Skip to content
Nexus Auditor
English
Get started

Menu

English
Get started

Frequently asked questions

9 questions

Do you connect to QuickBooks?

No. There is nothing to authorize in your client's QuickBooks. You export three standard QuickBooks Online reports (Sales by Product/Service Detail, Transaction List by Customer with shipping and billing addresses, and the customer contact list) or fill in our one-file template, and upload them.

Why does the address matter so much?

A sale generally belongs to the state where the customer receives it, usually the ship-to address; the billing address is only a fallback when no delivery address is known. QuickBooks Online reports can show a customer's default address, or a blank, instead of the ship-to typed on the invoice, so Nexus Auditor records where each sale's address came from and flags results where more than 10% of sales rest on default addresses. Addresses that cannot be placed in a state are listed so you can fix them.

Which taxes and places does it cover?

State sales and use tax: economic nexus for every state with a sales tax plus DC, physical nexus in the client's home state (recording other offices, employees and inventory is coming), and the Alaska Remote Seller Sales Tax Commission threshold for the local taxes of its member cities and boroughs. New Mexico's gross receipts tax and Hawaii's general excise tax are treated as those states' sales taxes. States where localities administer their own sales tax, such as Colorado's self-collecting home-rule cities, are marked but not evaluated. Five separate business taxes (Washington B&O, Ohio CAT, Texas franchise, Delaware and Oregon gross receipts) are listed as not evaluated, and income taxes are not covered.

How current is the law?

Each state's economic nexus rule shows its source and the date it was last checked; all were rechecked in September 2026. Changes are added as new versions with effective dates: sales are counted under the rules in force on their dates, the threshold in force on the measurement date decides, and a threshold met only under an earlier version is marked for review. Rules where sources disagree or are silent carry a lower confidence rating, which lowers the finding's confidence.

What does a finding show?

The status for the state; each test the state applies (sales, and transactions where it still counts them) against its threshold with the rule's comparator; every measurement window; what counted, including the state's sales basis, marketplace and resale treatment, and exempt or resale claims without a valid certificate; the rule versions applied with their sources; and the reasons behind the confidence level.

Is this a filed return or a legal opinion?

No. Nexus Auditor is decision support for your professional judgment. It does not register, file or remit anything, and its results are not legal advice.

Who can see a client's data?

Each firm has its own workspace, and firms are isolated from each other in the database. Everyone in a firm, including guests, can see its clients; roles decide who can change data, and only owners and admins can undo an import.

What files can we upload?

CSV, XLSX or XLS files up to 25 MB and 250,000 rows each. Files are stored when you upload them, but no sales are recorded until you review the check and confirm, and an owner or admin can undo a confirmed import.

What does it cost?

Early access is by invitation while we work with a small group of firms. Pricing will be published before general availability.

Open full FAQ page
Documentation
Browse documentation

Modules / AI and operations

MCP server

Expose workspace tools to MCP clients over Streamable HTTP.

Setup and configuration

POST /api/mcp is a stateless Streamable HTTP MCP endpoint built on @modelcontextprotocol/sdk. Authentication is API keys only — the same sk_ keys and scopes as the public /api/v1 REST API. Cookie sessions never apply; missing or invalid keys get a 401 with a Bearer challenge, and GET/DELETE return 405.

The endpoint registers only the tools the key's scopes allow from the shared workspace-tool registry (get_workspace, list_entitlements, create_ai_task, get_ai_task, get_ai_task_result). Every call reuses the /api/v1 BFF with the caller's headers, so REST authorization, workspace checks, and scope enforcement are identical — the MCP surface never widens access.

{
  "mcpServers": {
    "supastack": {
      "url": "https://<app>/api/mcp",
      "headers": {
        "Authorization": "Bearer sk_..."
      }
    }
  }
}

Implementation workflow

Issue a scoped key from Settings → Developers (or the API-keys flow) and hand the client the Authorization header shown above. A read-only key sees only read tools; write tools such as create_ai_task appear only for keys with the write scope.

The endpoint shares the /api/v1 rate limiter. Tool results are JSON text content; workspace errors surface as isError results with the REST error message — no stack traces or secrets cross the boundary.

Verification and troubleshooting

Drive initialize → tools/list → tools/call against the handler in tests with a fake registry before touching production keys. Verify a read-scoped key cannot see write tools and that requests without Authorization are rejected even when a session cookie is present.