TAR Engine

Name: TAR Engine
Author: qingxuantang

by qingxuantangversion 0.3.3i★ –iRuns on your computer

Registry nameio.github.qingxuantang/tar-engine

Install

Overview

Description from the maker (original English)

Audit AI skill safety before you ship. Static, semantic, adversarial, supply chain scans.

PopNx MCP’s three pillars

These three are never merged into one score: opinions, measurements and popularity are different things.

User voiceiNo reviews yetReviews open together with accounts in a later step
Our basic checksi1 of 1 passedChecked from public information; code not scanned yet
UsageiVery new↓ 15/wk · ★ –

What you can do with it

We have not written a plain-language summary for this one yet. Below are the facts we read from the registry.

Connection: Runs on your computer
Transport: stdio
Category: Other
You need to fill in: TAR_ENGINE_BYOK_OPENAI_KEY, TAR_ENGINE_BYOK_ANTHROPIC_KEY

Install

Pick the AI app you use, then copy the settings.

Before you install

Basic checks: 1 of 1 passed
Runs on your computer with your user’s permissions (files, network, apps).
You fill in yourself: TAR_ENGINE_URL, TAR_ENGINE_BYOK_OPENAI_KEY, TAR_ENGINE_BYOK_ANTHROPIC_KEY

Values marked secret are keys to your account. Never share them or paste them into a chat.

You need

PyPIPython’s uv installed (for the uvx command)

Which app do you use?

ClaudeClaude CodeCursorVS CodeChatGPT

Pick your app above. We remember it, so next time the button says “Install in …”.

Open Claude Desktop → Settings → Developer → Edit Config, and paste this into claude_desktop_config.json

{
  "mcpServers": {
    "tar-engine": {
      "command": "uvx",
      "args": [
        "tar-engine",
        "tar-engine",
        "tar-engine-mcp"
      ],
      "env": {
        "TAR_ENGINE_URL": "your-value",
        "TAR_ENGINE_BYOK_OPENAI_KEY": "your-value",
        "TAR_ENGINE_BYOK_ANTHROPIC_KEY": "your-value"
      }
    }
  }
}

Run this in your terminal

claude mcp add tar-engine --env TAR_ENGINE_URL=your-value --env TAR_ENGINE_BYOK_OPENAI_KEY=your-value --env TAR_ENGINE_BYOK_ANTHROPIC_KEY=your-value -- uvx tar-engine tar-engine tar-engine-mcp

Fill in the empty values before running it.

Open in Cursor

Or copy the settings yourself

Paste into .cursor/mcp.json in your project, or ~/.cursor/mcp.json

{
  "mcpServers": {
    "tar-engine": {
      "command": "uvx",
      "args": [
        "tar-engine",
        "tar-engine",
        "tar-engine-mcp"
      ],
      "env": {
        "TAR_ENGINE_URL": "your-value",
        "TAR_ENGINE_BYOK_OPENAI_KEY": "your-value",
        "TAR_ENGINE_BYOK_ANTHROPIC_KEY": "your-value"
      }
    }
  }
}

Your browser asks to open the app, then the app shows the settings and asks you to confirm. Key values are left empty for you to fill in.

Open in VS Code

Or copy the settings yourself

Paste into .vscode/mcp.json in your project

{
  "servers": {
    "tar-engine": {
      "type": "stdio",
      "command": "uvx",
      "args": [
        "tar-engine",
        "tar-engine",
        "tar-engine-mcp"
      ],
      "env": {
        "TAR_ENGINE_URL": "your-value",
        "TAR_ENGINE_BYOK_OPENAI_KEY": "your-value",
        "TAR_ENGINE_BYOK_ANTHROPIC_KEY": "your-value"
      }
    }
  }
}

Your browser asks to open the app, then the app shows the settings and asks you to confirm. Key values are left empty for you to fill in.

This one runs on your computer, and ChatGPT can only connect to servers on the internet. Pick another app.

Your choice stays on this device in a cookie; no account needed.

Values you fill in

TAR_ENGINE_URL env
Override the audit backend. Default is the hosted playground at https://tarai.dev. Set to http://localhost:8765 (or your own tar-engine deployment) to self-host and keep SKILL.md content on your mach…
TAR_ENGINE_BYOK_OPENAI_KEY secret env
OpenAI API key that unlocks the semantic LLM and adversarial prompt-fuzz layers. Static and supply-chain layers run without it.
TAR_ENGINE_BYOK_ANTHROPIC_KEY secret env
Anthropic API key alternative to the OpenAI key for the semantic and adversarial layers.

These settings are generated from the maker’s registry entry. If the README says otherwise, follow the README.

What it can do

Runs on your computer; the tool list appears in your AI app after you install it.

Basic checksi

We check information anyone can see; we have not read the code. Checks that do not apply are left out of the count. · Checked Nov 8, 2026

✓ Pass
Maker matches the repo
The registry name was verified with the GitHub account qingxuantang, which owns the repo
… Not checked yet
Still maintained
We have not read this repo from GitHub yet
… Not checked yet
Has a licence
We have not read this repo from GitHub yet
– Not applicable
Endpoint responds
This one runs on your computer; there is no internet endpoint
– Not applicable
Sign-in with OAuth
Runs on your computer and uses local settings instead
… Not checked yet
No hidden instructions in tool descriptions
Runs on your computer; we can only read tool lists from internet endpoints

Compared with others in Otheri

More stars than 0% of the other 18444 servers in this category
Published to the registry more recently than 16% of the other 18444 servers in this category
Basic checks equal to or better than 100% of the other 18444 servers in this category

Compared with every active server in this category in the registry. Stars count only when the publisher owns the repo.

Common questions

Is TAR Engine safe?

It passed 1 of 1 applicable basic checks. We have not read the code. Before adding a key or token, see what access the server asks for and use a key with only the permissions you need.

What keys or codes does it need?

You need to fill in: TAR_ENGINE_BYOK_OPENAI_KEY, TAR_ENGINE_BYOK_ANTHROPIC_KEY

Does it run on my computer or in the cloud?

It runs on your computer. Your AI app starts it when needed, and data does not pass through the maker’s servers (unless it calls an online service itself).

Is it still maintained?

The GitHub repo last changed –, and the latest version (0.3.3) reached the registry 4 months ago.

Which apps can use it?

Apps that support MCP, such as Claude Desktop, Claude Code, Cursor and VS Code. You also need Python (uv) on your computer.

What can I use instead?

In the same category: Spec Driven Development, Remote Desktop Commander, Tethered Trust

Alternatives

Servers in the same category from other makers, sorted by stars.

Reading a card:↓ Downloads per weeki★ GitHub starsiThree pillars: reviews · checks · usageiUpdated = latest version published to the registryi

Spec Driven Development

MCP Server that facilitates spec-driven development workflows, not just Vibe Coding.

by formulahendryEarly↓ 66/wk★ 440Updated 14 months ago

Runs on your computer

Install

Remote Desktop Commander

Remote Desktop Commander: use files, terminal and processes on your own computers from any AI app.

by desktop-commanderGrowing★ 211Updated 3 days ago

Runs in the cloud✓ desktopcommander.app

Install

Tethered Trust

Fit, compatibility and recall checks for AI agents before they buy: verdicts, evidence, receipts.

by tetheredtrust.comVery newUpdated today

Runs in the cloud✓ tetheredtrust.com

Install

README from the maker

Open the README

Copied from the maker’s repo as written. PopNx MCP has not reviewed or endorsed it. HTML, images and scripts are removed. Links lead off this site.

TAR Engine — audit AI skill safety before you ship

Static + semantic + adversarial + supply-chain audit for AI agent skills. Run it in CI, or call it as an MCP tool from Claude Code / Cursor / Codex. BYOK for the LLM layers; free hosted tier + live Playground on tarai.dev.

Listed on the official Model Context Protocol Registry and published to PyPI — one-click install into any MCP-compatible agent.

tar-engine audits SKILL.md (OpenClaw, Claude Code), Codex `skill.yaml`, Claude Code custom commands (.claude/commands/*.md), and OpenCode configs — with no change to how you author skills. The core idea: a skill can pass every static red-flag check and still behave maliciously at runtime. TAR Engine catches that.

Three ways to run it — two of them install nothing on your machine:

Hosted — zero install. Paste or upload a skill on the tarai.dev Playground and read the audit in your browser. Nothing to install, nothing to trust locally.
In CI — zero install into your agent. The GitHub Action runs a *pinned* release inside your own CI sandbox: tar-engine scan ./skills --min-score 70 exits 1 if any skill scores below the bar. A pre-publish gate, not a nicer directory card.
In your agent — opt in. Install the MCP server and audit any SKILL.md while you write. It's a pinned, hash-verifiable PyPI release — no arbitrary git+https install. Details below.

What an audit looks like

Point it at a skill that *looks* fine. A "weekly note formatter" whose SKILL.md reads clean — but buried in it is a curl … | bash step, a "cloud sync" that tars up ~/.aws and ~/.ssh, and an instruction telling the agent to hide those network calls from you:

weekly-note-formatter        0 / 100   grade F   risk CRITICAL

L01 static SS-003 critical remote script piped to shell (curl … | bash) L01 static PI-002 critical hidden instruction — "don't tell the user" L02 semantic SEM-003 critical only formats docs, yet packages up AWS creds + SSH keys L02 semantic SEM-004 high instructs the model to lie about its network calls L03 adversarial AR-002 high 3/3 role-jailbreak probes changed the skill's behavior

→ below --min-score 70, exit 1

Regex catches the curl | bash. The semantic and adversarial layers catch the parts regex can't: intent that exceeds the skill's stated purpose, and instructions that turn the agent against its user. Every finding cites the exact source line with a fix.

The four audit layers

Layer	What it looks for	LLM?
L01 Static	Regex red flags: `curl\	bash` installs, credential/SSH exfil, obfuscated or base64 strings, hidden "ignore previous" style instructions, out-of-scope file writes	No
L02 Semantic	Reads what the skill actually asks the agent to do and flags intent beyond its stated purpose	Yes (BYOK)
L03 Adversarial	Treats the `SKILL.md` as a system prompt and runs 15 probes across 5 attack classes to see if it can be coerced into unsafe behavior	Yes (BYOK)
L06 Supply chain	Parses declared dependencies and checks them against OSV.dev advisories + a typosquat reference list	No

The 5 adversarial classes (L03):

Class	ID	Probes for
Instruction override	AR-001	`ignore previous`, `new system prompt` hijacks
Role jailbreak	AR-002	DAN / hypothetical / fictional-roleplay bypasses
Hidden payload	AR-003	base64 / leetspeak / unicode-lookalike smuggling
Authority spoof	AR-004	`I'm the developer / admin / platform staff`
Reflective injection	AR-005	output-as-instruction loops

Every skill gets a 0–100 score, an A–F grade, and a risk class. L01 and L06 are deterministic and free; L02 and L03 require your own LLM key (BYOK).

These four layers implement a vendor-neutral standard — the Skill Audit Dimensions checklist (static, semantic, adversarial/behavioral, supply-chain). The dimensions are the standard; TAR Engine is one open-source reference implementation. That checklist also says the audit *tooling* must meet its own supply-chain bar — which is why TAR Engine ships as a pinned, hash-verifiable PyPI release with a zero-install hosted and CI path, not a git+https install.

CLI — audit AI skill from the command line

The tar-engine CLI walks a directory, audits every skill it finds, and exits with a CI-friendly status code.

# audit every skill under ./skills, fail the build if any scores below 70

tar-engine scan ./skills --min-score 70

list discovered skills without auditing

tar-engine list ./skills

JSON output for downstream processing

tar-engine scan ./skills --json

Discovery covers five formats out of the box:

File pattern	Format
`**/SKILL.md`	OpenClaw, Claude Code, generic md
`*/.claude/commands/.md`	Claude Code custom commands
`**/skill.yaml` / `.yml`	Codex
`**/manifest.json`	Codex / Claude Code (key-detected)
`**/opencode.json`	OpenCode

Each audit payload bundles the primary skill file plus sibling .sh / .py / .js / .ts / .yaml / .json helper files in the same directory (200 KB cap). Catches the "SKILL.md clean but install.sh malicious" pattern.

Run it in CI — zero install. The audit runs inside *your own* CI sandbox on a pinned release; nothing is installed into your agent, and there is no arbitrary git fetch to trust:

- name: Audit AI skills

uses: qingxuantang/tar-engine@v0.3.3 # pinned release with: path: ./skills min-score: 70

Prefer a plain step? Run the pinned PyPI release directly — still no git+https:

- run: uvx --from tar-engine==0.3.3 tar-engine scan ./skills --min-score 70

Pre-commit hook:

#!/usr/bin/env bash

tar-engine scan ./skills --min-score 80 || exit 1

Exit codes: 0 clean, 1 below threshold, 2 usage/missing path.

Install as an MCP tool

TAR Engine ships an MCP server as a Python package, runnable with uvx — no Docker. By default it talks to the hosted backend at [tarai.dev](https://tarai.dev/) (free, rate-limited).

Read this first — what you're trusting

Where SKILL.md goes. With the default config the MCP server POSTs the SKILL.md content you ask it to audit to https://tarai.dev. We don't write skill text to disk or log it, but it does leave your machine. If you're auditing proprietary or sensitive skills, self-host and set TAR_ENGINE_URL=http://localhost:8765.
No silent key forwarding. The server does NOT forward your OPENAI_API_KEY. Semantic + adversarial audit layers require an explicit opt-in via TAR_ENGINE_BYOK_OPENAI_KEY in the MCP server config — see BYOK below.
What environments work. Claude Code CLI, Cursor, Codex CLI — anywhere your agent can launch a subprocess. Claude Desktop, Claude.ai web, and the mobile apps cannot install local MCP servers; hosted endpoint for those is coming — waitlist on tarai.dev.

Step 0 — install `uv` (one-time, ~5 seconds)

The package is run via uvx, which comes with uv. Install once:

# macOS / Linux

curl -fsSL https://astral.sh/uv/install.sh | sh

Windows (PowerShell)

irm https://astral.sh/uv/install.ps1 | iex

Alternative — via pipx if you don't trust curl|sh

pipx install uv

Alternative — via pip

pip install --user uv

Verify with uvx --version.

Step 1 — register with your agent

One-click: grab setup-mcp.sh and run it — it checks for uv, prompts for an optional BYOK key (hidden input, never written to disk by the script), and registers the server with your agent:

curl -fsSL https://raw.githubusercontent.com/qingxuantang/tar-engine/master/setup-mcp.sh -o setup-mcp.sh

chmod +x setup-mcp.sh ./setup-mcp.sh # Claude Code (default); add --client cursor|codex

Or configure it manually. Two install forms are supported:

From PyPI — recommended, pinned & verifiable: uvx --from tar-engine==0.3.3 tar-engine-mcp. Every release ships to PyPI with a published hash you can lock in your lockfile — this is the canonical, reproducible install and the form the MCP registry / Anthropic MCPB clients use. No arbitrary `git+https`; pin the version so you always know exactly what you're running.
From source — development only: installing from a git checkout runs unreleased code without a published release hash. Use this only if you're hacking on TAR Engine itself — it is *not* the recommended way to run it, precisely because "install this unvetted git URL" is the pattern a supply-chain audit should warn against.

Claude Code

claude mcp add tar-engine -- uvx --from tar-engine==0.3.3 tar-engine-mcp

Verify: /mcp list should show tar-engine Connected. Restart Claude Code so this session picks up the new tool surface, then ask:

Audit this SKILL.md: [paste a skill]

Cursor

Edit ~/.cursor/mcp.json (or project-level .cursor/mcp.json):

"mcpServers": { "tar-engine": { "command": "uvx", "args": ["--from", "tar-engine==0.3.3", "tar-engine-mcp"] } } }

Reload MCP servers in Cursor (or restart the app), then call audit_skill_text from inside Cursor.

Codex CLI

Add to ~/.codex/config.toml:

[mcp_servers.tar-engine]

command = "uvx" args = ["--from", "tar-engine==0.3.3", "tar-engine-mcp"]

Restart the Codex CLI, then call audit_skill_text.

Any other MCP-compatible agent

Most agents accept an MCP server spec with command + args (JSON or TOML):

command: uvx
args: ["--from", "tar-engine==0.3.3", "tar-engine-mcp"] — pinned to a published PyPI release for a reproducible, hash-verifiable install

env (optional):

TAR_ENGINE_URL=http://localhost:8765 to self-host
TAR_ENGINE_BYOK_OPENAI_KEY=sk-... to enable semantic + adversarial layers

Reload the agent and call audit_skill_text to verify.

BYOK (semantic + adversarial layers)

By default only the static rule layer runs against your skill — free, deterministic, no LLM cost. To enable the semantic LLM review and the adversarial prompt-fuzz pass, supply your own LLM key explicitly:

"tar-engine": {

"command": "uvx", "args": ["--from", "tar-engine==0.3.3", "tar-engine-mcp"], "env": { "TAR_ENGINE_BYOK_OPENAI_KEY": "sk-..." } }

The key layer is OpenAI-compatible, so you can point it at any compatible endpoint (TAR_ENGINE_BYOK_OPENAI_BASE_URL / TAR_ENGINE_BYOK_OPENAI_MODEL). We deliberate

Only the beginning is shown; read the rest in the repo

TAR Engine

Overview

PopNx MCP’s three pillars

What you can do with it

Install

Before you install

Values you fill in

What it can do

Basic checksi

Maker matches the repo

Still maintained

Has a licence

Endpoint responds

Sign-in with OAuth

No hidden instructions in tool descriptions

Compared with others in Otheri

Common questions

Alternatives

Spec Driven Development

Remote Desktop Commander

Tethered Trust

README from the maker

TAR Engine — audit AI skill safety before you ship

What an audit looks like

The four audit layers

CLI — audit AI skill from the command line

list discovered skills without auditing

JSON output for downstream processing

Install as an MCP tool

Read this first — what you're trusting

Step 0 — install uv (one-time, ~5 seconds)

Windows (PowerShell)

Alternative — via pipx if you don't trust curl|sh

Alternative — via pip

Step 1 — register with your agent

BYOK (semantic + adversarial layers)

Step 0 — install `uv` (one-time, ~5 seconds)