LeashIndex Get the report

Index / payments

TapTax

uk-co-taptax-taptax declares 49 capabilities across 49 tools, with 3 critical issues.

83/100 exposureHigh exposure

Manifest recorded 2026-10-11 from tools/list on https://api.taptax.co.uk/mcp, published in the official MCP registry as uk.co.taptax/taptax 1.1.1. The date changes only when the manifest does. Not verified by a maintainer.

Issues

These describe what this server's manifest declares. A product can provide controls that MCP has no way to express — token revocation, an admin console, audit logs — and this page cannot see them. The absence of a declaration is not evidence that a control is absent.

critical · no-revocation · All 49 tools

49 of 49 tools declare no way for the customer to switch them off once granted. This applies to every tool because MCP has no field in which to declare a revocation mechanism; the product may provide one outside MCP that a manifest cannot show.

critical · irreversible-uncapped · 4 of 49 tools

4 tools are classified as irreversible and declare no limit.

critical · uncapped-spend · 1 of 49 tools

1 tool is classified as moving money and declares no dollar limit. A cap on the number of payments does not bound their amount.

high · no-expiry · All 49 tools

49 of 49 tools declare no expiry. This applies to every tool because MCP has no field in which to declare an expiry; the product may provide one outside MCP that a manifest cannot show.

high · no-audit-trail · All 49 tools

49 of 49 tools declare no record of their actions that the customer can read. This applies to every tool because MCP has no field in which to declare an audit requirement; the product may provide one outside MCP that a manifest cannot show.

high · uncapped-write · 3 of 49 tools

3 tools can modify data and declare no limit.

low · uncapped-read · 42 of 49 tools

42 tools can read data and declare no limit.

Declared capabilities

How each tool was read. declared means the server's own annotation said so — self-reported and unverified. inferred is from the tool's name. assumed means nothing indicated either way.

ToolRead asBasis
estimate_self_employed_taxread declared
check_tax_coderead declared
check_mtd_statusread declared
get_mtd_deadlinesread declared
calculate_take_home_payread declared
calculate_gross_salary_for_take_homeread declared
calculate_salary_sacrificeread declared
calculate_pro_rata_salaryread declared
convert_hourly_rate_to_salaryread declared
convert_salary_to_hourly_rateread declared
calculate_student_loan_repaymentread declared
calculate_child_benefit_chargeread declared
calculate_tax_on_multiple_incomesread declared
calculate_pension_tax_reliefread declared
calculate_dividend_taxread declared
compare_salary_and_dividendsread declared
compare_limited_company_and_sole_traderread declared
calculate_corporation_taxread declared
calculate_contractor_day_rateread declared
compare_inside_and_outside_ir35read declared
calculate_cis_deductionread declared
plan_quarterly_tax_set_asideread declared
calculate_mileage_allowanceread declared
estimate_self_assessment_penaltiesread declared
calculate_vatread declared
check_vat_registrationread declared
check_vat_reverse_chargeread declared
calculate_markupread declared
calculate_profit_marginread declared
calculate_invoice_due_dateread declared
calculate_late_payment_interestread declared
calculate_capital_gains_taxread declared
calculate_rental_income_taxread declared
calculate_savings_interest_taxread declared
calculate_stamp_dutyread declared
prepare_business_documentread declared
generate_invoice_numbersread declared
get_tax_positionread declared
list_transactionsread declared
get_mileage_summaryread declared
add_transactionwrite inferred
update_transactiondestructive declared
log_mileage_tripwrite assumed
list_invoicesread declared
create_invoicewrite inferred
send_invoicesend inferred
send_invoice_from_carddestructive declared
mark_invoice_paidpay inferred
prepare_quarterly_updateread declared
Answering this question about your own agent? The self-serve stack report applies the same reading to your own stack or server and gives you a dated document you can hand to a customer's security review. It is generated in your browser, with nobody to wait for. Buying one does not change this page, its score or its place in the index — see Independence.
Maintain this server? If this page misreads your manifest, or your server has changed, submit its current tools/list response and it will be re-scored and dated. Corrections are published alongside the original, not in place of it.