Avalara MCP Server: Tools, Setup and Security

Avalara's MCP servers let an AI app work with Avalara's tax compliance systems: calculate sales tax, look up transactions and nexus, validate addresses, and manage tax returns and filing calendars. Avalara publishes and hosts a family of servers, one per product, each with production and sandbox environments.

Checked against: Avalara's MCP servers overview on 28 October 2026. eSEOspace did not install or test this server.

At a glance

What it can do

Avalara's overview says the servers let you query real-time tax rates and calculations, follow regulatory updates, manage exemption certificates, business licenses and returns, and retrieve documentation.

The AvaTax MCP server page lists 10 tools:

• calculate_tax: creates a tax transaction and calculates tax from addresses, line items and transaction details.
• get_transaction and get_transactions: retrieve one transaction or a filtered list.
• get_nexus_definitions and get_nexus: show nexus rules and your company's nexus and registrations.
• create_nexus: creates nexus records in a jurisdiction.
• get_companies: retrieves company information.
• get_tax_code_definitions and get_tax_code_recommendations, which suggests 1 to 3 ranked tax codes from a product description.
• validate_address: resolves an address for accurate jurisdiction lookup.

The Returns MCP server page lists tools for filing calendars, liability reports, filings and funding power of attorney. Examples include get_filing_calendars_returns, get_filings_returns, approve_filings_returns and create_filing_cal_req_returns. It also covers MyLodgeTax lodging tools, such as create_revenue_transactions_mylodge and delete_location_mylodge.

How to connect it

Avalara's overview gives two steps. First, set up your MCP client using the steps on the individual server page. Then authorize: your client sends you to Avalara's sign-in page, you review the requested permissions and grant consent.

The AvaTax page gives this manual config for Cursor:

{
  "mcpServers": {
    "avalara-avatax": {
      "type": "http",
      "url": "https://mcp.avalara.com/avatax"
    }
  }
}

The server pages also have tabs for VS Code and Claude Code, and for sandbox and production environments.

Returns is different. Avalara says the Returns server "does not use OAuth2 flow and requires a valid JWT Token," generated from your license key. You must also pick one business domain, such as us-returns or vat-returns, on every request:

{
  "mcpServers": {
    "avalara-returns": {
      "type": "http",
      "url": "https://mcp.avalara.com/returns",
      "headers": {
        "Authorization": "Bearer jwt_token_here",
        "X-Returns-Tools": "us-returns"
      }
    }
  }
}

Avalara warns that leaving out the domain "blocks all tool calls."

Security notes

Avalara's developer primer gives this advice:

• Least privilege. Grant "only the OAuth scopes the agent actually needs," and audit consents periodically.
• Safe writes. Handle writes idempotently, such as filing returns or committing transactions, so a retry doesn't file twice.
• Logging. Log every tool call, its inputs and its response status.
• Rate limits. On HTTP 429, wait before retrying, and use exponential backoff with jitter in production.

A few more points from the server pages:

• Real writes. calculate_tax creates a tax transaction, create_nexus changes your registrations and approve_filings_returns signals returns are ready for submission to the tax authority. Require approval for each.
• Token storage. The Returns JWT sits in a config header. Protect it like a password.
• Test first. Every server has a sandbox environment. Use it before pointing an agent at production.

See our guides to excessive permissions and secret leakage, and the MCP security center.

Alternatives

• Stripe, for payments and billing data.
• NetSuite, for ERP records where tax data ends up.
• Chargebee, for subscription billing data.

Browse the MCP server directory.

Next step

Building tax-aware workflows for clients? See how we approach MCP development.

Frequently asked questions