· ReadyStack
Worked example
Real numbers from this tool, line by line.
Five header spellings HMRC rejects look completely correct to a UK developer building Making Tax Digital software. They pass code review, they pass your tests, and they pass every linter you already run - because none of those things has ever read HMRC's Fraud Prevention Directions.
Here is the one that catches almost everyone. HMRC's header is Gov-Vendor-License-IDs. American spelling. A UK developer writes Licence without a second thought, and nothing in the toolchain objects.
There are four more of the same shape:
Gov-Client-Timezonemust be a UTC offset inUTC+HH:MMform. NotEurope/London, notGMT, notUTC+1.Gov-Client-Public-IP-Timestampmust beyyyy-MM-ddThh:mm:ss.sssZ, with the milliseconds and the trailing zeros.2026-09-09T14:30:05Zis the wrong format.Gov-Client-Screensusescolour-depth. British spelling this time, which is exactly why it catches people who learned the License one.Gov-Client-Device-IDends in a capitalID, and it has to be a UUID that persists on the device, not a string you hard-coded during testing.
Why your assistant gets this wrong
The Directions have been revised repeatedly - version 3.0 in January 2021, 3.1 in January 2022, 3.2 in August 2023, 3.3 in January 2025. Each revision moved headers between required and optional. Gov-Client-Browser-Plugins and Gov-Client-Browser-Do-Not-Track no longer need values for a web application via server, but a large amount of the tutorial material on the open web still lists them as mandatory, and that is the material language models were trained on.
That is the trap. The wrong answer is confidently written, well formatted, and four years out of date.
Why HMRC's own validator does not save you
HMRC publishes a Test Fraud Prevention Headers API, and it is good. But it grades a live request that you have already built and sent, using sandbox credentials. It cannot read your source. It tells you nothing on the afternoon you are writing the integration, and nothing at all about the code paths your tests do not exercise.
What this extension does
It reads the file you have open and applies 34 rules drawn directly from HMRC's connection-method tables - the header names, the value syntax, the percent-encoding rules, and the connection methods that actually exist. WEB_APP_DIRECT is not one of them; a browser-based application is always WEB_APP_VIA_SERVER.
It runs offline. Your code is not uploaded anywhere, which matters when the file in front of you sets headers on a request carrying a client's tax data.
Checking the open file is free and complete: every finding, every correct spelling. A licence adds the whole-workspace scan - header code is almost always spread across the HTTP client, the middleware and the tests - plus an exportable CSV, JSON or HTML report, machine-readable output so CI can fail the build, and auto-correction of the names that have exactly one right spelling.
The first mandated Making Tax Digital for Income Tax year is running now, and the next quarterly update deadline is 7 November 2026.
Questions people ask
What does this actually check?
It reads the code where you set HMRC's Gov-Client and Gov-Vendor fraud prevention headers and reports 34 specific problems: header names spelled a way HMRC does not accept, timezone values that are not UTC+HH:MM, timestamps missing their milliseconds, values that should be percent-encoded, and connection methods that do not exist in HMRC's specification.
Who is this for?
UK developers and software vendors building or maintaining Making Tax Digital software that calls HMRC's VAT (MTD) or Income Tax Self Assessment (MTD) APIs. If your team sends Gov-Client headers on any HMRC request, including a white-labelled product or an application built purely for internal use, this was written for you.
Why not just use HMRC's own header validator?
HMRC's Test Fraud Prevention Headers API grades a live request you have already built and sent, and calling it needs sandbox credentials. It cannot read your source, so it finds nothing until the integration exists and is running. This checks code in your editor, offline, before anything has been sent to HMRC.
What is free and what needs a licence?
Checking the file you have open, or only the lines you select, against all 34 rules is free and complete: you get every finding and the correct spelling for each one. A licence adds scanning every file in the workspace, exporting a CSV, JSON or HTML report, machine-readable output for CI, and auto-correcting the misspelled header names.
What would it cost to check this by hand?
By hand it means reading HMRC's connection-method tables for every header on every request, then rechecking them each time the Fraud Prevention Directions are revised, most recently version 3.3 on 27 January 2025. HMRC charges a 200 pound penalty once a filer crosses the points threshold for late quarterly updates.
Why not just ask ChatGPT or another AI chat?
A general AI chat answers from training data with a cutoff date, cannot read your repository and names no rule version. HMRC Fraud Prevention Header Lint for Making Tax Digital (VA checks the file you open against 34 rules from a rule set dated 2026-09-20, and points at the exact line with the fix. For a filing, an audit or a client you need that dated result on your own files.
Ask about this tool
One question, answered by the person who built it. Your email only if you want the answer sent.