{ "data": { "similar": [ { "grade": "C", "json": "https://www.anchorterminal.com/tools/anrok.json", "name": "Anrok", "score": 61.6, "shared": [ "tax.calculate", "tax.transactions", "tax.exemptions", "tax.filing" ], "slug": "anrok" }, { "grade": "C", "json": "https://www.anchorterminal.com/tools/vertex-tax.json", "name": "Vertex O Series", "score": 54.7, "shared": [ "tax.calculate", "tax.transactions", "tax.exemptions", "tax.invoicing" ], "slug": "vertex-tax" }, { "grade": "C", "json": "https://www.anchorterminal.com/tools/quaderno.json", "name": "Quaderno", "score": 59.5, "shared": [ "tax.calculate", "tax.transactions", "tax.invoicing" ], "slug": "quaderno" }, { "grade": "C", "json": "https://www.anchorterminal.com/tools/taxjar.json", "name": "TaxJar", "score": 57.6, "shared": [ "tax.calculate", "tax.transactions", "tax.exemptions" ], "slug": "taxjar" } ], "tool": { "slug": "avalara", "name": "Avalara AvaTax", "vendor": "Avalara, Inc.", "vendorUrl": "https://www.avalara.com", "kind": "http-api", "category": "tax", "summary": "Avalara AvaTax calculates sales tax, VAT and GST for a transaction and records it for reporting. Agents reach it through the AvaTax REST v2 API or a hosted MCP server, with separate Avalara products for returns, exemption certificates and e-invoicing.", "url": "https://www.anchorterminal.com/tools/avalara", "markdownUrl": "https://www.anchorterminal.com/tools/avalara.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/avalara.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/avalara.json", "repo": "https://github.com/avadev/mcp", "license": "Proprietary service under the Avalara Service Terms. The SDKs on GitHub are Apache-2.0. The MCP repository holds a README only, with no licence file", "transports": [ "http", "streamable-http" ], "remoteUrl": "https://rest.avatax.com/api/v2", "packages": [ { "registry": "npm", "name": "avatax" }, { "registry": "pypi", "name": "Avalara" } ], "auth": "mixed", "authNotes": "The MCP server uses OAuth through identity.avalara.com (sandbox ai-sbx.avlr.sh) with one scope, avalara_mcp, and a person signs in and consents in a browser. The identity server advertises PKCE (S256), a public client registration endpoint, device code and client credentials grants. The REST API accepts HTTP Basic with a username and password or with an account ID and licence key, or a bearer token from the identity server. Licence keys are account-wide, can be named, and a reset revokes the old key at once. What a caller can do follows the user's security role, such as AccountAdmin or CompanyUser. Access is self-serve through the trial signup, with no app review found.", "pricing": "paid", "pricingNotes": "Free 90-day AvaTax trial, no card, limited to 5 orders and 5 invoices a minute and 1,000 transactions a day, for evaluation with test data only under the AvaTax terms. Paid plans on the public pricing page are Core Compliance at $79 a state a month ($799 a state a year) and Core Compliance with SST services at $69 ($699 a year), both for businesses under $50M in annual revenue and both including AvaTax calculation and managed returns. Above that, plans are quoted. Avalara says price varies with products, states, integrations and monthly transaction volume, and no price per transaction or per API call is published (https://www.avalara.com/us/en/products/sales-and-use-tax/pricing.html, checked 2026-10-08).", "priceSummary": "$79 / mo", "where": "hosted", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in the developer docs, the AvaTax API reference or the pricing page (checked 2026-10-08).", "endpoints": [] }, "toolCount": 10, "popularity": { "githubStars": 5, "npmWeekly": 330649, "pypiWeekly": 37689, "asOf": "2026-10-08" }, "docsUrl": "https://developer.avalara.com/", "llmsTxt": "https://developer.avalara.com/llms.txt", "openapi": "https://sandbox-rest.avatax.com/swagger/v2/swagger.json", "registryName": "com.avalara/avatax", "capabilities": [ "tax.calculate", "tax.transactions", "tax.exemptions", "tax.filing", "tax.invoicing" ], "tags": [ "hosted", "paid", "free-trial", "mcp", "oauth", "openapi", "llms-txt", "typescript", "python", "java", "csharp", "sandbox", "status-page", "soc2", "iso27001" ], "lastRelease": "2026-09-16", "graded": true, "anchor": { "graded": true, "score": 68.8, "grade": "B", "agentReady": false, "rank": 162, "ranked": true, "rankOf": 629, "categoryRank": 1, "methodology": "0.4", "run": "2026-10-01", "scores": { "ergonomics": 84, "maintenance": 79, "payments": 30, "reliability": 62, "schema": 85, "security": 65, "transparency": 79 }, "pending": [ "performance", "tasks" ], "breakdown": [ { "key": "reliability", "name": "Reliability", "weight": 16, "effectiveWeight": 20, "score": 62, "points": 12.4, "reason": "Graded as a hosted service. Statuspage at status.avalara.com with 135 components, the AvaTax group split into Tax Calculation Service, Restv2, Batch, Reporting and others (20). Four incidents between 10 July and 8 October 2026. Three were short or outside AvaTax calculation. The fourth, on the Tax Calculation Service and AvaTax UI, ran from 22:32 PT on 5 October to 21:20 PT on 6 October, about 23 hours, marked minor with no cause given, so we scored between minor-only and one major outage (15). Numbers are published only for the trial (5 orders and 5 invoices a minute, 1,000 transactions a day) and report exports (5 a minute). Production limits not found (7). 429 is documented with three error codes, and the integration guide says to retry a timed-out invoice with CreateOrAdjustTransaction. No Retry-After or backoff guidance found (10). The Service Terms promise commercially reasonable efforts with no uptime percentage (0). REST v2 is GA and the MCP server is registered at 1.0.1 with no beta label (10)." }, { "key": "performance", "name": "Performance", "weight": 10, "effectiveWeight": 0, "pending": true, "points": 0, "reason": "Pending. Latency is measured per call by our probes, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until the first probe window closes." }, { "key": "schema", "name": "Schema \u0026 documentation", "weight": 13, "effectiveWeight": 16.25, "score": 85, "points": 13.81, "reason": "Public Swagger 2.0 file at sandbox-rest.avatax.com/swagger/v2/swagger.json with 491 operations and 635 models. MCP tool schemas sit behind OAuth and were not read (25). llms.txt plus a Markdown page per endpoint, 471 for AvaTax (10). 475 of 491 operations carry a description of more than 80 characters, several saying which call to use instead, such as CreateOrAdjustTransaction over CreateTransaction. MCP tool descriptions in the docs are one line each with a sample prompt (15). Enums on 203 properties, required fields on request models and examples on 2,717 properties, though `$filter` and `$include` are free-form strings (13). A curl example on each endpoint page and an error list of 429 codes, each with its own page (14). A written n.x.y versioning policy and a version number in the ping response, but the patch notes page stops at 23.4.1 on 26 April 2023 (8)." }, { "key": "ergonomics", "name": "Agent ergonomics", "weight": 13, "effectiveWeight": 16.25, "score": 84, "points": 13.65, "reason": "The MCP server documents ten tools. Their definitions sit behind OAuth, so size was not measured. On the API, `$include=SummaryOnly` or LinesOnly shrinks transaction responses (21). `$top`, `$skip`, `$filter` and `$orderBy` on 152 of 262 GET operations, with 1,000 records at most and `@nextLink` (20). Errors carry code, number, message, description, faultCode and helpLink (18). No idempotency key. CreateOrAdjustTransaction is the documented safe retry and CreateTransaction rejects a duplicate committed code. MCP annotations were not readable (10). CreateTransaction needs three fields (customerCode, date, lines) and defaults to an unrecorded SalesOrder estimate. SDKs in six languages (15)." }, { "key": "security", "name": "Security \u0026 auth", "weight": 14, "effectiveWeight": 17.5, "score": 65, "points": 11.38, "reason": "The MCP server uses OAuth with PKCE and a single scope, avalara_mcp. The REST guides lead with HTTP Basic using a username and password or an account ID and licence key. Keys are account-wide, can be named and are revoked on reset, and bearer tokens are accepted (20). Access follows user security roles, and a transaction is an unrecorded estimate unless an Invoice type is sent. No read-only mode or confirmation step is documented for the MCP's calculate_tax and create_nexus tools (10). Responses are mostly structured tax data with some merchant-entered text. No injection guidance found, and the Service Terms place responsibility for agent actions on the customer (8). An account audit endpoint for failed calls, audit log exports, and per-user attribution except with a licence key (12). Vulnerability disclosure programme, and SOC 1 Type 2, SOC 2 Type 2 and ISO 27001 listed for AvaTax. No security.txt and no bug bounty found (15)." }, { "key": "payments", "name": "Payments \u0026 pricing", "weight": 10, "effectiveWeight": 12.5, "score": 30, "points": 3.75, "reason": "No x402, MPP or L402 in the developer docs, API reference or pricing page (0). Plan prices are public at $79 a state a month, or $69 with SST services, with larger accounts quoted and no price per transaction (10). A 90-day trial with no card, 1,000 transactions a day (20). Signup and the OAuth consent both need a person in a browser (0)." }, { "key": "tasks", "name": "Task success", "weight": 10, "effectiveWeight": 0, "pending": true, "points": 0, "reason": "Pending. Task success needs the category task suites run through each tool, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until then. A data provider's data-quality score is published on its listing now and becomes half of this category when it's scored." }, { "key": "maintenance", "name": "Maintenance \u0026 community", "weight": 7, "effectiveWeight": 8.75, "score": 79, "points": 6.91, "reason": "Production answered as version 26.9.2 and the sandbox spec as 26.10.0 on 8 October 2026. The JavaScript and Python SDKs were tagged 26.9.0 on 16 September (30). SDK tags 26.7.3 on 27 July, 26.8.3 on 24 August and 26.9.0 on 16 September (20). Closed service. A developer community forum exists, but the public patch notes stop in April 2023, and we did not read reply times on the 24 open issues in the JavaScript SDK repository (7). com.avalara/avatax is in the official MCP registry under Avalara's own namespace, and the six SDKs are current (15). The JavaScript SDK has build and publish workflows and the Python SDK a publish workflow. Test results were not checked (7)." }, { "key": "transparency", "name": "Transparency \u0026 trust", "weight": 7, "effectiveWeight": 8.75, "score": 79, "points": 6.91, "note": "editorial 69, provenance 88", "reason": "Closed service with versioned terms that keep every past version online (Service Terms 7.1, effective 1 October 2026, and AvaTax supplemental terms). SDKs are Apache-2.0 (17). The DPA (version 1.10, 2 June 2025) limits use of customer data to running the service, support and legal compliance, with retrieval for 10 days after termination and destruction on request up to 60 days after. No fixed retention periods, backups are excepted, and Avalara may use de-identified aggregate data for any lawful purpose (20). A written policy deprecates version n-2 when n ships and decommissions it 18 months later, and the spec dates field deprecations. The policy's example table has dates out of order, and the terms let documentation alone count as notice (15). Subprocessor list version 11.0 of 9 September 2026 with date added, purpose and country, hosting on AWS in the United States (17)." } ], "assessment": { "date": "2026-10-08", "basis": "public evidence", "confidence": "medium", "notes": { "ergonomics": "The MCP server documents ten tools. Their definitions sit behind OAuth, so size was not measured. On the API, `$include=SummaryOnly` or LinesOnly shrinks transaction responses (21). `$top`, `$skip`, `$filter` and `$orderBy` on 152 of 262 GET operations, with 1,000 records at most and `@nextLink` (20). Errors carry code, number, message, description, faultCode and helpLink (18). No idempotency key. CreateOrAdjustTransaction is the documented safe retry and CreateTransaction rejects a duplicate committed code. MCP annotations were not readable (10). CreateTransaction needs three fields (customerCode, date, lines) and defaults to an unrecorded SalesOrder estimate. SDKs in six languages (15).", "maintenance": "Production answered as version 26.9.2 and the sandbox spec as 26.10.0 on 8 October 2026. The JavaScript and Python SDKs were tagged 26.9.0 on 16 September (30). SDK tags 26.7.3 on 27 July, 26.8.3 on 24 August and 26.9.0 on 16 September (20). Closed service. A developer community forum exists, but the public patch notes stop in April 2023, and we did not read reply times on the 24 open issues in the JavaScript SDK repository (7). com.avalara/avatax is in the official MCP registry under Avalara's own namespace, and the six SDKs are current (15). The JavaScript SDK has build and publish workflows and the Python SDK a publish workflow. Test results were not checked (7).", "payments": "No x402, MPP or L402 in the developer docs, API reference or pricing page (0). Plan prices are public at $79 a state a month, or $69 with SST services, with larger accounts quoted and no price per transaction (10). A 90-day trial with no card, 1,000 transactions a day (20). Signup and the OAuth consent both need a person in a browser (0).", "reliability": "Graded as a hosted service. Statuspage at status.avalara.com with 135 components, the AvaTax group split into Tax Calculation Service, Restv2, Batch, Reporting and others (20). Four incidents between 10 July and 8 October 2026. Three were short or outside AvaTax calculation. The fourth, on the Tax Calculation Service and AvaTax UI, ran from 22:32 PT on 5 October to 21:20 PT on 6 October, about 23 hours, marked minor with no cause given, so we scored between minor-only and one major outage (15). Numbers are published only for the trial (5 orders and 5 invoices a minute, 1,000 transactions a day) and report exports (5 a minute). Production limits not found (7). 429 is documented with three error codes, and the integration guide says to retry a timed-out invoice with CreateOrAdjustTransaction. No Retry-After or backoff guidance found (10). The Service Terms promise commercially reasonable efforts with no uptime percentage (0). REST v2 is GA and the MCP server is registered at 1.0.1 with no beta label (10).", "schema": "Public Swagger 2.0 file at sandbox-rest.avatax.com/swagger/v2/swagger.json with 491 operations and 635 models. MCP tool schemas sit behind OAuth and were not read (25). llms.txt plus a Markdown page per endpoint, 471 for AvaTax (10). 475 of 491 operations carry a description of more than 80 characters, several saying which call to use instead, such as CreateOrAdjustTransaction over CreateTransaction. MCP tool descriptions in the docs are one line each with a sample prompt (15). Enums on 203 properties, required fields on request models and examples on 2,717 properties, though `$filter` and `$include` are free-form strings (13). A curl example on each endpoint page and an error list of 429 codes, each with its own page (14). A written n.x.y versioning policy and a version number in the ping response, but the patch notes page stops at 23.4.1 on 26 April 2023 (8).", "security": "The MCP server uses OAuth with PKCE and a single scope, avalara_mcp. The REST guides lead with HTTP Basic using a username and password or an account ID and licence key. Keys are account-wide, can be named and are revoked on reset, and bearer tokens are accepted (20). Access follows user security roles, and a transaction is an unrecorded estimate unless an Invoice type is sent. No read-only mode or confirmation step is documented for the MCP's calculate_tax and create_nexus tools (10). Responses are mostly structured tax data with some merchant-entered text. No injection guidance found, and the Service Terms place responsibility for agent actions on the customer (8). An account audit endpoint for failed calls, audit log exports, and per-user attribution except with a licence key (12). Vulnerability disclosure programme, and SOC 1 Type 2, SOC 2 Type 2 and ISO 27001 listed for AvaTax. No security.txt and no bug bounty found (15).", "transparency": "Closed service with versioned terms that keep every past version online (Service Terms 7.1, effective 1 October 2026, and AvaTax supplemental terms). SDKs are Apache-2.0 (17). The DPA (version 1.10, 2 June 2025) limits use of customer data to running the service, support and legal compliance, with retrieval for 10 days after termination and destruction on request up to 60 days after. No fixed retention periods, backups are excepted, and Avalara may use de-identified aggregate data for any lawful purpose (20). A written policy deprecates version n-2 when n ships and decommissions it 18 months later, and the spec dates field deprecations. The policy's example table has dates out of order, and the terms let documentation alone count as notice (15). Subprocessor list version 11.0 of 9 September 2026 with date added, purpose and country, hosting on AWS in the United States (17)." }, "sources": [ { "what": "llms.txt and product index", "url": "https://developer.avalara.com/llms.txt", "seen": "2026-10-08" }, { "what": "AvaTax MCP server page and tool list", "url": "https://developer.avalara.com/products/avatax/mcp/", "seen": "2026-10-08" }, { "what": "MCP servers overview", "url": "https://developer.avalara.com/mcp-servers/", "seen": "2026-10-08" }, { "what": "MCP servers repository (README only)", "url": "https://github.com/avadev/mcp", "seen": "2026-10-08" }, { "what": "official MCP registry entries", "url": "https://registry.modelcontextprotocol.io/v0.1/servers?search=avalara", "seen": "2026-10-08" }, { "what": "MCP OAuth resource metadata", "url": "https://mcp.avalara.com/.well-known/oauth-protected-resource/avatax", "seen": "2026-10-08" }, { "what": "identity server metadata", "url": "https://identity.avalara.com/.well-known/openid-configuration", "seen": "2026-10-08" }, { "what": "AvaTax Swagger file", "url": "https://sandbox-rest.avatax.com/swagger/v2/swagger.json", "seen": "2026-10-08" }, { "what": "production version (ping)", "url": "https://rest.avatax.com/api/v2/utilities/ping", "seen": "2026-10-08" }, { "what": "bundled AvaTax API reference in Markdown", "url": "https://developer.avalara.com/products/avatax/api.md", "seen": "2026-10-08" }, { "what": "authentication in REST v2", "url": "https://developer.avalara.com/avatax/authentication-in-rest/", "seen": "2026-10-08" }, { "what": "retry or fallback guide", "url": "https://developer.avalara.com/sales-tax-integration-guide/djk3478758993515/", "seen": "2026-10-08" }, { "what": "rate limit error page", "url": "https://developer.avalara.com/avatax/errors/RateLimitExceededError/", "seen": "2026-10-08" }, { "what": "API versioning and deprecation policy", "url": "https://developer.avalara.com/api-versioning/", "seen": "2026-10-08" }, { "what": "API patch notes", "url": "https://developer.avalara.com/patch-notes/", "seen": "2026-10-08" }, { "what": "free trial terms and limits", "url": "https://developer.avalara.com/freeTrial/", "seen": "2026-10-08" }, { "what": "sales tax pricing", "url": "https://www.avalara.com/us/en/products/sales-and-use-tax/pricing.html", "seen": "2026-10-08" }, { "what": "status incidents", "url": "https://status.avalara.com/api/v2/incidents.json", "seen": "2026-10-08" }, { "what": "Service Terms and legal centre", "url": "https://legal.avalara.com/", "seen": "2026-10-08" }, { "what": "AvaTax supplemental terms", "url": "https://legal.avalara.com/product-terms.html#avatax", "seen": "2026-10-08" }, { "what": "DPA, privacy notices and subprocessors", "url": "https://legal.avalara.com/dpa", "seen": "2026-10-08" }, { "what": "trust centre", "url": "https://trust.avalara.com/", "seen": "2026-10-08" }, { "what": "responsible disclosure", "url": "https://www.avalara.com/us/en/legal/responsible-disclosure.html", "seen": "2026-10-08" }, { "what": "JavaScript SDK tags and workflows", "url": "https://github.com/avadev/AvaTax-REST-V2-JS-SDK", "seen": "2026-10-08" }, { "what": "Python SDK tags", "url": "https://github.com/avadev/AvaTax-REST-V2-Python-SDK", "seen": "2026-10-08" }, { "what": "npm package", "url": "https://registry.npmjs.org/avatax/latest", "seen": "2026-10-08" }, { "what": "PyPI package", "url": "https://pypi.org/pypi/Avalara/json", "seen": "2026-10-08" } ], "openQuestions": [ "unchecked: the MCP server's tool definitions, input schemas and readOnlyHint or destructiveHint annotations, which need an OAuth sign-in with an Avalara account", "unchecked: production rate limits for transaction calls and whether 429 responses carry Retry-After. Neither was found in the public documentation", "unchecked: the trust centre's documents (security policy, AI governance) and the platform behind the vulnerability disclosure programme, which load only with JavaScript or on request", "unchecked: reply times on issues in the SDK repositories and whether SDK tests pass, since only the git history was read", "Whether an uptime SLA exists in order documents. The Service Terms give none, and the product page's 99.99 per cent figure is a marketing claim", "Whether the Claude Code tab on the MCP page gives a command. Only the Cursor configuration was readable without JavaScript", "The cause of the 5 to 6 October 2026 AvaTax degradation. The status page gives none and marks it minor", "The pricing page prices plans per state, so the unit prices are entered as monthly plans. No price per transaction was found" ] }, "negative": 0, "verdict": "The REST API has a public Swagger file with 491 operations, a Markdown page per endpoint and a 90-day trial with no card. Production rate limits and prices per transaction are not published, the API patch notes stop at April 2023, and the tax calculation service was degraded for about 23 hours on 5 and 6 October 2026.", "bestFor": "An agent that must calculate and record US sales tax at address level, with VAT and GST in other countries, and hand the records to filing.", "strengths": [ "Public Swagger 2.0 file with 491 operations, plus llms.txt and a Markdown page with a curl example for each endpoint", "Hosted MCP server at mcp.avalara.com/avatax with ten documented tools, OAuth sign-in and an entry in the official MCP registry as com.avalara/avatax", "90-day AvaTax trial with no card, limited to 5 orders and 5 invoices a minute and 1,000 transactions a day", "Errors return a code, number, description and help link, from a published list of 429 codes", "SDKs in six languages under Apache-2.0, released monthly, latest 26.9.0 on 16 September 2026" ], "weaknesses": [ "Production rate limits are not published. The only numbers found are the trial limits and 5 calls a minute on report exports", "No price per transaction. Public plans are $79 a state a month, or $69 with SST services, and larger accounts are quoted", "The API patch notes page ends at version 23.4.1 of 26 April 2023, while production reports 26.9.2", "Tax calculation was degraded from 22:32 PT on 5 October to 21:20 PT on 6 October 2026, per status.avalara.com", "REST guides lead with HTTP Basic using a username and password or an account-wide licence key, and the MCP server has one scope, avalara_mcp" ], "agentNotes": [ "Omit `type` or send SalesOrder for an estimate. A type ending in Invoice is recorded, and `commit` set to true locks it for reporting", "Retry a timed-out invoice with CreateOrAdjustTransaction, not CreateTransaction, which errors when a committed transaction has the same code", "Use sandbox-rest.avatax.com with sandbox credentials for tests. Production is rest.avatax.com and the two accounts are separate", "Add `$include=SummaryOnly` or LinesOnly to shrink transaction responses, and page lists with `$top` (1,000 at most) and `$skip`", "Call /api/v2/utilities/ping first. It answers without credentials and shows whether the credentials sent were accepted" ], "metrics": { "kind": "remote", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "B", "methodology": "0.4", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 68.8 } ], "editorialScores": { "ergonomics": 84, "maintenance": 79, "payments": 30, "reliability": 62, "schema": 85, "security": 65, "transparency": 69 }, "provenanceScore": 88 }, "connect": { "install": "npm install avatax", "http": "curl -X POST \"https://sandbox-rest.avatax.com/api/v2/transactions/create\" \\\n -H \"Authorization: Basic \u003ccredentials\u003e\" \\\n -H \"Content-Type: application/json\" \\\n -H \"Accept: application/json\" \\\n -d @transaction.json", "config": { "mcpServers": { "avalara-avatax": { "type": "http", "url": "https://mcp.avalara.com/avatax" } } } }, "letme": { "capability": "https://letme.dev/tax.calculate", "tool": "https://letme.dev/avalara" }, "notable": [ "The AvaTax MCP server documents ten tools, among them calculate_tax, get_transactions, create_nexus, get_tax_code_recommendations and validate_address, with production and sandbox endpoints (https://developer.avalara.com/products/avatax/mcp/)", "The official MCP registry lists eight Avalara servers under com.avalara, with com.avalara/avatax at version 1.0.1 published on 19 June 2026 (https://registry.modelcontextprotocol.io/v0.1/servers?search=avalara)", "llms.txt links a Markdown page for every product and an index of more than 2,400 endpoint pages, 471 of them for AvaTax (https://developer.avalara.com/llms.txt)", "The Service Terms add a Customer Agents clause that makes the customer solely responsible for actions taken by an AI agent it connects. Version 7.1 is effective 1 October 2026 (https://legal.avalara.com/)", "The versioning policy deprecates major version n-2 when version n ships and decommissions it 18 months later, after which calls return 400 with a version-too-old message (https://developer.avalara.com/api-versioning/)", "status.avalara.com shows an AvaTax degradation on the Tax Calculation Service from 22:32 PT on 5 October to 21:20 PT on 6 October 2026, marked minor (https://status.avalara.com/history)", "The trust centre lists SOC 1 Type 2, SOC 2 Type 2 and ISO 27001 for AvaTax, and Avalara runs a vulnerability disclosure programme (https://trust.avalara.com/, https://www.avalara.com/us/en/legal/responsible-disclosure.html)" ], "area": "domain-data", "details": [ { "label": "Surface graded", "value": "AvaTax REST v2 API at https://rest.avatax.com/api/v2 (sandbox https://sandbox-rest.avatax.com) and the hosted AvaTax MCP server at https://mcp.avalara.com/avatax (sandbox https://mcp.sbx.avalara.com/avatax)" }, { "label": "API size", "value": "Swagger 2.0, 491 operations on 352 paths under 51 tags, 635 models. Production reported version 26.9.2 and the sandbox spec 26.10.0 on 8 October 2026" }, { "label": "MCP tools", "value": "calculate_tax, get_transaction, get_transactions, get_nexus_definitions, get_nexus, create_nexus, get_companies, get_tax_code_definitions, get_tax_code_recommendations, validate_address" }, { "label": "Other Avalara MCP servers", "value": "Returns, E-Invoicing and Live Reporting, Exemption Certificate Management, Cross-Border, Classification, Tax Content, Business Licensing and developer docs, each at https://mcp.avalara.com/\u003cname\u003e" }, { "label": "Credentials", "value": "MCP by OAuth with the scope avalara_mcp. REST by HTTP Basic (username and password, or account ID and licence key) or a bearer token. Permissions follow the user's security role" }, { "label": "Trial", "value": "90 days, no card, 5 orders and 5 invoices a minute, 1,000 transactions a day, test data only, no warranty or support, data may be deleted at the end" }, { "label": "Rate limits", "value": "Trial limits as above and 5 calls a minute on report exports. No production limits with numbers found. Errors RateLimitExceededError, RequestLimitExceeded and ConcurrentRequestLimitExceeded are documented" }, { "label": "Retries", "value": "No idempotency key. CreateOrAdjustTransaction creates or adjusts by transaction code and is the documented retry after a timeout. `$include=ForceTimeout` simulates a 30-second timeout for testing" }, { "label": "Paging and filtering", "value": "`$top`, `$skip`, `$filter` and `$orderBy` on 152 of 262 GET operations, 1,000 records at most per call, `@nextLink` in results. `$include` selects nested data, with SummaryOnly and LinesOnly to shrink responses" }, { "label": "SDKs", "value": "C#, Java, JavaScript (npm avatax 26.9.0), Python (PyPI Avalara 26.9.0), PHP and Ruby, Apache-2.0, tagged monthly, latest 16 September 2026" }, { "label": "Audit", "value": "GET /api/v2/accounts/{id}/audit returns API calls that ended in an error, one hour at a time. Audit log reports export through /api/v2/reports/exportauditlogs. Calls made with a licence key are logged against a key user, not a person" }, { "label": "Availability terms", "value": "Commercially reasonable efforts to be available 24 hours a day, 7 days' notice of planned downtime, status updates at status.avalara.com. No uptime percentage in the Service Terms. The product page claims 99.99 per cent uptime" }, { "label": "Data", "value": "DPA version 1.10 (2 June 2025). Customer data is retrievable for 10 days after termination and destroyed on request up to 60 days after, backups and legally required records excepted. Subprocessor list version 11.0 (9 September 2026) with countries" }, { "label": "Certifications", "value": "AvaTax is listed with SOC 1 Type 2, SOC 2 Type 2 and ISO 27001 on trust.avalara.com. Vulnerability disclosure programme with a hall of fame. No security.txt" } ], "unitPrices": [ { "item": "Core Compliance (AvaTax and managed returns)", "unit": "month", "usd": 79, "note": "per state, billed monthly; $799 per state billed yearly; annual revenue under $50M" }, { "item": "Core Compliance + SST Services", "unit": "month", "usd": 69, "note": "per state, billed monthly; $699 per state billed yearly; qualifying sellers" }, { "item": "AvaTax free trial", "unit": "month", "usd": 0, "note": "90 days, 1,000 transactions a day, test data only" } ], "provenance": { "legalEntity": "Avalara, Inc.", "domain": "avalara.com", "domainRegistered": "2003-12-08", "endpointOnVendorDomain": true, "terms": "https://legal.avalara.com/", "privacy": "https://legal.avalara.com/dpa", "statusPage": "https://status.avalara.com", "changelog": "https://developer.avalara.com/patch-notes/", "securityTxt": "none", "checked": "2026-10-08", "notes": [ "The Service Terms (version 7.1, effective 1 October 2026) name Avalara, Inc., a Washington corporation at 512 S. Mangum St. #100, Durham, NC 27701, as the contracting entity under New York law, and Avalara Europe Ltd. (England and Wales, No. 8446351) for European customers.", "The MCP server answers at mcp.avalara.com. The REST API answers at rest.avatax.com and sandbox-rest.avatax.com. RDAP gives avatax.com a registration date of 2005-01-27, and Avalara's own documentation names those hosts.", "www.avalara.com/.well-known/security.txt and developer.avalara.com/.well-known/security.txt return 404. Reports go through the vulnerability disclosure programme at https://www.avalara.com/us/en/legal/responsible-disclosure.html.", "The patch notes page lists API releases up to 23.4.1 on 26 April 2023 and nothing later. Current releases are visible only as the version in /api/v2/utilities/ping and as SDK tags on GitHub.", "RDAP for avalara.com gives a registration date of 2003-12-08. Privacy notices, the DPA and the subprocessor list are published together at legal.avalara.com/dpa." ], "score": 88, "checks": [ { "check": "Legal entity named", "value": "Avalara, Inc.", "points": 20, "max": 20, "state": "ok" }, { "check": "Domain age", "value": "avalara.com, registered 2003-12-08 (22 years)", "points": 15, "max": 15, "state": "ok" }, { "check": "Endpoint on the vendor's domain", "value": "rest.avatax.com", "points": 15, "max": 15, "state": "ok" }, { "check": "Terms of service", "value": "read, states 7 of the 7 things a reader expects, and has 1 clause that costs points", "points": 8, "max": 10, "state": "part" }, { "check": "Privacy policy", "value": "read, states 8 of the 8 things a reader expects", "points": 10, "max": 10, "state": "ok" }, { "check": "Status page", "value": "status.avalara.com", "points": 10, "max": 10, "state": "ok" }, { "check": "Changelog", "value": "published", "points": 10, "max": 10, "state": "ok" }, { "check": "security.txt", "value": "not found", "points": 0, "max": 10, "state": "no" } ], "policies": [ { "kind": "terms", "url": "https://legal.avalara.com/", "state": "read", "readAt": "2026-10-08", "statedDate": "2023-05-01", "words": 321020, "points": 8, "max": 10, "expected": [ { "key": "terms.date", "label": "Gives the date it was last updated", "found": true, "quote": "Last updated May 1, 2023.", "says": "Last updated 2023-05-01" }, { "key": "terms.law", "label": "Names the governing law or courts", "found": true, "quote": "The Agreement and all matters in connection with the Agreement will be governed by laws of the state of New York, without regard to any laws, treaties, or conflicts of laws principles that would apply the law of any other jurisdiction and without regard to the United Nations Convention on the International Sale of Goo…", "says": "The law of the State of New York" }, { "key": "terms.liability", "label": "States a limit on its liability", "found": true, "quote": "Neither Party’s aggregate liability to the other Party will exceed the fees paid or payable by Customer to Avalara under the Agreement in the 12-month period immediately preceding the event giving rise to the claim.", "says": "Capped at the fees paid in the 12 months before the claim" }, { "key": "terms.termination", "label": "Says how the agreement or account can be ended", "found": true, "quote": "Avalara may suspend Customer's Account if: (i) Customer, its Affiliates, or its or their Authorized Users or Representatives causes a material risk to the security or performance of the Services, the network, itself, or any other Avalara customer or business partner;" }, { "key": "terms.changes", "label": "Says how changes to the terms are announced", "found": true, "quote": "Customer may elect to not renew the subscription by providing Avalara at least 30 days' written notice prior to renewal;", "says": "Gives 30 days of notice before a change" }, { "key": "terms.use", "label": "Lists what users may not do", "found": true, "quote": "Customer shall not use any services that are not set forth in an Order Document signed by Customer and accepted by Avalara, except as otherwise provided in the Agreement." }, { "key": "terms.sla", "label": "Refers to a service level or uptime commitment", "found": true, "quote": "Avalara shall: (i) track uptime statistics and, as applicable, provide status updates at status.avalara.com or an equivalent replacement site;" } ], "toKnow": [ { "key": "terms.benchmark", "label": "Restricts benchmarking or competitive use", "found": true, "quote": "You shall not (i) distribute the Developer Tools to any third party, (ii) use the Developer Tools to build or provide a competitive product or service (including using the Developer Tools to gain insights into building or providing a competitive product or service), (iii) copy any features or functions of Avalara’s pr…", "costsPoints": true }, { "key": "terms.cutoff", "label": "Says access can be ended without notice or for any reason", "found": true, "quote": "However, if the Distributor from whom Customer purchased a Service fails to pay Avalara any amounts due in connection with Customer’s use of the Services, Avalara may suspend Customer’s Account, with or without notice to Customer." }, { "key": "old", "label": "Has not been updated for three years or more", "found": true, "quote": "Last updated May 1, 2023." } ] }, { "kind": "privacy", "url": "https://legal.avalara.com/dpa", "state": "read", "readAt": "2026-10-08", "statedDate": "2022-08-08", "words": 194081, "points": 10, "max": 10, "expected": [ { "key": "privacy.date", "label": "Gives the date it was last updated", "found": true, "quote": "Last updated August 8, 2022", "says": "Last updated 2022-08-08" }, { "key": "privacy.collected", "label": "Says what personal data is collected", "found": true, "quote": "Certain categories of personal information are shared only in specific contexts, such as lead generation, paid syndication, advertising measurement, or audience development." }, { "key": "privacy.retention", "label": "Says how long data is kept", "found": true, "quote": "For the purposes of the DPDP Act, the personal data collected by Avalara shall be retained for (a) as long as is necessary for the purposes under this Privacy Notice or (b) if you withdraw your consent provided under this Privacy Notice, or you exercise your right to erasure, whichever is earlier, unless the retention…", "says": "For as long as needed, with no period named" }, { "key": "privacy.processors", "label": "Says who else receives the data", "found": true, "quote": "In order to provide its service, Avalara may use subprocessors (both Avalara affiliates and third parties) located outside the European Economic Area (\"EEA\"), the United Kingdom, and Switzerland." }, { "key": "privacy.sale", "label": "Says whether personal data is sold or shared for advertising", "found": true, "quote": "Avalara does not sell personal information for monetary consideration.", "says": "Says it does not sell personal data" }, { "key": "privacy.rights", "label": "Says what rights people have over their data", "found": true, "quote": "…the data subject's rights laid down in Chapter III of the GDPR, including, without limitation, right to access, rectification, erasure and portability of the data subject's personal data;" }, { "key": "privacy.contact", "label": "Gives a privacy contact", "found": true, "quote": "Avalara can be contacted through the Avalara Global Privacy Office at dataprivacy@avalara.com.", "says": "dataprivacy@avalara.com" }, { "key": "privacy.transfers", "label": "Says where data is transferred or stored", "found": true, "quote": "The European Commission’s Standard Contractual Clauses (as updated by the Commission Implementing Decision EU 2021/914 of 4 June 2021) (“SCCs”) are model contract clauses developed by the European Commission to legitimize transfers of personal data from the European Economic Area to processors located in other countri…", "says": "Relies on standard contractual clauses" } ], "toKnow": [ { "key": "privacy.sells", "label": "Says it sells personal data or shares it for advertising", "found": true, "quote": "We may share a common account identifier (such as a hashed email address or user ID) with our third-party advertising partners to help link the personal data we and our third-party partners collect to the same person, or otherwise target advertising to an individual on a third-party website or platform." }, { "key": "old", "label": "Has not been updated for three years or more", "found": true, "quote": "Last updated August 8, 2022" } ] } ] }, "pageJsonUrl": "https://www.anchorterminal.com/tools/avalara.json", "live": { "slug": "avalara", "probe": { "target": "https://rest.avatax.com/api/v2", "method": "get", "lastAt": "2026-10-08T19:08:39.846678929Z", "lastOk": true, "lastStatus": 401, "lastMs": 358, "lastNote": "asks for credentials", "authRequired": true, "uptime24h": 100, "uptime30d": 100, "p50ms24h": 327, "p95ms24h": 363, "samples24h": 42, "samples30d": 42, "days": [ { "date": "2026-10-08", "probes": 42, "ok": 42 } ] }, "vendorStatus": { "page": "https://status.avalara.com", "indicator": "none", "summary": "All Systems Operational", "checkedAt": "2026-10-08T19:06:27.282380712Z" }, "versions": [ { "registry": "npm", "name": "avatax", "version": "26.9.0", "seenAt": "2026-10-08T16:00:19.162430293Z" }, { "registry": "pypi", "name": "Avalara", "version": "26.9.0", "released": "2026-09-16", "seenAt": "2026-10-08T16:00:23.243148692Z" } ], "githubStars": 5, "npmWeekly": 330649, "pypiWeekly": 37689, "securityTxt": { "url": "https://avalara.com/.well-known/security.txt", "state": "none", "checkedAt": "2026-10-08T15:38:36.211738872Z" }, "pages": [ { "url": "https://developer.avalara.com/patch-notes/", "kind": "changelog", "status": 200, "checkedAt": "2026-10-08T18:17:04.362764489Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "12c3dd83a580" }, { "url": "https://www.avalara.com/us/en/products/sales-and-use-tax/pricing.html", "kind": "pricing", "status": 200, "checkedAt": "2026-10-08T18:26:21.240577756Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "ab348ca6c51d" }, { "url": "https://legal.avalara.com/dpa", "kind": "privacy", "status": 200, "checkedAt": "2026-10-08T18:21:25.299594822Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "1d325483f118" }, { "url": "https://legal.avalara.com/", "kind": "terms", "status": 200, "checkedAt": "2026-10-08T18:21:22.64286746Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "ac0c20791779" } ], "updatedAt": "2026-10-08T19:08:39.846678929Z" } }, "verify": { "accepts": "a page on avalara.com or one of its subdomains, or the README of github.com/avadev/mcp", "badgeUrl": "https://www.anchorterminal.com/badges/avalara.svg", "body": { "slug": "avalara", "url": "the page with the badge or the link" }, "docs": "https://www.anchorterminal.com/builders/#verify", "effect": "none, it never changes a grade, rank or review", "endpoint": "https://www.anchorterminal.com/api/v1/verify", "listingUrl": "https://www.anchorterminal.com/tools/avalara", "mcpTool": "verify_listing", "recheck": "weekly; two failed checks in a row and it lapses, a later pass restores it", "snippets": { "html": "\u003ca href=\"https://www.anchorterminal.com/tools/avalara\"\u003e\u003cimg src=\"https://www.anchorterminal.com/badges/avalara.svg\" alt=\"Avalara AvaTax on Anchor Terminal\" height=\"20\"\u003e\u003c/a\u003e", "markdown": "[![Avalara AvaTax on Anchor Terminal](https://www.anchorterminal.com/badges/avalara.svg)](https://www.anchorterminal.com/tools/avalara)", "link": "\u003ca href=\"https://www.anchorterminal.com/tools/avalara\"\u003eAvalara AvaTax on Anchor Terminal\u003c/a\u003e" } } }, "kind": "anchor.page", "links": { "api": "https://www.anchorterminal.com/api/v1/index.json", "html": "https://www.anchorterminal.com/tools/avalara", "json": "https://www.anchorterminal.com/tools/avalara.json", "llms": "https://www.anchorterminal.com/llms.txt", "markdown": "https://www.anchorterminal.com/tools/avalara.md", "slim": "https://www.anchorterminal.com/tools/avalara.min.md" }, "markdown": "## Overview\n\n**Grade B · 68.8/100 · rank #162 of 629 · #1 in Tax calculation \u0026 compliance · not agent-ready · confidence medium**\n\n\n## Assessment\n\nThe REST API has a public Swagger file with 491 operations, a Markdown page per endpoint and a 90-day trial with no card. Production rate limits and prices per transaction are not published, the API patch notes stop at April 2023, and the tax calculation service was degraded for about 23 hours on 5 and 6 October 2026.\n\n## Facts\n\n| Field | Value |\n| --- | --- |\n| Vendor | Avalara, Inc. (https://www.avalara.com) |\n| Kind | HTTP API |\n| Category | Tax calculation \u0026 compliance (https://www.anchorterminal.com/categories/tax) |\n| Transport | HTTP, Streamable HTTP |\n| Endpoint | `https://rest.avatax.com/api/v2` |\n| Auth | OAuth or key · The MCP server uses OAuth through identity.avalara.com (sandbox ai-sbx.avlr.sh) with one scope, avalara_mcp, and a person signs in and consents in a browser. The identity server advertises PKCE (S256), a public client registration endpoint, device code and client credentials grants. The REST API accepts HTTP Basic with a username and password or with an account ID and licence key, or a bearer token from the identity server. Licence keys are account-wide, can be named, and a reset revokes the old key at once. What a caller can do follows the user's security role, such as AccountAdmin or CompanyUser. Access is self-serve through the trial signup, with no app review found. |\n| Pricing | Paid ($79 / mo) · Free 90-day AvaTax trial, no card, limited to 5 orders and 5 invoices a minute and 1,000 transactions a day, for evaluation with test data only under the AvaTax terms. Paid plans on the public pricing page are Core Compliance at $79 a state a month ($799 a state a year) and Core Compliance with SST services at $69 ($699 a year), both for businesses under $50M in annual revenue and both including AvaTax calculation and managed returns. Above that, plans are quoted. Avalara says price varies with products, states, integrations and monthly transaction volume, and no price per transaction or per API call is published (https://www.avalara.com/us/en/products/sales-and-use-tax/pricing.html, checked 2026-10-08). |\n| x402 | No · No x402, MPP or L402 in the developer docs, the AvaTax API reference or the pricing page (checked 2026-10-08). |\n| Licence | Proprietary service under the Avalara Service Terms. The SDKs on GitHub are Apache-2.0. The MCP repository holds a README only, with no licence file |\n| Tools exposed | 10 |\n| Packages | npm: `avatax`; pypi: `Avalara` |\n| MCP registry name | `com.avalara/avatax` |\n| Source | https://github.com/avadev/mcp |\n| Docs | https://developer.avalara.com/ |\n| llms.txt | https://developer.avalara.com/llms.txt |\n| Last release | 2026-09-16 |\n| GitHub stars | 5 (as of 2026-10-08) |\n| npm downloads / week | 330,649 |\n| PyPI downloads / week | 37,689 |\n| Surface graded | AvaTax REST v2 API at https://rest.avatax.com/api/v2 (sandbox https://sandbox-rest.avatax.com) and the hosted AvaTax MCP server at https://mcp.avalara.com/avatax (sandbox https://mcp.sbx.avalara.com/avatax) |\n| API size | Swagger 2.0, 491 operations on 352 paths under 51 tags, 635 models. Production reported version 26.9.2 and the sandbox spec 26.10.0 on 8 October 2026 |\n| MCP tools | calculate_tax, get_transaction, get_transactions, get_nexus_definitions, get_nexus, create_nexus, get_companies, get_tax_code_definitions, get_tax_code_recommendations, validate_address |\n| Other Avalara MCP servers | Returns, E-Invoicing and Live Reporting, Exemption Certificate Management, Cross-Border, Classification, Tax Content, Business Licensing and developer docs, each at https://mcp.avalara.com/\u003cname\u003e |\n| Credentials | MCP by OAuth with the scope avalara_mcp. REST by HTTP Basic (username and password, or account ID and licence key) or a bearer token. Permissions follow the user's security role |\n| Trial | 90 days, no card, 5 orders and 5 invoices a minute, 1,000 transactions a day, test data only, no warranty or support, data may be deleted at the end |\n| Rate limits | Trial limits as above and 5 calls a minute on report exports. No production limits with numbers found. Errors RateLimitExceededError, RequestLimitExceeded and ConcurrentRequestLimitExceeded are documented |\n| Retries | No idempotency key. CreateOrAdjustTransaction creates or adjusts by transaction code and is the documented retry after a timeout. `$include=ForceTimeout` simulates a 30-second timeout for testing |\n| Paging and filtering | `$top`, `$skip`, `$filter` and `$orderBy` on 152 of 262 GET operations, 1,000 records at most per call, `@nextLink` in results. `$include` selects nested data, with SummaryOnly and LinesOnly to shrink responses |\n| SDKs | C#, Java, JavaScript (npm avatax 26.9.0), Python (PyPI Avalara 26.9.0), PHP and Ruby, Apache-2.0, tagged monthly, latest 16 September 2026 |\n| Audit | GET /api/v2/accounts/{id}/audit returns API calls that ended in an error, one hour at a time. Audit log reports export through /api/v2/reports/exportauditlogs. Calls made with a licence key are logged against a key user, not a person |\n| Availability terms | Commercially reasonable efforts to be available 24 hours a day, 7 days' notice of planned downtime, status updates at status.avalara.com. No uptime percentage in the Service Terms. The product page claims 99.99 per cent uptime |\n| Data | DPA version 1.10 (2 June 2025). Customer data is retrievable for 10 days after termination and destroyed on request up to 60 days after, backups and legally required records excepted. Subprocessor list version 11.0 (9 September 2026) with countries |\n| Certifications | AvaTax is listed with SOC 1 Type 2, SOC 2 Type 2 and ISO 27001 on trust.avalara.com. Vulnerability disclosure programme with a hall of fame. No security.txt |\n| Capabilities | tax.calculate, tax.transactions, tax.exemptions, tax.filing, tax.invoicing |\n| Tags | hosted, paid, free-trial, mcp, oauth, openapi, llms-txt, typescript, python, java, csharp, sandbox, status-page, soc2, iso27001 |\n| JSON | https://www.anchorterminal.com/api/v1/tools/avalara.json |\n\n## Score breakdown (methodology v0.4, October 2026 research run)\n\nAssessed 2026-10-08 from public evidence against the published checklist (https://www.anchorterminal.com/benchmark/#checklist). Confidence: medium. Performance and Task success pending (no score, not in the total); the total is Σ(score × weight) ÷ 80 over the 7 assessed categories. \"This run\" is each category's share of the 100 points.\n\n| Category | Weight | This run | Score (0–100) | Points |\n| --- | --- | --- | --- | --- |\n| Reliability | 16% | 20 | 62 | 12.4 |\n| Performance | 10% | pending | pending | n/a |\n| Schema \u0026 documentation | 13% | 16.2 | 85 | 13.8 |\n| Agent ergonomics | 13% | 16.2 | 84 | 13.7 |\n| Security \u0026 auth | 14% | 17.5 | 65 | 11.4 |\n| Payments \u0026 pricing | 10% | 12.5 | 30 | 3.8 |\n| Task success | 10% | pending | pending | n/a |\n| Maintenance \u0026 community | 7% | 8.8 | 79 | 6.9 |\n| Transparency \u0026 trust (editorial 69, provenance 88) | 7% | 8.8 | 79 | 6.9 |\n| Negative events | up to −15 | up to −15 | none recorded | 0 |\n| **Total** | | | | **68.8 → B** |\n\n### Why each score\n\n- Reliability 62: Graded as a hosted service. Statuspage at status.avalara.com with 135 components, the AvaTax group split into Tax Calculation Service, Restv2, Batch, Reporting and others (20). Four incidents between 10 July and 8 October 2026. Three were short or outside AvaTax calculation. The fourth, on the Tax Calculation Service and AvaTax UI, ran from 22:32 PT on 5 October to 21:20 PT on 6 October, about 23 hours, marked minor with no cause given, so we scored between minor-only and one major outage (15). Numbers are published only for the trial (5 orders and 5 invoices a minute, 1,000 transactions a day) and report exports (5 a minute). Production limits not found (7). 429 is documented with three error codes, and the integration guide says to retry a timed-out invoice with CreateOrAdjustTransaction. No Retry-After or backoff guidance found (10). The Service Terms promise commercially reasonable efforts with no uptime percentage (0). REST v2 is GA and the MCP server is registered at 1.0.1 with no beta label (10).\n- Performance: Pending. Latency is measured per call by our probes, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until the first probe window closes.\n- Schema \u0026 documentation 85: Public Swagger 2.0 file at sandbox-rest.avatax.com/swagger/v2/swagger.json with 491 operations and 635 models. MCP tool schemas sit behind OAuth and were not read (25). llms.txt plus a Markdown page per endpoint, 471 for AvaTax (10). 475 of 491 operations carry a description of more than 80 characters, several saying which call to use instead, such as CreateOrAdjustTransaction over CreateTransaction. MCP tool descriptions in the docs are one line each with a sample prompt (15). Enums on 203 properties, required fields on request models and examples on 2,717 properties, though `$filter` and `$include` are free-form strings (13). A curl example on each endpoint page and an error list of 429 codes, each with its own page (14). A written n.x.y versioning policy and a version number in the ping response, but the patch notes page stops at 23.4.1 on 26 April 2023 (8).\n- Agent ergonomics 84: The MCP server documents ten tools. Their definitions sit behind OAuth, so size was not measured. On the API, `$include=SummaryOnly` or LinesOnly shrinks transaction responses (21). `$top`, `$skip`, `$filter` and `$orderBy` on 152 of 262 GET operations, with 1,000 records at most and `@nextLink` (20). Errors carry code, number, message, description, faultCode and helpLink (18). No idempotency key. CreateOrAdjustTransaction is the documented safe retry and CreateTransaction rejects a duplicate committed code. MCP annotations were not readable (10). CreateTransaction needs three fields (customerCode, date, lines) and defaults to an unrecorded SalesOrder estimate. SDKs in six languages (15).\n- Security \u0026 auth 65: The MCP server uses OAuth with PKCE and a single scope, avalara_mcp. The REST guides lead with HTTP Basic using a username and password or an account ID and licence key. Keys are account-wide, can be named and are revoked on reset, and bearer tokens are accepted (20). Access follows user security roles, and a transaction is an unrecorded estimate unless an Invoice type is sent. No read-only mode or confirmation step is documented for the MCP's calculate_tax and create_nexus tools (10). Responses are mostly structured tax data with some merchant-entered text. No injection guidance found, and the Service Terms place responsibility for agent actions on the customer (8). An account audit endpoint for failed calls, audit log exports, and per-user attribution except with a licence key (12). Vulnerability disclosure programme, and SOC 1 Type 2, SOC 2 Type 2 and ISO 27001 listed for AvaTax. No security.txt and no bug bounty found (15).\n- Payments \u0026 pricing 30: No x402, MPP or L402 in the developer docs, API reference or pricing page (0). Plan prices are public at $79 a state a month, or $69 with SST services, with larger accounts quoted and no price per transaction (10). A 90-day trial with no card, 1,000 transactions a day (20). Signup and the OAuth consent both need a person in a browser (0).\n- Task success: Pending. Task success needs the category task suites run through each tool, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until then. A data provider's data-quality score is published on its listing now and becomes half of this category when it's scored.\n- Maintenance \u0026 community 79: Production answered as version 26.9.2 and the sandbox spec as 26.10.0 on 8 October 2026. The JavaScript and Python SDKs were tagged 26.9.0 on 16 September (30). SDK tags 26.7.3 on 27 July, 26.8.3 on 24 August and 26.9.0 on 16 September (20). Closed service. A developer community forum exists, but the public patch notes stop in April 2023, and we did not read reply times on the 24 open issues in the JavaScript SDK repository (7). com.avalara/avatax is in the official MCP registry under Avalara's own namespace, and the six SDKs are current (15). The JavaScript SDK has build and publish workflows and the Python SDK a publish workflow. Test results were not checked (7).\n- Transparency \u0026 trust 79: Closed service with versioned terms that keep every past version online (Service Terms 7.1, effective 1 October 2026, and AvaTax supplemental terms). SDKs are Apache-2.0 (17). The DPA (version 1.10, 2 June 2025) limits use of customer data to running the service, support and legal compliance, with retrieval for 10 days after termination and destruction on request up to 60 days after. No fixed retention periods, backups are excepted, and Avalara may use de-identified aggregate data for any lawful purpose (20). A written policy deprecates version n-2 when n ships and decommissions it 18 months later, and the spec dates field deprecations. The policy's example table has dates out of order, and the terms let documentation alone count as notice (15). Subprocessor list version 11.0 of 9 September 2026 with date added, purpose and country, hosting on AWS in the United States (17).\n\nFix list for a coding agent, everything this grade says the listing lacks, the biggest gain first (17 items): https://www.anchorterminal.com/fixes/avalara.md (JSON https://www.anchorterminal.com/fixes/avalara.json)\n\n### What we couldn't check\n\n- unchecked: the MCP server's tool definitions, input schemas and readOnlyHint or destructiveHint annotations, which need an OAuth sign-in with an Avalara account\n- unchecked: production rate limits for transaction calls and whether 429 responses carry Retry-After. Neither was found in the public documentation\n- unchecked: the trust centre's documents (security policy, AI governance) and the platform behind the vulnerability disclosure programme, which load only with JavaScript or on request\n- unchecked: reply times on issues in the SDK repositories and whether SDK tests pass, since only the git history was read\n- Whether an uptime SLA exists in order documents. The Service Terms give none, and the product page's 99.99 per cent figure is a marketing claim\n- Whether the Claude Code tab on the MCP page gives a command. Only the Cursor configuration was readable without JavaScript\n- The cause of the 5 to 6 October 2026 AvaTax degradation. The status page gives none and marks it minor\n- The pricing page prices plans per state, so the unit prices are entered as monthly plans. No price per transaction was found\n\n### Sources\n\n- llms.txt and product index: \u003chttps://developer.avalara.com/llms.txt\u003e (seen 2026-10-08)\n- AvaTax MCP server page and tool list: \u003chttps://developer.avalara.com/products/avatax/mcp/\u003e (seen 2026-10-08)\n- MCP servers overview: \u003chttps://developer.avalara.com/mcp-servers/\u003e (seen 2026-10-08)\n- MCP servers repository (README only): \u003chttps://github.com/avadev/mcp\u003e (seen 2026-10-08)\n- official MCP registry entries: \u003chttps://registry.modelcontextprotocol.io/v0.1/servers?search=avalara\u003e (seen 2026-10-08)\n- MCP OAuth resource metadata: \u003chttps://mcp.avalara.com/.well-known/oauth-protected-resource/avatax\u003e (seen 2026-10-08)\n- identity server metadata: \u003chttps://identity.avalara.com/.well-known/openid-configuration\u003e (seen 2026-10-08)\n- AvaTax Swagger file: \u003chttps://sandbox-rest.avatax.com/swagger/v2/swagger.json\u003e (seen 2026-10-08)\n- production version (ping): \u003chttps://rest.avatax.com/api/v2/utilities/ping\u003e (seen 2026-10-08)\n- bundled AvaTax API reference in Markdown: \u003chttps://developer.avalara.com/products/avatax/api.md\u003e (seen 2026-10-08)\n- authentication in REST v2: \u003chttps://developer.avalara.com/avatax/authentication-in-rest/\u003e (seen 2026-10-08)\n- retry or fallback guide: \u003chttps://developer.avalara.com/sales-tax-integration-guide/djk3478758993515/\u003e (seen 2026-10-08)\n- rate limit error page: \u003chttps://developer.avalara.com/avatax/errors/RateLimitExceededError/\u003e (seen 2026-10-08)\n- API versioning and deprecation policy: \u003chttps://developer.avalara.com/api-versioning/\u003e (seen 2026-10-08)\n- API patch notes: \u003chttps://developer.avalara.com/patch-notes/\u003e (seen 2026-10-08)\n- free trial terms and limits: \u003chttps://developer.avalara.com/freeTrial/\u003e (seen 2026-10-08)\n- sales tax pricing: \u003chttps://www.avalara.com/us/en/products/sales-and-use-tax/pricing.html\u003e (seen 2026-10-08)\n- status incidents: \u003chttps://status.avalara.com/api/v2/incidents.json\u003e (seen 2026-10-08)\n- Service Terms and legal centre: \u003chttps://legal.avalara.com/\u003e (seen 2026-10-08)\n- AvaTax supplemental terms: \u003chttps://legal.avalara.com/product-terms.html#avatax\u003e (seen 2026-10-08)\n- DPA, privacy notices and subprocessors: \u003chttps://legal.avalara.com/dpa\u003e (seen 2026-10-08)\n- trust centre: \u003chttps://trust.avalara.com/\u003e (seen 2026-10-08)\n- responsible disclosure: \u003chttps://www.avalara.com/us/en/legal/responsible-disclosure.html\u003e (seen 2026-10-08)\n- JavaScript SDK tags and workflows: \u003chttps://github.com/avadev/AvaTax-REST-V2-JS-SDK\u003e (seen 2026-10-08)\n- Python SDK tags: \u003chttps://github.com/avadev/AvaTax-REST-V2-Python-SDK\u003e (seen 2026-10-08)\n- npm package: \u003chttps://registry.npmjs.org/avatax/latest\u003e (seen 2026-10-08)\n- PyPI package: \u003chttps://pypi.org/pypi/Avalara/json\u003e (seen 2026-10-08)\n\n## Who's behind it (provenance 88/100, checked 2026-10-08)\n\n| Check | Finding | Points |\n| --- | --- | --- |\n| Legal entity named | Avalara, Inc. | 20/20 |\n| Domain age | avalara.com, registered 2003-12-08 (22 years) | 15/15 |\n| Endpoint on the vendor's domain | rest.avatax.com | 15/15 |\n| Terms of service | read, states 7 of the 7 things a reader expects, and has 1 clause that costs points | 8/10 |\n| Privacy policy | read, states 8 of the 8 things a reader expects | 10/10 |\n| Status page | status.avalara.com | 10/10 |\n| Changelog | published | 10/10 |\n| security.txt | not found | 0/10 |\n\nThe Service Terms (version 7.1, effective 1 October 2026) name Avalara, Inc., a Washington corporation at 512 S. Mangum St. #100, Durham, NC 27701, as the contracting entity under New York law, and Avalara Europe Ltd. (England and Wales, No. 8446351) for European customers.\n\nThe MCP server answers at mcp.avalara.com. The REST API answers at rest.avatax.com and sandbox-rest.avatax.com. RDAP gives avatax.com a registration date of 2005-01-27, and Avalara's own documentation names those hosts.\n\nwww.avalara.com/.well-known/security.txt and developer.avalara.com/.well-known/security.txt return 404. Reports go through the vulnerability disclosure programme at https://www.avalara.com/us/en/legal/responsible-disclosure.html.\n\nThe patch notes page lists API releases up to 23.4.1 on 26 April 2023 and nothing later. Current releases are visible only as the version in /api/v2/utilities/ping and as SDK tags on GitHub.\n\nRDAP for avalara.com gives a registration date of 2003-12-08. Privacy notices, the DPA and the subprocessor list are published together at legal.avalara.com/dpa.\n\n### Terms and privacy, as read\n\nA reading by a fixed set of rules, each answered with the vendor's own sentence. Not legal advice.\n\n**Terms of service** (https://legal.avalara.com/), read 2026-10-08, dated 2023-05-01, states 7 of the 7 things a reader expects.\n\n- To know. Restricts benchmarking or competitive use (costs points). \"You shall not (i) distribute the Developer Tools to any third party, (ii) use the Developer Tools to build or provide a competitive product or service (including using the Developer Tools to gain insights into building or providing a competitive product or service), (iii) copy any features or functions of Avalara’s pr…\"\n- To know. Says access can be ended without notice or for any reason. \"However, if the Distributor from whom Customer purchased a Service fails to pay Avalara any amounts due in connection with Customer’s use of the Services, Avalara may suspend Customer’s Account, with or without notice to Customer.\"\n- To know. Has not been updated for three years or more. \"Last updated May 1, 2023.\"\n- Gives the date it was last updated. Last updated 2023-05-01.\n- Names the governing law or courts. The law of the State of New York.\n- States a limit on its liability. Capped at the fees paid in the 12 months before the claim.\n- Says how changes to the terms are announced. Gives 30 days of notice before a change.\n\n**Privacy policy** (https://legal.avalara.com/dpa), read 2026-10-08, dated 2022-08-08, states 8 of the 8 things a reader expects.\n\n- To know. Says it sells personal data or shares it for advertising. \"We may share a common account identifier (such as a hashed email address or user ID) with our third-party advertising partners to help link the personal data we and our third-party partners collect to the same person, or otherwise target advertising to an individual on a third-party website or platform.\"\n- To know. Has not been updated for three years or more. \"Last updated August 8, 2022\"\n- Gives the date it was last updated. Last updated 2022-08-08.\n- Says how long data is kept. For as long as needed, with no period named.\n- Says whether personal data is sold or shared for advertising. Says it does not sell personal data.\n- Gives a privacy contact. dataprivacy@avalara.com.\n- Says where data is transferred or stored. Relies on standard contractual clauses.\n\n## Live (updated 2026-10-08 19:08 UTC)\n\n- Right now: up, HTTP 401, 358 ms, checked 2026-10-08 19:08 UTC (get on `https://rest.avatax.com/api/v2`, asks for auth)\n- Uptime 24h 100.0% (42 probes) · 30 days 100.0% (42 probes) · p50 327 ms · p95 363 ms\n- Vendor status page: none, All Systems Operational\n- npm `avatax` 26.9.0\n- pypi `Avalara` 26.9.0, released 2026-09-16\n- security.txt: none\n- Watching changelog \u003chttps://developer.avalara.com/patch-notes/\u003e\n- Watching pricing \u003chttps://www.avalara.com/us/en/products/sales-and-use-tax/pricing.html\u003e\n- Watching privacy \u003chttps://legal.avalara.com/dpa\u003e\n- Watching terms \u003chttps://legal.avalara.com/\u003e\n- Always current: https://www.anchorterminal.com/api/v1/live/avalara.json\n\n## Probe metrics\n\nNot measured yet. Our benchmark probes haven't run, so there's no availability, latency or error rate from a run and Performance is pending. Live uptime, where we poll the endpoint, is under Live and doesn't change the score.\n\n## Prices\n\n| Item | Price | Unit | Note |\n| --- | --- | --- | --- |\n| Core Compliance (AvaTax and managed returns) | $79 | per month (plan) | per state, billed monthly; $799 per state billed yearly; annual revenue under $50M |\n| Core Compliance + SST Services | $69 | per month (plan) | per state, billed monthly; $699 per state billed yearly; qualifying sellers |\n| AvaTax free trial | free | per month (plan) | 90 days, 1,000 transactions a day, test data only |\n\nAcross all listings: https://www.anchorterminal.com/prices/index.md\n\n## Strengths\n\n- Public Swagger 2.0 file with 491 operations, plus llms.txt and a Markdown page with a curl example for each endpoint\n- Hosted MCP server at mcp.avalara.com/avatax with ten documented tools, OAuth sign-in and an entry in the official MCP registry as com.avalara/avatax\n- 90-day AvaTax trial with no card, limited to 5 orders and 5 invoices a minute and 1,000 transactions a day\n- Errors return a code, number, description and help link, from a published list of 429 codes\n- SDKs in six languages under Apache-2.0, released monthly, latest 26.9.0 on 16 September 2026\n\n## Weaknesses\n\n- Production rate limits are not published. The only numbers found are the trial limits and 5 calls a minute on report exports\n- No price per transaction. Public plans are $79 a state a month, or $69 with SST services, and larger accounts are quoted\n- The API patch notes page ends at version 23.4.1 of 26 April 2023, while production reports 26.9.2\n- Tax calculation was degraded from 22:32 PT on 5 October to 21:20 PT on 6 October 2026, per status.avalara.com\n- REST guides lead with HTTP Basic using a username and password or an account-wide licence key, and the MCP server has one scope, avalara_mcp\n\n## Before you call it (notes for agents)\n\n1. Omit `type` or send SalesOrder for an estimate. A type ending in Invoice is recorded, and `commit` set to true locks it for reporting\n2. Retry a timed-out invoice with CreateOrAdjustTransaction, not CreateTransaction, which errors when a committed transaction has the same code\n3. Use sandbox-rest.avatax.com with sandbox credentials for tests. Production is rest.avatax.com and the two accounts are separate\n4. Add `$include=SummaryOnly` or LinesOnly to shrink transaction responses, and page lists with `$top` (1,000 at most) and `$skip`\n5. Call /api/v2/utilities/ping first. It answers without credentials and shows whether the credentials sent were accepted\n\n## Connect\n\nInstall:\n\n```bash\nnpm install avatax\n```\n\nFirst request:\n\n```bash\ncurl -X POST \"https://sandbox-rest.avatax.com/api/v2/transactions/create\" \\\n -H \"Authorization: Basic \u003ccredentials\u003e\" \\\n -H \"Content-Type: application/json\" \\\n -H \"Accept: application/json\" \\\n -d @transaction.json\n```\n\nMCP client configuration:\n\n```json\n{\n \"mcpServers\": {\n \"avalara-avatax\": {\n \"type\": \"http\",\n \"url\": \"https://mcp.avalara.com/avatax\"\n }\n }\n}\n```\n\nThrough letme (picks today, calling later): https://letme.dev/avalara (letme picks it for tax.calculate, the top-graded tool for the job, letme picks it for tax.exemptions, the top-graded tool for the job, letme picks it for tax.filing, the top-graded tool for the job, letme picks it for tax.invoicing, the top-graded tool for the job, letme picks it for tax.transactions, the top-graded tool for the job). letme answers with the pick and how to call it direct; calling through letme (one key, the vendor's own price) comes later. How it works: https://www.anchorterminal.com/letme/index.md\n\n## Similar tools\n\nRanked by shared capabilities, then score. Same-category tools with no shared capability key are listed last.\n\n| Tool | Grade | Score | Rank | Shared capabilities | x402 | Markdown |\n| --- | --- | --- | --- | --- | --- | --- |\n| Anrok | C | 61.6 | 321 | tax.calculate, tax.transactions, tax.exemptions, tax.filing | no | https://www.anchorterminal.com/tools/anrok.md |\n| Vertex O Series | C | 54.7 | 464 | tax.calculate, tax.transactions, tax.exemptions, tax.invoicing | no | https://www.anchorterminal.com/tools/vertex-tax.md |\n| Quaderno | C | 59.5 | 377 | tax.calculate, tax.transactions, tax.invoicing | no | https://www.anchorterminal.com/tools/quaderno.md |\n| TaxJar | C | 57.6 | 417 | tax.calculate, tax.transactions, tax.exemptions | no | https://www.anchorterminal.com/tools/taxjar.md |\n\n## Panel reviews (0)\n\nReviewed by the Anchor panel (https://www.anchorterminal.com/reviewers/index.md): .\n\nDesk reviews, written from public documentation, pricing, terms, source and status history on 1 October 2026. No calls made. For a desk review, the outcome says whether the reviewer's questions could be answered from public material: success, partial or failure. How reviews work: https://www.anchorterminal.com/reviews/how-it-works.md\n\n## Notable\n\n- The AvaTax MCP server documents ten tools, among them calculate_tax, get_transactions, create_nexus, get_tax_code_recommendations and validate_address, with production and sandbox endpoints (source: \u003chttps://developer.avalara.com/products/avatax/mcp/\u003e)\n- The official MCP registry lists eight Avalara servers under com.avalara, with com.avalara/avatax at version 1.0.1 published on 19 June 2026 (source: \u003chttps://registry.modelcontextprotocol.io/v0.1/servers?search=avalara\u003e)\n- llms.txt links a Markdown page for every product and an index of more than 2,400 endpoint pages, 471 of them for AvaTax (source: \u003chttps://developer.avalara.com/llms.txt\u003e)\n- The Service Terms add a Customer Agents clause that makes the customer solely responsible for actions taken by an AI agent it connects. Version 7.1 is effective 1 October 2026 (source: \u003chttps://legal.avalara.com/\u003e)\n- The versioning policy deprecates major version n-2 when version n ships and decommissions it 18 months later, after which calls return 400 with a version-too-old message (source: \u003chttps://developer.avalara.com/api-versioning/\u003e)\n- status.avalara.com shows an AvaTax degradation on the Tax Calculation Service from 22:32 PT on 5 October to 21:20 PT on 6 October 2026, marked minor (source: \u003chttps://status.avalara.com/history\u003e)\n- The trust centre lists SOC 1 Type 2, SOC 2 Type 2 and ISO 27001 for AvaTax, and Avalara runs a vulnerability disclosure programme (source: \u003chttps://trust.avalara.com/, https://www.avalara.com/us/en/legal/responsible-disclosure.html\u003e)\n\n## Compare\n\n- [Anrok vs Avalara AvaTax](https://www.anchorterminal.com/compare/anrok-vs-avalara.md): C 61.6 vs B 68.8\n- [Avalara AvaTax vs Quaderno](https://www.anchorterminal.com/compare/avalara-vs-quaderno.md): B 68.8 vs C 59.5\n- [Avalara AvaTax vs TaxJar](https://www.anchorterminal.com/compare/avalara-vs-taxjar.md): B 68.8 vs C 57.6\n- [Avalara AvaTax vs Vertex O Series](https://www.anchorterminal.com/compare/avalara-vs-vertex-tax.md): B 68.8 vs C 54.7\n\n## Verify this listing\n\nFor the vendor. The badge or a plain link to this page verifies the listing, from a page on avalara.com or one of its subdomains, or the README of github.com/avadev/mcp. It shows the listing is the vendor's and that the vendor knows it's here, and it never changes a grade, rank or review. The vendor sends the page's address to `POST https://www.anchorterminal.com/api/v1/verify` as `{\"slug\": \"avalara\", \"url\": \"…\"}`, or calls the `verify_listing` tool at https://www.anchorterminal.com/mcp. We fetch the page once, then again every week; two failed checks in a row and the verification lapses, and a later pass restores it. What we check: https://www.anchorterminal.com/builders/index.md#verify\n\nHTML badge:\n\n```html\n\u003ca href=\"https://www.anchorterminal.com/tools/avalara\"\u003e\u003cimg src=\"https://www.anchorterminal.com/badges/avalara.svg\" alt=\"Avalara AvaTax on Anchor Terminal\" height=\"20\"\u003e\u003c/a\u003e\n```\n\nMarkdown badge, for a README:\n\n```markdown\n[![Avalara AvaTax on Anchor Terminal](https://www.anchorterminal.com/badges/avalara.svg)](https://www.anchorterminal.com/tools/avalara)\n```\n\nPlain link:\n\n```html\n\u003ca href=\"https://www.anchorterminal.com/tools/avalara\"\u003eAvalara AvaTax on Anchor Terminal\u003c/a\u003e\n```\n\n## Share this listing\n\nFor the vendor. Sharing assets for social media, two PNGs of 1200 × 630 that say Avalara AvaTax is listed on Anchor Terminal, with the vendor's logo and this page's address and no grade or score.\n\n- Dark: https://www.anchorterminal.com/assets/share/avalara-dark.png\n- Light: https://www.anchorterminal.com/assets/share/avalara-light.png\n", "meta": { "attribution": "Anchor Terminal (https://www.anchorterminal.com)", "docs": "https://www.anchorterminal.com/docs/", "generatedAt": "2026-10-08", "license": "CC-BY-4.0", "method": "https://www.anchorterminal.com/benchmark/", "methodology": "0.4", "openapi": "https://www.anchorterminal.com/openapi.json", "preview": false, "run": "2026-10-01", "runLabel": "October 2026 research run" }, "page": { "breadcrumbs": [ { "name": "Home", "url": "https://www.anchorterminal.com/" }, { "name": "Terminal", "url": "https://www.anchorterminal.com/tools/" }, { "name": "Tax calculation \u0026 compliance", "url": "https://www.anchorterminal.com/categories/tax" }, { "name": "Avalara AvaTax", "url": "" } ], "description": "Avalara AvaTax calculates sales tax, VAT and GST for a transaction and records it for reporting. Agents reach it through the AvaTax REST v2 API or a hosted MCP server, with separate Avalara products for returns, exemption certificates and e-invoicing.", "facts": [ "rank #162 of 629", "OAuth or key auth", "0 desk reviews" ], "h1": "Avalara AvaTax", "image": "https://www.anchorterminal.com/assets/og/tools-avalara.png", "path": "/tools/avalara", "published": "2026-10-01", "section": "tools", "title": "Avalara AvaTax review for AI agents, grade B (68.8/100)", "toc": null, "updated": "2026-10-08", "url": "https://www.anchorterminal.com/tools/avalara" }, "tokens": { "markdown": 7850, "slim": 1980 }, "version": 1 }