HMRC Fraud Prevention Header Lint for Making Tax Digital (VAT and Income Tax)

HMRC’s Fraud Prevention Directions specify the Gov-Client and Gov-Vendor headers used for Making Tax Digital. This lint checks those headers in your files for mistakes HMRC rejects, including misspelled names such as Gov-Vendor-License-IDs. It runs in your editor offline. The full version can scan a workspace, export CSV, JSON or HTML, produce machine-readable output for CI, and correct header names with one correct spelling.

Finds the Gov-Client and Gov-Vendor header mistakes HMRC rejects, in your editor, offline, before you send the request.

Install free

Free for the file open in your editor - no key, no limit. The workspace sweep and the report ask for a key.

VS Code MarketplacenpmMCP server (npx)Docker Hub
ext install ReadyStack.hmrc-fraud-prevention-header-lint
npx @readystack/hmrc-fraud-prevention-header-lint <file>
npx @readystack/hmrc-fraud-prevention-header-lint --mcp

Team? One key for every ReadyStack linter, 5 seats, $149 once

Get the full rule table as a PDF
All 34 rules HMRC Fraud Prevention Header Lint for Making Tax Digital (VAT and Income Tax) checks, each with its source and date, on printable pages you can hand to your team or auditor. We email it now, and once more only if a rule changes. No newsletter.

Get the full version $29

Scans every file in the workspace, exports a CSV, JSON or HTML report, prints machine-readable output so CI can fail the build, and auto-corrects the header names that have exactly one correct spelling.

One payment, one licence key for this tool. The key is shown right after payment.

HMRC charges a 200 pound penalty once a filer crosses the points threshold for late MTD quarterly updates, and HMRC's own header validator only grades a live request you have already sent.

Buy the full version — $29

Need more than this one? ReadyStack Pass opens all 593 files and 513 full versions — $29/month or $199/year. See the Pass →

ENDEJAESPT

Find a tool

· ReadyStack

Worked example

Real numbers from this tool, line by line.

Five HMRC fraud prevention headers that look right and are rejected

Five header spellings HMRC rejects look completely correct to a UK developer building Making Tax Digital software. They pass code review, they pass your tests, and they pass every linter you already run - because none of those things has ever read HMRC's Fraud Prevention Directions.

Here is the one that catches almost everyone. HMRC's header is Gov-Vendor-License-IDs. American spelling. A UK developer writes Licence without a second thought, and nothing in the toolchain objects.

There are four more of the same shape:

Why your assistant gets this wrong

The Directions have been revised repeatedly - version 3.0 in January 2021, 3.1 in January 2022, 3.2 in August 2023, 3.3 in January 2025. Each revision moved headers between required and optional. Gov-Client-Browser-Plugins and Gov-Client-Browser-Do-Not-Track no longer need values for a web application via server, but a large amount of the tutorial material on the open web still lists them as mandatory, and that is the material language models were trained on.

That is the trap. The wrong answer is confidently written, well formatted, and four years out of date.

Why HMRC's own validator does not save you

HMRC publishes a Test Fraud Prevention Headers API, and it is good. But it grades a live request that you have already built and sent, using sandbox credentials. It cannot read your source. It tells you nothing on the afternoon you are writing the integration, and nothing at all about the code paths your tests do not exercise.

What this extension does

It reads the file you have open and applies 34 rules drawn directly from HMRC's connection-method tables - the header names, the value syntax, the percent-encoding rules, and the connection methods that actually exist. WEB_APP_DIRECT is not one of them; a browser-based application is always WEB_APP_VIA_SERVER.

It runs offline. Your code is not uploaded anywhere, which matters when the file in front of you sets headers on a request carrying a client's tax data.

Checking the open file is free and complete: every finding, every correct spelling. A licence adds the whole-workspace scan - header code is almost always spread across the HTTP client, the middleware and the tests - plus an exportable CSV, JSON or HTML report, machine-readable output so CI can fail the build, and auto-correction of the names that have exactly one right spelling.

The first mandated Making Tax Digital for Income Tax year is running now, and the next quarterly update deadline is 7 November 2026.

Questions people ask

What does this actually check?

It reads the code where you set HMRC's Gov-Client and Gov-Vendor fraud prevention headers and reports 34 specific problems: header names spelled a way HMRC does not accept, timezone values that are not UTC+HH:MM, timestamps missing their milliseconds, values that should be percent-encoded, and connection methods that do not exist in HMRC's specification.

Who is this for?

UK developers and software vendors building or maintaining Making Tax Digital software that calls HMRC's VAT (MTD) or Income Tax Self Assessment (MTD) APIs. If your team sends Gov-Client headers on any HMRC request, including a white-labelled product or an application built purely for internal use, this was written for you.

Why not just use HMRC's own header validator?

HMRC's Test Fraud Prevention Headers API grades a live request you have already built and sent, and calling it needs sandbox credentials. It cannot read your source, so it finds nothing until the integration exists and is running. This checks code in your editor, offline, before anything has been sent to HMRC.

What is free and what needs a licence?

Checking the file you have open, or only the lines you select, against all 34 rules is free and complete: you get every finding and the correct spelling for each one. A licence adds scanning every file in the workspace, exporting a CSV, JSON or HTML report, machine-readable output for CI, and auto-correcting the misspelled header names.

What would it cost to check this by hand?

By hand it means reading HMRC's connection-method tables for every header on every request, then rechecking them each time the Fraud Prevention Directions are revised, most recently version 3.3 on 27 January 2025. HMRC charges a 200 pound penalty once a filer crosses the points threshold for late quarterly updates.

Why not just ask ChatGPT or another AI chat?

A general AI chat answers from training data with a cutoff date, cannot read your repository and names no rule version. HMRC Fraud Prevention Header Lint for Making Tax Digital (VA checks the file you open against 34 rules from a rule set dated 2026-09-20, and points at the exact line with the fix. For a filing, an audit or a client you need that dated result on your own files.

Ask about this tool

One question, answered by the person who built it. Your email only if you want the answer sent.

Embed this tool on your site (free)

Paste this code into your page. It runs in your visitor’s browser and stays up to date. Nothing your visitors type is stored.

 All embeddable tools

For businesses: your name and logo instead of ours, and each visitor’s result + e-mail in your inbox (only when they tick consent) — Pro from $19/month. See Pro →

Same job, next tool

Free in the browser. The full version is a one-time licence.

MTD for Income Tax 2026: are you in, and on which dates$60Billable Tab Timer for Hourly Freelancers & Consultants — Firefox extension th$9Angular Removed-API Lint$29DSA Terms Lint - EU Digital Services Act$29EN 301 549 Lint — European Accessibility Act rules, with the clause number, in$29EUDI Wallet Request Lint (OpenID4VP)$29