenticated and paid tools	—
`MADTACO_API_BASE`	No	`https://api.madtaco.dev/v1`