# TAR Engine [Health: Active]

**Category:** 🔒 Security  
**Repository:** https://github.com/qingxuantang/tar-engine  
**GitHub Stars:** 2  
**Views:** 0  
**Installs:** 0  
**Upvotes:** 0  
**Directory Page:** https://allmcps.com/mcp/tar-engine

## Description
Audit AI skill safety before you ship. Static, semantic, adversarial, supply chain scans.

## Claude Desktop Quick Installation
Install path detected from listing signals. Uses `uvx` (confidence: high):

```json
"mcpServers": {
  "tar-engine": {
    "command": "uvx",
    "args": ["--from","tar-engine==0.3.3","tar-engine"],
    "env": {
      "TAR_ENGINE_URL": "",
      "TAR_ENGINE_BYOK_OPENAI_KEY": ""
    }
  }
}
```

**Requires environment variables:** `TAR_ENGINE_URL`, `TAR_ENGINE_BYOK_OPENAI_KEY` — the values above are empty placeholders; fill in real credentials before running (see the repository for what each one is for).

## Documentation

## What TAR Engine MCP server does

TAR Engine MCP server evaluates AI agent skill definitions and related configuration files before they are published or used. It supports `SKILL.md` files for OpenClaw, Claude Code, and generic Markdown skills; Codex `skill.yaml` or `skill.yml`; Claude Code custom commands; Codex or Claude Code `manifest.json` files; and OpenCode configuration files.

Each audit produces a score from 0 to 100, an A–F grade, and a risk classification. Findings include the audit layer, rule identifier, severity, and the relevant source line, along with a suggested direction for fixing the issue. The scanner also includes sibling `.sh`, `.py`, `.js`, `.ts`, `.yaml`, and `.json` files in the same skill directory, subject to a 200 KB limit.

## How it works

The audit is divided into four layers. L01 uses deterministic checks for patterns such as remote shell execution, credential or SSH-key access, obfuscation, hidden instruction overrides, and out-of-scope writes. L02 uses an LLM to assess whether a skill requests actions beyond its stated purpose. L03 treats the skill as a system prompt and runs 15 adversarial probes covering instruction overrides, role jailbreaks, hidden payloads, authority spoofing, and reflective injection. L06 checks declared dependencies against OSV advisories and a typosquat reference list.

L01 and L06 do not require an LLM key. L02 and L03 require an explicit BYOK OpenAI key. The command-line scanner can walk a directory, list discovered skills, emit JSON, and return status code 1 when a configured minimum score is not met.

## Setup and configuration

The TAR Engine MCP server is distributed as a Python package and can be launched with `uvx`; Docker is not required. In its default configuration, it sends the skill content being audited to `https://tarai.dev`, where the hosted backend performs the audit. The server does not silently forward an existing `OPENAI_API_KEY`. Enable the LLM-backed layers by providing `TAR_ENGINE_BYOK_OPENAI_KEY` in the MCP server configuration.

For sensitive or proprietary skill content, the project documents self-hosting and supports changing the backend with `TAR_ENGINE_URL`, such as `http://localhost:8765`. The package is intended for agent environments that can launch a subprocess. The documented MCP clients are Claude Code CLI, Cursor, and Codex CLI.

## Tools and capabilities

The TAR Engine MCP server provides an agent-accessible audit path for supported skill content. Its broader package also includes:

- Directory discovery across the supported skill formats
- Static, semantic, adversarial, and dependency-safety analysis
- JSON output for downstream processing
- Minimum-score gates for CI or pre-commit checks
- A GitHub Action using a pinned release
- A hosted Playground for browser-based audits

The release is published to PyPI and is described as pinned and hash-verifiable. CI can run the scanner without installing it into the agent environment.

## Limitations and notes

The default MCP setup sends submitted skill text off the local machine to tarai.dev. Use a self-hosted endpoint when that transfer is not acceptable. The hosted service is described as free and rate-limited. Claude Desktop, Claude.ai web, and mobile applications cannot install local MCP servers according to the project documentation.

Semantic and adversarial results depend on the explicitly configured LLM access, while static and supply-chain checks remain deterministic. The documented helper-file bundle has a 200 KB cap, and the CI scanner uses exit code 0 for a clean result, 1 for a below-threshold result, and 2 for usage or missing-path errors.

_Full upstream README: https://allmcps.com/mcp/tar-engine/readme_