Mexican Tax & Banking MCP server

mx-fiscal-mcp-server

An MCP server that gives an AI agent Mexican tax and banking capabilities — validate RFC, CURP, CLABE and NSS with real check digits, read a CFDI 4.0 invoice, ask the SAT whether it is still live, and look up the SAT's code tables. No API keys, no CSD certificate, no PAC contract.

Ask Claude "read this invoice and tell me whether it's still valid" and it parses the XML, labels every SAT code, checks both RFCs and the arithmetic, and queries the SAT's public status service — instead of you opening three web tools.

> Read this CFDI and check it at the SAT

  parse_cfdi(xml="<cfdi:Comprobante …>")

  CFDI A-1042 — 1160.00 MXN
  ✅ Stamped · version 4.0 · Ingreso
  Emisor:   TES150312DX2 ✅  601 — General de Ley Personas Morales
  Receptor: PELJ900521DK2 ✅  G03 — Gastos en general
  ✅ Totals add up: subtotal − discount + transferred − withheld = total

  cfdi_status(xml="<cfdi:Comprobante …>")

  CFDI status — Vigente
  ✅ The invoice exists in the SAT's records and has not been cancelled.
  Es cancelable: Cancelable con aceptación
  EFOS: returned 200 — the issuer is NOT on the SAT's definitive 69-B list.

Why this exists

Mexican electronic invoicing has two halves, and only one of them was served.

Building and stamping a CFDI needs a CSD certificate and a contract with a PAC. That half already has tooling — mcp-cfdi-mx (Python) does it, and this server deliberately does not compete with it.

Reading is the other half, and it needs nothing: the check-digit algorithms are public, the SAT's catalogues are public, and the invoice status service behind the QR code on every printed invoice is public and unauthenticated. Yet an agent asked to validate an RFC will happily invent a regex that rejects XAXX010101000 — the RFC of every invoice issued to the general public — because that one does not satisfy its own check digit. This server is the read half, done carefully.

The arithmetic comes from mx-identifiers (MIT, zero dependencies, 101 tests against public vectors); the CFDI reader is ported from the tool running at ortamarco.me; the SOAP envelope was read out of nodecfdi/sat-estado-cfdi rather than guessed. It is the third of three read-only, key-free MCP servers alongside domain-security-mcp-server and seo-geo-mcp-server.

Tools

Identifiers

Shortened. The full README is on GitHub.