# CukaiMax MCP servers CukaiMax runs two MCP servers. They answer different questions and must not be confused: | Server | Endpoint | Who it is for | Auth | Data | |--------|----------|---------------|------|------| | Tax Authority MCP | `https://www.cukaimax.com/.well-known/mcp` | Any agent researching Malaysian individual tax rules | None, anonymous | Public: source-verified Form BE and Form B releases. Never taxpayer data | | CukaiMax account MCP | `https://app.cukaimax.com/api/mcp` | A CukaiMax user's own assistant (ChatGPT, Claude, Grok) | OAuth 2.1, the user signs in and approves | Private: that user's own tax position, reliefs, receipts and next actions; on the Personal plan it can also record entries for the user to review. Also offers the Tax Authority tools above, so one connection does both | Use the Tax Authority MCP for "what does the rule say". Use the account MCP for "what is my position"; it also registers the same five Tax Authority tools, so an assistant connected to a user's account needs no second connector for the rules. The account MCP is described in [Your account: CukaiMax MCP](#your-account-cukaimax-mcp) at the end of this page. ## Tax Authority MCP (public tax rules) Endpoint: `https://www.cukaimax.com/.well-known/mcp` Human-readable overview: `https://www.cukaimax.com/tax-authority` AI for Malaysian Tax guide: `https://www.cukaimax.com/en/malaysia-tax-ai` Live playground: `https://www.cukaimax.com/tax-authority/playground` Installable agent skill: `https://www.cukaimax.com/skills/cukaimax-tax-authority/SKILL.md` Codex, Claude Code, and generic client setup: `https://www.cukaimax.com/integrations.md` Universal distribution package: `https://github.com/jakzaizzat/cukaimax-agent` Portable Agent Plugin manifest: `https://raw.githubusercontent.com/jakzaizzat/cukaimax-agent/main/plugin.json` Portable Agent Plugin MCP config: `https://raw.githubusercontent.com/jakzaizzat/cukaimax-agent/main/mcp.json` Official MCP Registry name: `io.github.jakzaizzat/cukaimax-tax-authority` Smithery marketplace: `https://smithery.ai/servers/jakzaizzat/cukaimax-tax-authority` Glama marketplace: `https://glama.ai/mcp/connectors/io.github.jakzaizzat/cukaimax-tax-authority` Agent Skills listing: `https://skills.sh/jakzaizzat/cukaimax-agent/cukaimax-tax-authority` Public MCP privacy: `https://www.cukaimax.com/mcp-privacy.md` Support: `https://www.cukaimax.com/mcp-support.md` Transport: MCP Streamable HTTP. No API key is required. Send `POST` requests with `Accept: application/json, text/event-stream`. The endpoint supports MCP `2025-11-25` and the legacy `2025-03-26` stateless protocol. ### Safety and scope The registry contains a CukaiMax source-verified YA2025 Form BE preparation release, a source-verified YA2025 Form B authority/readiness release, and a source-verified YA2026 planning release. Form B readiness never reports filing readiness, and YA2026 has no filing fields until HASiL publishes its official return forms and explanatory notes. Source verification is not official HASiL approval, and outputs are never a filing or submission to MyTax. Every successful or failed authority tool call returns a privacy-safe `audit` event in `structuredContent`. It records the operation, immutable release, matched rule IDs, versioned source references, and canonical SHA-256 fingerprints. It never stores the raw prompt, taxpayer payload, direct identifiers, receipts, or financial amounts. ### Tools - `list_tax_authority_releases`: Discover supported years, forms, versions, capabilities, statuses, and limitations. - `get_tax_authority_release`: Return the complete release, pinned official sources, validation result, review state, and known limitations. - `search_tax_authority`: Search cited Form BE or Form B rules by topic, field, rule ID, or TaxBrain category. - `prepare_be_2025_draft`: Deterministically compile supplied income and relief evaluation data into cited Form BE fields. It does not store taxpayer data. - `assess_form_b_2025_readiness`: Check finalised accounts, HK worksheets, conditional schedules, relief evidence, and payment records before manual Form B preparation. It never reports filing readiness. ### Resources - `tax://my/individual/be/2025/release` - `tax://my/individual/be/2025/sources` - `tax://my/individual/be/2025/review-status` - `tax://my/individual/b/2025/release` - `tax://my/individual/b/2025/sources` - `tax://my/individual/b/2025/review-status` - `tax://my/individual/be/2026/preview` - `tax://my/evaluations/agent/v1/scenarios` The evaluation resource contains 36 fictional golden scenarios, an 85-point pass threshold, and the expected release, operation, authority-evidence, conclusion, and safety contract for each scenario. ### Audit chaining Pass an optional audit context to create a chain across calls: ```json { "audit": { "runId": "your-run-id", "sequence": 2, "previousEventId": "taxevt_from_the_previous_result" } } ``` Persist the returned event if you need a durable audit log. The public MCP itself remains stateless. ### Example: initialize ```bash curl https://www.cukaimax.com/.well-known/mcp \ -H 'Accept: application/json, text/event-stream' \ -H 'Content-Type: application/json' \ -H 'MCP-Protocol-Version: 2025-11-25' \ --data '{"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2025-11-25","capabilities":{},"clientInfo":{"name":"example-agent","version":"1.0.0"}}}' ``` ### Example: search a rule ```bash curl https://www.cukaimax.com/.well-known/mcp \ -H 'Accept: application/json, text/event-stream' \ -H 'Content-Type: application/json' \ -H 'MCP-Protocol-Version: 2025-11-25' \ --data '{"jsonrpc":"2.0","id":2,"method":"tools/call","params":{"name":"search_tax_authority","arguments":{"query":"dental","taxYear":2025,"formType":"BE","audit":{"runId":"example-run","sequence":1}}}}' ``` ### Error behavior - Invalid tool arguments return a tool result with `isError: true` and validation details. - Unknown releases are returned as tool errors rather than guessed tax rules. - Unapproved browser origins and hostnames receive HTTP `403`. - Draft generation returns explicit blockers and warnings instead of silently assuming missing taxpayer facts. - Form B readiness returns missing evidence and worksheet blockers while keeping `filingReady: false`. - Requests are limited to 120 per minute per client and return standard `RateLimit-*` headers. Exceeding the limit returns HTTP `429`. ## Your account: CukaiMax MCP Endpoint: `https://app.cukaimax.com/api/mcp` Human-readable setup: `https://app.cukaimax.com/settings/connected-apps` (CukaiMax Settings, Connected apps) This is a separate server from the Tax Authority MCP above. It lets an assistant read the signed-in user's own CukaiMax data: their tax position for a year of assessment, the reliefs they have used or still have room in, the receipts and transactions behind those reliefs, and what they still need to do before filing. Every answer is the same number the CukaiMax app shows that user. It needs a CukaiMax account. Reads are available on every plan. Making changes (recording a transaction, answering a relief question, setting a Tax Profile flag, recording a statement, uploading a file) needs the Personal plan; on Free those tools return an upgrade message instead. ### Authentication OAuth 2.1 through Supabase Auth, with dynamic client registration and PKCE. There is no API key. 1. The assistant fetches `https://app.cukaimax.com/.well-known/oauth-protected-resource/api/mcp` and discovers the authorization server. 2. It registers itself and sends the user to sign in to CukaiMax. 3. The user sees a consent page at `https://app.cukaimax.com/oauth/consent` naming the assistant and what it may read and record, and approves or denies. 4. Every tool call carries the user's access token as a Bearer token. Row-level security applies, so the assistant only reaches that one user's rows. The user can revoke a connection at any time from Settings, Connected apps in the CukaiMax app. ### Connect from an assistant - ChatGPT: enable Developer Mode, add a custom connector (MCP server) with the URL above and OAuth authentication. ChatGPT sends you to CukaiMax to sign in and approve. - Claude: add a custom connector with the URL above. Claude sends you to CukaiMax to sign in and approve. - Grok: add a custom connector with the URL above. Grok sends you to CukaiMax to sign in and approve. - Other MCP clients: Streamable HTTP with OAuth 2.1 resource discovery (RFC 9728). An unauthenticated request returns HTTP `401` with a `WWW-Authenticate` header pointing at the resource metadata. ### Tools Each takes an optional `year` (year of assessment, defaulting to the current one) and returns `structuredContent` with a one-sentence `summary`. Reads, on every plan: - `get_tax_position`: How much tax the user owes or is refunded for the year, and how much relief room is left. - `list_reliefs`: Which reliefs have room, need an answer from the user, or are missing proof. - `get_relief_detail`: Why one relief is the amount it is, with the contributing receipts. - `list_transactions`: The user's receipts and transactions, filtered by category, merchant, date, status or claim state, paginated (at most 50 a page). - `get_next_actions`: What the user still has to do before filing. Writes, on the Personal plan. Each is annotated as a write that deletes nothing, and everything it records is marked for the user to review in the app: - `add_manual_transaction`: Record an expense the user paid but has no receipt file for (date, merchant, amount, optional relief category and note). Saved as a manual entry pending review. - `recategorize_transaction`: Run relief categorization again for one transaction, with the user's answers to its open questions. - `answer_relief_question`: Answer a Tax Relief quick question (yes, no, or later). - `set_relief_profile_flag`: Set one of the Tax Profile yes/no answers a relief hinges on (life insurance, medical insurance, PRS, SSPN, childcare and the like), with the yearly amount where the profile keeps one. - `record_statement`: Type in a statement the user has the figures for (insurance, PRS, SSPN, zakat, donation): it is filed under Documents as needing a check, and its lines count as pending until the user confirms them. - `upload_document`: Send a receipt or statement as a base64 PDF, JPEG or PNG for CukaiMax to read, the same as dropping it on the Upload page. The same file sent again within a day returns the first upload. The account MCP also offers the five Tax Authority tools documented above, with the same names, inputs and results: `list_tax_authority_releases`, `get_tax_authority_release`, `search_tax_authority`, `prepare_be_2025_draft` and `assess_form_b_2025_readiness`, plus the `tax://` resources. They read no account data, are available on every plan, and count against the same per-user limit. Use the account tools for the user's own figures and the Tax Authority tools for the rule, cap or official source behind them. ### What assistants cannot do Assistants cannot delete anything, mark a receipt or claim as verified, change the plan or billing, export a filing pack, or submit anything to MyTax. Every entry an assistant records stays pending until the user reviews it in the CukaiMax app, and the user can disconnect the assistant at any time from Settings, Connected apps. ### Limits and errors - Per-user rate limit: 120 calls a minute and 2,000 calls a day, across every connected assistant. Exceeding it returns a tool error. - A missing or expired token returns HTTP `401`. - Invalid tool arguments return a tool result with `isError: true` and validation details. Privacy for both servers: `https://www.cukaimax.com/mcp-privacy.md`. Support: `https://www.cukaimax.com/mcp-support.md`.