TAR Engine

Developer Tools Python v0.3.3

Audit AI skill safety before you ship. Static, semantic, adversarial, supply chain scans.

View source ↗ Website ↗ Generate config for multiple servers More servers

Install

Pin version registry version 0.3.3

Python
uvx tar-engine

Python
uvx tar-engine@0.3.3

Setup by client

Pick your client — the config below is generated for this server (local stdio). Copy respects the “Pin version” switch above.

claude_desktop_config.json

{
  "mcpServers": {
    "tar-engine": {
      "command": "uvx",
      "args": [
        "tar-engine"
      ],
      "env": {
        "TAR_ENGINE_BYOK_OPENAI_KEY": "<YOUR_TAR_ENGINE_BYOK_OPENAI_KEY>",
        "TAR_ENGINE_BYOK_ANTHROPIC_KEY": "<YOUR_TAR_ENGINE_BYOK_ANTHROPIC_KEY>"
      }
    }
  }
}

{
  "mcpServers": {
    "tar-engine": {
      "command": "uvx",
      "args": [
        "tar-engine@0.3.3"
      ],
      "env": {
        "TAR_ENGINE_BYOK_OPENAI_KEY": "<YOUR_TAR_ENGINE_BYOK_OPENAI_KEY>",
        "TAR_ENGINE_BYOK_ANTHROPIC_KEY": "<YOUR_TAR_ENGINE_BYOK_ANTHROPIC_KEY>"
      }
    }
  }
}

Format verified against the official Claude Desktop docs ↗.

terminal

claude mcp add --env TAR_ENGINE_BYOK_OPENAI_KEY=<YOUR_TAR_ENGINE_BYOK_OPENAI_KEY> --env TAR_ENGINE_BYOK_ANTHROPIC_KEY=<YOUR_TAR_ENGINE_BYOK_ANTHROPIC_KEY> tar-engine -- uvx tar-engine

claude mcp add --env TAR_ENGINE_BYOK_OPENAI_KEY=<YOUR_TAR_ENGINE_BYOK_OPENAI_KEY> --env TAR_ENGINE_BYOK_ANTHROPIC_KEY=<YOUR_TAR_ENGINE_BYOK_ANTHROPIC_KEY> tar-engine -- uvx tar-engine@0.3.3

Format verified against the official Claude Code docs ↗.

.cursor/mcp.json

{
  "mcpServers": {
    "tar-engine": {
      "command": "uvx",
      "args": [
        "tar-engine"
      ],
      "env": {
        "TAR_ENGINE_BYOK_OPENAI_KEY": "<YOUR_TAR_ENGINE_BYOK_OPENAI_KEY>",
        "TAR_ENGINE_BYOK_ANTHROPIC_KEY": "<YOUR_TAR_ENGINE_BYOK_ANTHROPIC_KEY>"
      }
    }
  }
}

{
  "mcpServers": {
    "tar-engine": {
      "command": "uvx",
      "args": [
        "tar-engine@0.3.3"
      ],
      "env": {
        "TAR_ENGINE_BYOK_OPENAI_KEY": "<YOUR_TAR_ENGINE_BYOK_OPENAI_KEY>",
        "TAR_ENGINE_BYOK_ANTHROPIC_KEY": "<YOUR_TAR_ENGINE_BYOK_ANTHROPIC_KEY>"
      }
    }
  }
}

Format verified against the official Cursor docs ↗.

.vscode/mcp.json

{
  "servers": {
    "tar-engine": {
      "command": "uvx",
      "args": [
        "tar-engine"
      ],
      "env": {
        "TAR_ENGINE_BYOK_OPENAI_KEY": "<YOUR_TAR_ENGINE_BYOK_OPENAI_KEY>",
        "TAR_ENGINE_BYOK_ANTHROPIC_KEY": "<YOUR_TAR_ENGINE_BYOK_ANTHROPIC_KEY>"
      }
    }
  }
}

{
  "servers": {
    "tar-engine": {
      "command": "uvx",
      "args": [
        "tar-engine@0.3.3"
      ],
      "env": {
        "TAR_ENGINE_BYOK_OPENAI_KEY": "<YOUR_TAR_ENGINE_BYOK_OPENAI_KEY>",
        "TAR_ENGINE_BYOK_ANTHROPIC_KEY": "<YOUR_TAR_ENGINE_BYOK_ANTHROPIC_KEY>"
      }
    }
  }
}

Format verified against the official VS Code docs ↗.

mcp_config.json

{
  "mcpServers": {
    "tar-engine": {
      "command": "uvx",
      "args": [
        "tar-engine"
      ],
      "env": {
        "TAR_ENGINE_BYOK_OPENAI_KEY": "<YOUR_TAR_ENGINE_BYOK_OPENAI_KEY>",
        "TAR_ENGINE_BYOK_ANTHROPIC_KEY": "<YOUR_TAR_ENGINE_BYOK_ANTHROPIC_KEY>"
      }
    }
  }
}

{
  "mcpServers": {
    "tar-engine": {
      "command": "uvx",
      "args": [
        "tar-engine@0.3.3"
      ],
      "env": {
        "TAR_ENGINE_BYOK_OPENAI_KEY": "<YOUR_TAR_ENGINE_BYOK_OPENAI_KEY>",
        "TAR_ENGINE_BYOK_ANTHROPIC_KEY": "<YOUR_TAR_ENGINE_BYOK_ANTHROPIC_KEY>"
      }
    }
  }
}

Format verified against the official Windsurf docs ↗.

Environment variables

Defined in the server's official registry manifest. Required secrets are shown as <YOUR_…> placeholders in the configs above.

TAR_ENGINE_URL — Override the audit backend. Default is the hosted playground at https://tarai.dev. Set to http://localhost:8765 (or your own tar-engine deployment) to self-host and keep SKILL.md content on your machine.
TAR_ENGINE_BYOK_OPENAI_KEY secret — OpenAI API key that unlocks the semantic LLM and adversarial prompt-fuzz layers. Static and supply-chain layers run without it.
TAR_ENGINE_BYOK_ANTHROPIC_KEY secret — Anthropic API key alternative to the OpenAI key for the semantic and adversarial layers.

GitHub

⭐ 2 stars · 最近更新于 112 天前 · Apache-2.0 license

About this server

TAR Engine — audit AI skill safety before you ship Static + semantic + adversarial + supply chain audit for AI agent skills. Run it in CI, or call it as an MCP tool from Claude Code / Cursor / Codex. BYOK for the LLM layers; free hosted tier + live Playground on tarai.dev. Listed on the official Mod…

Summary from the project README — github.com/qingxuantang/tar-engine

Distributed as Python, listed under Developer Tools. Review our MCP security guide before granting access to real data.

Frequently asked questions

What does the TAR Engine MCP server do?

How do I install TAR Engine?

Run the install command shown above, then paste the config for your client (Claude Desktop, Claude Code, Cursor, VS Code or Windsurf) into its MCP settings and restart the client.

Is TAR Engine free to use?

The MCP server itself is free to install. The source is public on https://github.com/qingxuantang/tar-engine. Any third-party service it calls may require its own API key and account.

Which clients support TAR Engine?

Any MCP-compatible client can use it, including Claude Desktop, Claude Code, Cursor, VS Code, Windsurf and custom agents.

Add this badge

Publish this server? Link back with a badge on your README or site — copy either snippet.

Markdown

[![Listed on MCPNav](https://mcpnav.net/badge/tar-engine.svg)](https://mcpnav.net/server/tar-engine/)

HTML

<a href="https://mcpnav.net/server/tar-engine/"><img src="https://mcpnav.net/badge/tar-engine.svg" alt="Listed on MCPNav" height="20"></a>