# VIESAC MCP server: connect an AI assistant or agent

VIESAC provides a live remote MCP server for VAT/GST and EORI validation, compliance audit creation and evidence retrieval. VAT rates are an additional tool. Direct MCP setup does not require approval of an app directory listing.

## Endpoint and requirements

- Production endpoint: `https://mcp.viesac.eu`
- Transport: MCP Streamable HTTP.
- Authentication: OAuth authorization code with PKCE S256 and dynamic client registration.
- Protected resource metadata: `https://mcp.viesac.eu/.well-known/oauth-protected-resource`
- Authorization server metadata: `https://viesac.eu/.well-known/oauth-authorization-server`
- A VIESAC account and a compatible remote MCP client are required. The client connects, not the model alone.

## Connect now

1. Add a remote HTTP MCP server called VIESAC in your assistant or agent runtime.
2. Enter the production endpoint above. Select OAuth and let the client discover authorization metadata. Public dynamic-registration clients do not need a manually entered client secret.
3. Start Connect/Authenticate. Sign in on viesac.eu, select your organization and review the requested scopes.
4. Return to your client and discover the tools using its MCP tool list.
5. Ask: "Validate VAT DE129274202 without creating an audit. Show the result source and registry check time."

### Cursor configuration

```json
{"mcpServers":{"VIESAC":{"url":"https://mcp.viesac.eu"}}}
```

### Gemini CLI

```sh
gemini mcp add --transport http --scope user VIESAC https://mcp.viesac.eu
```

Inside Gemini CLI:

```text
/mcp auth VIESAC
/mcp list
```

For JSON settings Gemini CLI uses `httpUrl` for Streamable HTTP, whereas Cursor uses `url`. Authenticate the Google model separately. End-to-end Gemini CLI model verification remains pending supported Google access; this does not affect server availability.

### ChatGPT and other assistants

If the workspace supports custom remote MCP connections, enter the endpoint in its custom app/developer settings and select OAuth. Feature availability depends on the host plan and workspace administrator. This does not enable a connector in a consumer app that lacks custom MCP support.

### Custom agents

Use your MCP SDK's Streamable HTTP client and OAuth provider. On HTTP 401, discover protected-resource and authorization-server metadata, complete PKCE authorization in the browser, and reconnect using the access token. Refresh expired access using the rotating refresh token. Do not hardcode tokens in source files or put credentials in URL query parameters. Never ask the user to paste secrets into the model conversation.

## Validation, then audits, then rates

Quick validation returns identifier status, source and check time; it does not create audit evidence or return company details. Cached results retain their original check time. A registry outage does not mean an identifier is invalid.

Audit history and counterparty search are scoped to the connected organization. Create audits only on explicit user request. A VAT or EORI audit consumes 1 existing audit credit; a combined VAT/EORI audit consumes 2. Optional monitoring creates additional scheduled audits. Plans, validation limits and certificate availability apply. Purchase credits only on viesac.eu.

VAT rates can also be requested as an additional capability.

## Permissions and revocation

`viesac:read` covers validation, rates, quota and organization audit history. `viesac:audit` additionally permits audit creation. Sign-in selects the organization. Revoke the connection in the VIESAC API keys page. Do not grant audit permission if read-only access is sufficient.

Machine-readable configuration: https://viesac.eu/docs/mcp/connection.json
Human guide: https://viesac.eu/extensions/mcp

## Existing connections

The previous https://mcp.viesac.eu/mcp endpoint remains supported. Existing connections do not need to be changed. New connections should use https://mcp.viesac.eu.