Home / MCP registry index / kr.xdata/xdata-mcp
XBOSS
kr.xdata/xdata-mcp in the official MCP registry.
Endpoint https://api.xdata.kr/mcp.
The registry describes it as: Korean national tax and social insurance filings, invoices and payroll data as MCP tools.
We read its 200 tools on 2026-10-26. Nothing in them matched our tool-poisoning rules. It also sets server instructions, text a client puts in front of the model on connect; those were read too.
A clean read means these rules found nothing, not that the server is harmless. A server can change its tools at any time, which is why the index reads it again every week.
Tools it advertises
hometax__session__login hometax__session__user_info hometax__certificate__list hometax__certificate__apply__national_tax_payment hometax__certificate__apply__tax_payment_record hometax__certificate__apply__vat_standard hometax__certificate__apply__business_registration hometax__certificate__apply__financial_statement hometax__certificate__apply__business_registration_reissue hometax__etax__invoice__search_summary hometax__etax__invoice__search_list hometax__etax__invoice__search_statistics hometax__etax__invoice__search_detail hometax__etax__invoice__issue hometax__etax__invoice__modify hometax__tax__business_registration__search_status hometax__tax__business_registration__search_info hometax__tax__my_tax_agent__search hometax__tax__return_history__search_vat hometax__tax__payment_due__search_or_pay hometax__tax__electronic_notice__check_status hometax__tax__refund__search_detail hometax__tax__unclaimed_refund__search hometax__tax__notice__search_history hometax__tax__overdue__search_history hometax__tax__payment_statement__search hometax__tax__payment_statement__search_submit_history hometax__tax__trade_partner__search_list hometax__tax__credit_card__search_sales_data hometax__cash_receipt__sales__search_history hometax__cash_receipt__sales__search_summary hometax__cash_receipt__purchase__search_history hometax__cash_receipt__issue_individual hometax__cash_receipt__daily_issue__search hometax__cash_receipt__daily_issue__modify hometax__cash_receipt__daily_issue__cancel hometax__certificate__apply_with_template hometax__certificate__list_templates hometax__certificate__apply_auto hometax__certificate__download hometax__certificate__apply_auto_download hometax__etax__business_info__get hometax__etax__client_info__get nhis_edi__session__login nhis_edi__session__status nhis_edi__hr_payroll__received_documents__options nhis_edi__document_box__sent_documents__list nhis_edi__document_box__sent_documents__detail nhis_edi__file_report__init nhis_edi__certificates__payment_completion__init nhis_edi__certificates__payment_completion__issue nhis_edi__certificates__workplace_application_notice__apply__init nhis_edi__certificates__workplace_member_list__apply__init nhis_edi__certificates__health_premium_payment__individual__init nhis_edi__certificates__workplace_application_notice__issued__init nhis_edi__certificates__workplace_member_list__issued__init nhis_edi__qualification__acquisition__init nhis_edi__qualification__loss__init nhis_edi__qualification__change__init nhis_edi__qualification__dependent__init and 140 more
Run this server? Show the check in your README
The badge reflects the latest weekly read: 
[](https://lazaretto.dev/mcp-registry/kr-xdata-xdata-mcp)How this was checked
Lazaretto connects to the endpoint the way any MCP client does, asks the server to introduce itself and list its tools, and reads every name, description, parameter schema and server instruction for tool poisoning: hidden directive blocks, orders to read local secrets, parameters built to carry secrets or the conversation out, orders that redirect another server's tools, and invisible characters. It never calls a tool. What we found across the registry.
To run the same check every time Claude Code adds a server, install the free lazaretto-guard plugin. Browse every server in the index.