{ "meta": { "attribution": "Anchor Terminal (https://www.anchorterminal.com)", "docs": "https://www.anchorterminal.com/docs/", "generatedAt": "2026-10-08", "license": "CC-BY-4.0", "method": "https://www.anchorterminal.com/benchmark/", "methodology": "0.4", "openapi": "https://www.anchorterminal.com/openapi.json", "preview": false, "run": "2026-10-01", "runLabel": "October 2026 research run" }, "tool": { "slug": "avalara", "name": "Avalara AvaTax", "vendor": "Avalara, Inc.", "vendorUrl": "https://www.avalara.com", "kind": "http-api", "category": "tax", "summary": "Avalara AvaTax calculates sales tax, VAT and GST for a transaction and records it for reporting. Agents reach it through the AvaTax REST v2 API or a hosted MCP server, with separate Avalara products for returns, exemption certificates and e-invoicing.", "url": "https://www.anchorterminal.com/tools/avalara", "markdownUrl": "https://www.anchorterminal.com/tools/avalara.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/avalara.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/avalara.json", "repo": "https://github.com/avadev/mcp", "license": "Proprietary service under the Avalara Service Terms. The SDKs on GitHub are Apache-2.0. The MCP repository holds a README only, with no licence file", "transports": [ "http", "streamable-http" ], "remoteUrl": "https://rest.avatax.com/api/v2", "packages": [ { "registry": "npm", "name": "avatax" }, { "registry": "pypi", "name": "Avalara" } ], "auth": "mixed", "authNotes": "The MCP server uses OAuth through identity.avalara.com (sandbox ai-sbx.avlr.sh) with one scope, avalara_mcp, and a person signs in and consents in a browser. The identity server advertises PKCE (S256), a public client registration endpoint, device code and client credentials grants. The REST API accepts HTTP Basic with a username and password or with an account ID and licence key, or a bearer token from the identity server. Licence keys are account-wide, can be named, and a reset revokes the old key at once. What a caller can do follows the user's security role, such as AccountAdmin or CompanyUser. Access is self-serve through the trial signup, with no app review found.", "pricing": "paid", "pricingNotes": "Free 90-day AvaTax trial, no card, limited to 5 orders and 5 invoices a minute and 1,000 transactions a day, for evaluation with test data only under the AvaTax terms. Paid plans on the public pricing page are Core Compliance at $79 a state a month ($799 a state a year) and Core Compliance with SST services at $69 ($699 a year), both for businesses under $50M in annual revenue and both including AvaTax calculation and managed returns. Above that, plans are quoted. Avalara says price varies with products, states, integrations and monthly transaction volume, and no price per transaction or per API call is published (https://www.avalara.com/us/en/products/sales-and-use-tax/pricing.html, checked 2026-10-08).", "priceSummary": "$79 / mo", "where": "hosted", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in the developer docs, the AvaTax API reference or the pricing page (checked 2026-10-08).", "endpoints": [] }, "toolCount": 10, "popularity": { "githubStars": 5, "npmWeekly": 330649, "pypiWeekly": 37689, "asOf": "2026-10-08" }, "docsUrl": "https://developer.avalara.com/", "llmsTxt": "https://developer.avalara.com/llms.txt", "openapi": "https://sandbox-rest.avatax.com/swagger/v2/swagger.json", "registryName": "com.avalara/avatax", "capabilities": [ "tax.calculate", "tax.transactions", "tax.exemptions", "tax.filing", "tax.invoicing" ], "tags": [ "hosted", "paid", "free-trial", "mcp", "oauth", "openapi", "llms-txt", "typescript", "python", "java", "csharp", "sandbox", "status-page", "soc2", "iso27001" ], "lastRelease": "2026-09-16", "graded": true, "anchor": { "graded": true, "score": 68.8, "grade": "B", "agentReady": false, "rank": 162, "ranked": true, "rankOf": 629, "categoryRank": 1, "methodology": "0.4", "run": "2026-10-01", "scores": { "ergonomics": 84, "maintenance": 79, "payments": 30, "reliability": 62, "schema": 85, "security": 65, "transparency": 79 }, "pending": [ "performance", "tasks" ], "breakdown": [ { "key": "reliability", "name": "Reliability", "weight": 16, "effectiveWeight": 20, "score": 62, "points": 12.4, "reason": "Graded as a hosted service. Statuspage at status.avalara.com with 135 components, the AvaTax group split into Tax Calculation Service, Restv2, Batch, Reporting and others (20). Four incidents between 10 July and 8 October 2026. Three were short or outside AvaTax calculation. The fourth, on the Tax Calculation Service and AvaTax UI, ran from 22:32 PT on 5 October to 21:20 PT on 6 October, about 23 hours, marked minor with no cause given, so we scored between minor-only and one major outage (15). Numbers are published only for the trial (5 orders and 5 invoices a minute, 1,000 transactions a day) and report exports (5 a minute). Production limits not found (7). 429 is documented with three error codes, and the integration guide says to retry a timed-out invoice with CreateOrAdjustTransaction. No Retry-After or backoff guidance found (10). The Service Terms promise commercially reasonable efforts with no uptime percentage (0). REST v2 is GA and the MCP server is registered at 1.0.1 with no beta label (10)." }, { "key": "performance", "name": "Performance", "weight": 10, "effectiveWeight": 0, "pending": true, "points": 0, "reason": "Pending. Latency is measured per call by our probes, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until the first probe window closes." }, { "key": "schema", "name": "Schema \u0026 documentation", "weight": 13, "effectiveWeight": 16.25, "score": 85, "points": 13.81, "reason": "Public Swagger 2.0 file at sandbox-rest.avatax.com/swagger/v2/swagger.json with 491 operations and 635 models. MCP tool schemas sit behind OAuth and were not read (25). llms.txt plus a Markdown page per endpoint, 471 for AvaTax (10). 475 of 491 operations carry a description of more than 80 characters, several saying which call to use instead, such as CreateOrAdjustTransaction over CreateTransaction. MCP tool descriptions in the docs are one line each with a sample prompt (15). Enums on 203 properties, required fields on request models and examples on 2,717 properties, though `$filter` and `$include` are free-form strings (13). A curl example on each endpoint page and an error list of 429 codes, each with its own page (14). A written n.x.y versioning policy and a version number in the ping response, but the patch notes page stops at 23.4.1 on 26 April 2023 (8)." }, { "key": "ergonomics", "name": "Agent ergonomics", "weight": 13, "effectiveWeight": 16.25, "score": 84, "points": 13.65, "reason": "The MCP server documents ten tools. Their definitions sit behind OAuth, so size was not measured. On the API, `$include=SummaryOnly` or LinesOnly shrinks transaction responses (21). `$top`, `$skip`, `$filter` and `$orderBy` on 152 of 262 GET operations, with 1,000 records at most and `@nextLink` (20). Errors carry code, number, message, description, faultCode and helpLink (18). No idempotency key. CreateOrAdjustTransaction is the documented safe retry and CreateTransaction rejects a duplicate committed code. MCP annotations were not readable (10). CreateTransaction needs three fields (customerCode, date, lines) and defaults to an unrecorded SalesOrder estimate. SDKs in six languages (15)." }, { "key": "security", "name": "Security \u0026 auth", "weight": 14, "effectiveWeight": 17.5, "score": 65, "points": 11.38, "reason": "The MCP server uses OAuth with PKCE and a single scope, avalara_mcp. The REST guides lead with HTTP Basic using a username and password or an account ID and licence key. Keys are account-wide, can be named and are revoked on reset, and bearer tokens are accepted (20). Access follows user security roles, and a transaction is an unrecorded estimate unless an Invoice type is sent. No read-only mode or confirmation step is documented for the MCP's calculate_tax and create_nexus tools (10). Responses are mostly structured tax data with some merchant-entered text. No injection guidance found, and the Service Terms place responsibility for agent actions on the customer (8). An account audit endpoint for failed calls, audit log exports, and per-user attribution except with a licence key (12). Vulnerability disclosure programme, and SOC 1 Type 2, SOC 2 Type 2 and ISO 27001 listed for AvaTax. No security.txt and no bug bounty found (15)." }, { "key": "payments", "name": "Payments \u0026 pricing", "weight": 10, "effectiveWeight": 12.5, "score": 30, "points": 3.75, "reason": "No x402, MPP or L402 in the developer docs, API reference or pricing page (0). Plan prices are public at $79 a state a month, or $69 with SST services, with larger accounts quoted and no price per transaction (10). A 90-day trial with no card, 1,000 transactions a day (20). Signup and the OAuth consent both need a person in a browser (0)." }, { "key": "tasks", "name": "Task success", "weight": 10, "effectiveWeight": 0, "pending": true, "points": 0, "reason": "Pending. Task success needs the category task suites run through each tool, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until then. A data provider's data-quality score is published on its listing now and becomes half of this category when it's scored." }, { "key": "maintenance", "name": "Maintenance \u0026 community", "weight": 7, "effectiveWeight": 8.75, "score": 79, "points": 6.91, "reason": "Production answered as version 26.9.2 and the sandbox spec as 26.10.0 on 8 October 2026. The JavaScript and Python SDKs were tagged 26.9.0 on 16 September (30). SDK tags 26.7.3 on 27 July, 26.8.3 on 24 August and 26.9.0 on 16 September (20). Closed service. A developer community forum exists, but the public patch notes stop in April 2023, and we did not read reply times on the 24 open issues in the JavaScript SDK repository (7). com.avalara/avatax is in the official MCP registry under Avalara's own namespace, and the six SDKs are current (15). The JavaScript SDK has build and publish workflows and the Python SDK a publish workflow. Test results were not checked (7)." }, { "key": "transparency", "name": "Transparency \u0026 trust", "weight": 7, "effectiveWeight": 8.75, "score": 79, "points": 6.91, "note": "editorial 69, provenance 88", "reason": "Closed service with versioned terms that keep every past version online (Service Terms 7.1, effective 1 October 2026, and AvaTax supplemental terms). SDKs are Apache-2.0 (17). The DPA (version 1.10, 2 June 2025) limits use of customer data to running the service, support and legal compliance, with retrieval for 10 days after termination and destruction on request up to 60 days after. No fixed retention periods, backups are excepted, and Avalara may use de-identified aggregate data for any lawful purpose (20). A written policy deprecates version n-2 when n ships and decommissions it 18 months later, and the spec dates field deprecations. The policy's example table has dates out of order, and the terms let documentation alone count as notice (15). Subprocessor list version 11.0 of 9 September 2026 with date added, purpose and country, hosting on AWS in the United States (17)." } ], "assessment": { "date": "2026-10-08", "basis": "public evidence", "confidence": "medium", "notes": { "ergonomics": "The MCP server documents ten tools. Their definitions sit behind OAuth, so size was not measured. On the API, `$include=SummaryOnly` or LinesOnly shrinks transaction responses (21). `$top`, `$skip`, `$filter` and `$orderBy` on 152 of 262 GET operations, with 1,000 records at most and `@nextLink` (20). Errors carry code, number, message, description, faultCode and helpLink (18). No idempotency key. CreateOrAdjustTransaction is the documented safe retry and CreateTransaction rejects a duplicate committed code. MCP annotations were not readable (10). CreateTransaction needs three fields (customerCode, date, lines) and defaults to an unrecorded SalesOrder estimate. SDKs in six languages (15).", "maintenance": "Production answered as version 26.9.2 and the sandbox spec as 26.10.0 on 8 October 2026. The JavaScript and Python SDKs were tagged 26.9.0 on 16 September (30). SDK tags 26.7.3 on 27 July, 26.8.3 on 24 August and 26.9.0 on 16 September (20). Closed service. A developer community forum exists, but the public patch notes stop in April 2023, and we did not read reply times on the 24 open issues in the JavaScript SDK repository (7). com.avalara/avatax is in the official MCP registry under Avalara's own namespace, and the six SDKs are current (15). The JavaScript SDK has build and publish workflows and the Python SDK a publish workflow. Test results were not checked (7).", "payments": "No x402, MPP or L402 in the developer docs, API reference or pricing page (0). Plan prices are public at $79 a state a month, or $69 with SST services, with larger accounts quoted and no price per transaction (10). A 90-day trial with no card, 1,000 transactions a day (20). Signup and the OAuth consent both need a person in a browser (0).", "reliability": "Graded as a hosted service. Statuspage at status.avalara.com with 135 components, the AvaTax group split into Tax Calculation Service, Restv2, Batch, Reporting and others (20). Four incidents between 10 July and 8 October 2026. Three were short or outside AvaTax calculation. The fourth, on the Tax Calculation Service and AvaTax UI, ran from 22:32 PT on 5 October to 21:20 PT on 6 October, about 23 hours, marked minor with no cause given, so we scored between minor-only and one major outage (15). Numbers are published only for the trial (5 orders and 5 invoices a minute, 1,000 transactions a day) and report exports (5 a minute). Production limits not found (7). 429 is documented with three error codes, and the integration guide says to retry a timed-out invoice with CreateOrAdjustTransaction. No Retry-After or backoff guidance found (10). The Service Terms promise commercially reasonable efforts with no uptime percentage (0). REST v2 is GA and the MCP server is registered at 1.0.1 with no beta label (10).", "schema": "Public Swagger 2.0 file at sandbox-rest.avatax.com/swagger/v2/swagger.json with 491 operations and 635 models. MCP tool schemas sit behind OAuth and were not read (25). llms.txt plus a Markdown page per endpoint, 471 for AvaTax (10). 475 of 491 operations carry a description of more than 80 characters, several saying which call to use instead, such as CreateOrAdjustTransaction over CreateTransaction. MCP tool descriptions in the docs are one line each with a sample prompt (15). Enums on 203 properties, required fields on request models and examples on 2,717 properties, though `$filter` and `$include` are free-form strings (13). A curl example on each endpoint page and an error list of 429 codes, each with its own page (14). A written n.x.y versioning policy and a version number in the ping response, but the patch notes page stops at 23.4.1 on 26 April 2023 (8).", "security": "The MCP server uses OAuth with PKCE and a single scope, avalara_mcp. The REST guides lead with HTTP Basic using a username and password or an account ID and licence key. Keys are account-wide, can be named and are revoked on reset, and bearer tokens are accepted (20). Access follows user security roles, and a transaction is an unrecorded estimate unless an Invoice type is sent. No read-only mode or confirmation step is documented for the MCP's calculate_tax and create_nexus tools (10). Responses are mostly structured tax data with some merchant-entered text. No injection guidance found, and the Service Terms place responsibility for agent actions on the customer (8). An account audit endpoint for failed calls, audit log exports, and per-user attribution except with a licence key (12). Vulnerability disclosure programme, and SOC 1 Type 2, SOC 2 Type 2 and ISO 27001 listed for AvaTax. No security.txt and no bug bounty found (15).", "transparency": "Closed service with versioned terms that keep every past version online (Service Terms 7.1, effective 1 October 2026, and AvaTax supplemental terms). SDKs are Apache-2.0 (17). The DPA (version 1.10, 2 June 2025) limits use of customer data to running the service, support and legal compliance, with retrieval for 10 days after termination and destruction on request up to 60 days after. No fixed retention periods, backups are excepted, and Avalara may use de-identified aggregate data for any lawful purpose (20). A written policy deprecates version n-2 when n ships and decommissions it 18 months later, and the spec dates field deprecations. The policy's example table has dates out of order, and the terms let documentation alone count as notice (15). Subprocessor list version 11.0 of 9 September 2026 with date added, purpose and country, hosting on AWS in the United States (17)." }, "sources": [ { "what": "llms.txt and product index", "url": "https://developer.avalara.com/llms.txt", "seen": "2026-10-08" }, { "what": "AvaTax MCP server page and tool list", "url": "https://developer.avalara.com/products/avatax/mcp/", "seen": "2026-10-08" }, { "what": "MCP servers overview", "url": "https://developer.avalara.com/mcp-servers/", "seen": "2026-10-08" }, { "what": "MCP servers repository (README only)", "url": "https://github.com/avadev/mcp", "seen": "2026-10-08" }, { "what": "official MCP registry entries", "url": "https://registry.modelcontextprotocol.io/v0.1/servers?search=avalara", "seen": "2026-10-08" }, { "what": "MCP OAuth resource metadata", "url": "https://mcp.avalara.com/.well-known/oauth-protected-resource/avatax", "seen": "2026-10-08" }, { "what": "identity server metadata", "url": "https://identity.avalara.com/.well-known/openid-configuration", "seen": "2026-10-08" }, { "what": "AvaTax Swagger file", "url": "https://sandbox-rest.avatax.com/swagger/v2/swagger.json", "seen": "2026-10-08" }, { "what": "production version (ping)", "url": "https://rest.avatax.com/api/v2/utilities/ping", "seen": "2026-10-08" }, { "what": "bundled AvaTax API reference in Markdown", "url": "https://developer.avalara.com/products/avatax/api.md", "seen": "2026-10-08" }, { "what": "authentication in REST v2", "url": "https://developer.avalara.com/avatax/authentication-in-rest/", "seen": "2026-10-08" }, { "what": "retry or fallback guide", "url": "https://developer.avalara.com/sales-tax-integration-guide/djk3478758993515/", "seen": "2026-10-08" }, { "what": "rate limit error page", "url": "https://developer.avalara.com/avatax/errors/RateLimitExceededError/", "seen": "2026-10-08" }, { "what": "API versioning and deprecation policy", "url": "https://developer.avalara.com/api-versioning/", "seen": "2026-10-08" }, { "what": "API patch notes", "url": "https://developer.avalara.com/patch-notes/", "seen": "2026-10-08" }, { "what": "free trial terms and limits", "url": "https://developer.avalara.com/freeTrial/", "seen": "2026-10-08" }, { "what": "sales tax pricing", "url": "https://www.avalara.com/us/en/products/sales-and-use-tax/pricing.html", "seen": "2026-10-08" }, { "what": "status incidents", "url": "https://status.avalara.com/api/v2/incidents.json", "seen": "2026-10-08" }, { "what": "Service Terms and legal centre", "url": "https://legal.avalara.com/", "seen": "2026-10-08" }, { "what": "AvaTax supplemental terms", "url": "https://legal.avalara.com/product-terms.html#avatax", "seen": "2026-10-08" }, { "what": "DPA, privacy notices and subprocessors", "url": "https://legal.avalara.com/dpa", "seen": "2026-10-08" }, { "what": "trust centre", "url": "https://trust.avalara.com/", "seen": "2026-10-08" }, { "what": "responsible disclosure", "url": "https://www.avalara.com/us/en/legal/responsible-disclosure.html", "seen": "2026-10-08" }, { "what": "JavaScript SDK tags and workflows", "url": "https://github.com/avadev/AvaTax-REST-V2-JS-SDK", "seen": "2026-10-08" }, { "what": "Python SDK tags", "url": "https://github.com/avadev/AvaTax-REST-V2-Python-SDK", "seen": "2026-10-08" }, { "what": "npm package", "url": "https://registry.npmjs.org/avatax/latest", "seen": "2026-10-08" }, { "what": "PyPI package", "url": "https://pypi.org/pypi/Avalara/json", "seen": "2026-10-08" } ], "openQuestions": [ "unchecked: the MCP server's tool definitions, input schemas and readOnlyHint or destructiveHint annotations, which need an OAuth sign-in with an Avalara account", "unchecked: production rate limits for transaction calls and whether 429 responses carry Retry-After. Neither was found in the public documentation", "unchecked: the trust centre's documents (security policy, AI governance) and the platform behind the vulnerability disclosure programme, which load only with JavaScript or on request", "unchecked: reply times on issues in the SDK repositories and whether SDK tests pass, since only the git history was read", "Whether an uptime SLA exists in order documents. The Service Terms give none, and the product page's 99.99 per cent figure is a marketing claim", "Whether the Claude Code tab on the MCP page gives a command. Only the Cursor configuration was readable without JavaScript", "The cause of the 5 to 6 October 2026 AvaTax degradation. The status page gives none and marks it minor", "The pricing page prices plans per state, so the unit prices are entered as monthly plans. No price per transaction was found" ] }, "negative": 0, "verdict": "The REST API has a public Swagger file with 491 operations, a Markdown page per endpoint and a 90-day trial with no card. Production rate limits and prices per transaction are not published, the API patch notes stop at April 2023, and the tax calculation service was degraded for about 23 hours on 5 and 6 October 2026.", "bestFor": "An agent that must calculate and record US sales tax at address level, with VAT and GST in other countries, and hand the records to filing.", "strengths": [ "Public Swagger 2.0 file with 491 operations, plus llms.txt and a Markdown page with a curl example for each endpoint", "Hosted MCP server at mcp.avalara.com/avatax with ten documented tools, OAuth sign-in and an entry in the official MCP registry as com.avalara/avatax", "90-day AvaTax trial with no card, limited to 5 orders and 5 invoices a minute and 1,000 transactions a day", "Errors return a code, number, description and help link, from a published list of 429 codes", "SDKs in six languages under Apache-2.0, released monthly, latest 26.9.0 on 16 September 2026" ], "weaknesses": [ "Production rate limits are not published. The only numbers found are the trial limits and 5 calls a minute on report exports", "No price per transaction. Public plans are $79 a state a month, or $69 with SST services, and larger accounts are quoted", "The API patch notes page ends at version 23.4.1 of 26 April 2023, while production reports 26.9.2", "Tax calculation was degraded from 22:32 PT on 5 October to 21:20 PT on 6 October 2026, per status.avalara.com", "REST guides lead with HTTP Basic using a username and password or an account-wide licence key, and the MCP server has one scope, avalara_mcp" ], "agentNotes": [ "Omit `type` or send SalesOrder for an estimate. A type ending in Invoice is recorded, and `commit` set to true locks it for reporting", "Retry a timed-out invoice with CreateOrAdjustTransaction, not CreateTransaction, which errors when a committed transaction has the same code", "Use sandbox-rest.avatax.com with sandbox credentials for tests. Production is rest.avatax.com and the two accounts are separate", "Add `$include=SummaryOnly` or LinesOnly to shrink transaction responses, and page lists with `$top` (1,000 at most) and `$skip`", "Call /api/v2/utilities/ping first. It answers without credentials and shows whether the credentials sent were accepted" ], "metrics": { "kind": "remote", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "B", "methodology": "0.4", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 68.8 } ], "editorialScores": { "ergonomics": 84, "maintenance": 79, "payments": 30, "reliability": 62, "schema": 85, "security": 65, "transparency": 69 }, "provenanceScore": 88 }, "connect": { "install": "npm install avatax", "http": "curl -X POST \"https://sandbox-rest.avatax.com/api/v2/transactions/create\" \\\n -H \"Authorization: Basic \u003ccredentials\u003e\" \\\n -H \"Content-Type: application/json\" \\\n -H \"Accept: application/json\" \\\n -d @transaction.json", "config": { "mcpServers": { "avalara-avatax": { "type": "http", "url": "https://mcp.avalara.com/avatax" } } } }, "letme": { "capability": "https://letme.dev/tax.calculate", "tool": "https://letme.dev/avalara" }, "notable": [ "The AvaTax MCP server documents ten tools, among them calculate_tax, get_transactions, create_nexus, get_tax_code_recommendations and validate_address, with production and sandbox endpoints (https://developer.avalara.com/products/avatax/mcp/)", "The official MCP registry lists eight Avalara servers under com.avalara, with com.avalara/avatax at version 1.0.1 published on 19 June 2026 (https://registry.modelcontextprotocol.io/v0.1/servers?search=avalara)", "llms.txt links a Markdown page for every product and an index of more than 2,400 endpoint pages, 471 of them for AvaTax (https://developer.avalara.com/llms.txt)", "The Service Terms add a Customer Agents clause that makes the customer solely responsible for actions taken by an AI agent it connects. Version 7.1 is effective 1 October 2026 (https://legal.avalara.com/)", "The versioning policy deprecates major version n-2 when version n ships and decommissions it 18 months later, after which calls return 400 with a version-too-old message (https://developer.avalara.com/api-versioning/)", "status.avalara.com shows an AvaTax degradation on the Tax Calculation Service from 22:32 PT on 5 October to 21:20 PT on 6 October 2026, marked minor (https://status.avalara.com/history)", "The trust centre lists SOC 1 Type 2, SOC 2 Type 2 and ISO 27001 for AvaTax, and Avalara runs a vulnerability disclosure programme (https://trust.avalara.com/, https://www.avalara.com/us/en/legal/responsible-disclosure.html)" ], "area": "domain-data", "details": [ { "label": "Surface graded", "value": "AvaTax REST v2 API at https://rest.avatax.com/api/v2 (sandbox https://sandbox-rest.avatax.com) and the hosted AvaTax MCP server at https://mcp.avalara.com/avatax (sandbox https://mcp.sbx.avalara.com/avatax)" }, { "label": "API size", "value": "Swagger 2.0, 491 operations on 352 paths under 51 tags, 635 models. Production reported version 26.9.2 and the sandbox spec 26.10.0 on 8 October 2026" }, { "label": "MCP tools", "value": "calculate_tax, get_transaction, get_transactions, get_nexus_definitions, get_nexus, create_nexus, get_companies, get_tax_code_definitions, get_tax_code_recommendations, validate_address" }, { "label": "Other Avalara MCP servers", "value": "Returns, E-Invoicing and Live Reporting, Exemption Certificate Management, Cross-Border, Classification, Tax Content, Business Licensing and developer docs, each at https://mcp.avalara.com/\u003cname\u003e" }, { "label": "Credentials", "value": "MCP by OAuth with the scope avalara_mcp. REST by HTTP Basic (username and password, or account ID and licence key) or a bearer token. Permissions follow the user's security role" }, { "label": "Trial", "value": "90 days, no card, 5 orders and 5 invoices a minute, 1,000 transactions a day, test data only, no warranty or support, data may be deleted at the end" }, { "label": "Rate limits", "value": "Trial limits as above and 5 calls a minute on report exports. No production limits with numbers found. Errors RateLimitExceededError, RequestLimitExceeded and ConcurrentRequestLimitExceeded are documented" }, { "label": "Retries", "value": "No idempotency key. CreateOrAdjustTransaction creates or adjusts by transaction code and is the documented retry after a timeout. `$include=ForceTimeout` simulates a 30-second timeout for testing" }, { "label": "Paging and filtering", "value": "`$top`, `$skip`, `$filter` and `$orderBy` on 152 of 262 GET operations, 1,000 records at most per call, `@nextLink` in results. `$include` selects nested data, with SummaryOnly and LinesOnly to shrink responses" }, { "label": "SDKs", "value": "C#, Java, JavaScript (npm avatax 26.9.0), Python (PyPI Avalara 26.9.0), PHP and Ruby, Apache-2.0, tagged monthly, latest 16 September 2026" }, { "label": "Audit", "value": "GET /api/v2/accounts/{id}/audit returns API calls that ended in an error, one hour at a time. Audit log reports export through /api/v2/reports/exportauditlogs. Calls made with a licence key are logged against a key user, not a person" }, { "label": "Availability terms", "value": "Commercially reasonable efforts to be available 24 hours a day, 7 days' notice of planned downtime, status updates at status.avalara.com. No uptime percentage in the Service Terms. The product page claims 99.99 per cent uptime" }, { "label": "Data", "value": "DPA version 1.10 (2 June 2025). Customer data is retrievable for 10 days after termination and destroyed on request up to 60 days after, backups and legally required records excepted. Subprocessor list version 11.0 (9 September 2026) with countries" }, { "label": "Certifications", "value": "AvaTax is listed with SOC 1 Type 2, SOC 2 Type 2 and ISO 27001 on trust.avalara.com. Vulnerability disclosure programme with a hall of fame. No security.txt" } ], "unitPrices": [ { "item": "Core Compliance (AvaTax and managed returns)", "unit": "month", "usd": 79, "note": "per state, billed monthly; $799 per state billed yearly; annual revenue under $50M" }, { "item": "Core Compliance + SST Services", "unit": "month", "usd": 69, "note": "per state, billed monthly; $699 per state billed yearly; qualifying sellers" }, { "item": "AvaTax free trial", "unit": "month", "usd": 0, "note": "90 days, 1,000 transactions a day, test data only" } ], "provenance": { "legalEntity": "Avalara, Inc.", "domain": "avalara.com", "domainRegistered": "2003-12-08", "endpointOnVendorDomain": true, "terms": "https://legal.avalara.com/", "privacy": "https://legal.avalara.com/dpa", "statusPage": "https://status.avalara.com", "changelog": "https://developer.avalara.com/patch-notes/", "securityTxt": "none", "checked": "2026-10-08", "notes": [ "The Service Terms (version 7.1, effective 1 October 2026) name Avalara, Inc., a Washington corporation at 512 S. Mangum St. #100, Durham, NC 27701, as the contracting entity under New York law, and Avalara Europe Ltd. (England and Wales, No. 8446351) for European customers.", "The MCP server answers at mcp.avalara.com. The REST API answers at rest.avatax.com and sandbox-rest.avatax.com. RDAP gives avatax.com a registration date of 2005-01-27, and Avalara's own documentation names those hosts.", "www.avalara.com/.well-known/security.txt and developer.avalara.com/.well-known/security.txt return 404. Reports go through the vulnerability disclosure programme at https://www.avalara.com/us/en/legal/responsible-disclosure.html.", "The patch notes page lists API releases up to 23.4.1 on 26 April 2023 and nothing later. Current releases are visible only as the version in /api/v2/utilities/ping and as SDK tags on GitHub.", "RDAP for avalara.com gives a registration date of 2003-12-08. Privacy notices, the DPA and the subprocessor list are published together at legal.avalara.com/dpa." ], "score": 88, "checks": [ { "check": "Legal entity named", "value": "Avalara, Inc.", "points": 20, "max": 20, "state": "ok" }, { "check": "Domain age", "value": "avalara.com, registered 2003-12-08 (22 years)", "points": 15, "max": 15, "state": "ok" }, { "check": "Endpoint on the vendor's domain", "value": "rest.avatax.com", "points": 15, "max": 15, "state": "ok" }, { "check": "Terms of service", "value": "read, states 7 of the 7 things a reader expects, and has 1 clause that costs points", "points": 8, "max": 10, "state": "part" }, { "check": "Privacy policy", "value": "read, states 8 of the 8 things a reader expects", "points": 10, "max": 10, "state": "ok" }, { "check": "Status page", "value": "status.avalara.com", "points": 10, "max": 10, "state": "ok" }, { "check": "Changelog", "value": "published", "points": 10, "max": 10, "state": "ok" }, { "check": "security.txt", "value": "not found", "points": 0, "max": 10, "state": "no" } ], "policies": [ { "kind": "terms", "url": "https://legal.avalara.com/", "state": "read", "readAt": "2026-10-08", "statedDate": "2023-05-01", "words": 321020, "points": 8, "max": 10, "expected": [ { "key": "terms.date", "label": "Gives the date it was last updated", "found": true, "quote": "Last updated May 1, 2023.", "says": "Last updated 2023-05-01" }, { "key": "terms.law", "label": "Names the governing law or courts", "found": true, "quote": "The Agreement and all matters in connection with the Agreement will be governed by laws of the state of New York, without regard to any laws, treaties, or conflicts of laws principles that would apply the law of any other jurisdiction and without regard to the United Nations Convention on the International Sale of Goo…", "says": "The law of the State of New York" }, { "key": "terms.liability", "label": "States a limit on its liability", "found": true, "quote": "Neither Party’s aggregate liability to the other Party will exceed the fees paid or payable by Customer to Avalara under the Agreement in the 12-month period immediately preceding the event giving rise to the claim.", "says": "Capped at the fees paid in the 12 months before the claim" }, { "key": "terms.termination", "label": "Says how the agreement or account can be ended", "found": true, "quote": "Avalara may suspend Customer's Account if: (i) Customer, its Affiliates, or its or their Authorized Users or Representatives causes a material risk to the security or performance of the Services, the network, itself, or any other Avalara customer or business partner;" }, { "key": "terms.changes", "label": "Says how changes to the terms are announced", "found": true, "quote": "Customer may elect to not renew the subscription by providing Avalara at least 30 days' written notice prior to renewal;", "says": "Gives 30 days of notice before a change" }, { "key": "terms.use", "label": "Lists what users may not do", "found": true, "quote": "Customer shall not use any services that are not set forth in an Order Document signed by Customer and accepted by Avalara, except as otherwise provided in the Agreement." }, { "key": "terms.sla", "label": "Refers to a service level or uptime commitment", "found": true, "quote": "Avalara shall: (i) track uptime statistics and, as applicable, provide status updates at status.avalara.com or an equivalent replacement site;" } ], "toKnow": [ { "key": "terms.benchmark", "label": "Restricts benchmarking or competitive use", "found": true, "quote": "You shall not (i) distribute the Developer Tools to any third party, (ii) use the Developer Tools to build or provide a competitive product or service (including using the Developer Tools to gain insights into building or providing a competitive product or service), (iii) copy any features or functions of Avalara’s pr…", "costsPoints": true }, { "key": "terms.cutoff", "label": "Says access can be ended without notice or for any reason", "found": true, "quote": "However, if the Distributor from whom Customer purchased a Service fails to pay Avalara any amounts due in connection with Customer’s use of the Services, Avalara may suspend Customer’s Account, with or without notice to Customer." }, { "key": "old", "label": "Has not been updated for three years or more", "found": true, "quote": "Last updated May 1, 2023." } ] }, { "kind": "privacy", "url": "https://legal.avalara.com/dpa", "state": "read", "readAt": "2026-10-08", "statedDate": "2022-08-08", "words": 194081, "points": 10, "max": 10, "expected": [ { "key": "privacy.date", "label": "Gives the date it was last updated", "found": true, "quote": "Last updated August 8, 2022", "says": "Last updated 2022-08-08" }, { "key": "privacy.collected", "label": "Says what personal data is collected", "found": true, "quote": "Certain categories of personal information are shared only in specific contexts, such as lead generation, paid syndication, advertising measurement, or audience development." }, { "key": "privacy.retention", "label": "Says how long data is kept", "found": true, "quote": "For the purposes of the DPDP Act, the personal data collected by Avalara shall be retained for (a) as long as is necessary for the purposes under this Privacy Notice or (b) if you withdraw your consent provided under this Privacy Notice, or you exercise your right to erasure, whichever is earlier, unless the retention…", "says": "For as long as needed, with no period named" }, { "key": "privacy.processors", "label": "Says who else receives the data", "found": true, "quote": "In order to provide its service, Avalara may use subprocessors (both Avalara affiliates and third parties) located outside the European Economic Area (\"EEA\"), the United Kingdom, and Switzerland." }, { "key": "privacy.sale", "label": "Says whether personal data is sold or shared for advertising", "found": true, "quote": "Avalara does not sell personal information for monetary consideration.", "says": "Says it does not sell personal data" }, { "key": "privacy.rights", "label": "Says what rights people have over their data", "found": true, "quote": "…the data subject's rights laid down in Chapter III of the GDPR, including, without limitation, right to access, rectification, erasure and portability of the data subject's personal data;" }, { "key": "privacy.contact", "label": "Gives a privacy contact", "found": true, "quote": "Avalara can be contacted through the Avalara Global Privacy Office at dataprivacy@avalara.com.", "says": "dataprivacy@avalara.com" }, { "key": "privacy.transfers", "label": "Says where data is transferred or stored", "found": true, "quote": "The European Commission’s Standard Contractual Clauses (as updated by the Commission Implementing Decision EU 2021/914 of 4 June 2021) (“SCCs”) are model contract clauses developed by the European Commission to legitimize transfers of personal data from the European Economic Area to processors located in other countri…", "says": "Relies on standard contractual clauses" } ], "toKnow": [ { "key": "privacy.sells", "label": "Says it sells personal data or shares it for advertising", "found": true, "quote": "We may share a common account identifier (such as a hashed email address or user ID) with our third-party advertising partners to help link the personal data we and our third-party partners collect to the same person, or otherwise target advertising to an individual on a third-party website or platform." }, { "key": "old", "label": "Has not been updated for three years or more", "found": true, "quote": "Last updated August 8, 2022" } ] } ] }, "pageJsonUrl": "https://www.anchorterminal.com/tools/avalara.json", "live": { "slug": "avalara", "probe": { "target": "https://rest.avatax.com/api/v2", "method": "get", "lastAt": "2026-10-08T17:36:30.571722273Z", "lastOk": true, "lastStatus": 401, "lastMs": 313, "lastNote": "asks for credentials", "authRequired": true, "uptime24h": 100, "uptime30d": 100, "p50ms24h": 328, "p95ms24h": 407, "samples24h": 25, "samples30d": 25, "days": [ { "date": "2026-10-08", "probes": 25, "ok": 25 } ] }, "vendorStatus": { "page": "https://status.avalara.com", "indicator": "none", "summary": "All Systems Operational", "checkedAt": "2026-10-08T17:37:43.046132634Z" }, "versions": [ { "registry": "npm", "name": "avatax", "version": "26.9.0", "seenAt": "2026-10-08T16:00:19.162430293Z" }, { "registry": "pypi", "name": "Avalara", "version": "26.9.0", "released": "2026-09-16", "seenAt": "2026-10-08T16:00:23.243148692Z" } ], "githubStars": 5, "npmWeekly": 330649, "pypiWeekly": 37689, "securityTxt": { "url": "https://avalara.com/.well-known/security.txt", "state": "none", "checkedAt": "2026-10-08T15:38:36.211738872Z" }, "updatedAt": "2026-10-08T17:37:43.046132634Z" } } }