@taplid/mcp 0.4.6 → 0.4.7
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +171 -165
- package/dist/mcp-output.js +0 -1
- package/dist/server.js +1 -1
- package/dist/taplid-client.js +1 -2
- package/dist/tool.js +0 -1
- package/package.json +2 -2
package/README.md
CHANGED
|
@@ -1,165 +1,171 @@
|
|
|
1
|
-
# @taplid/mcp
|
|
2
|
-
|
|
3
|
-
|
|
4
|
-
|
|
5
|
-
|
|
6
|
-
|
|
7
|
-
|
|
8
|
-
|
|
9
|
-
|
|
10
|
-
|
|
11
|
-
-
|
|
12
|
-
|
|
13
|
-
|
|
14
|
-
|
|
15
|
-
|
|
16
|
-
|
|
17
|
-
|
|
18
|
-
|
|
19
|
-
|
|
20
|
-
|
|
21
|
-
|
|
22
|
-
|
|
23
|
-
|
|
24
|
-
|
|
25
|
-
|
|
26
|
-
|
|
27
|
-
|
|
28
|
-
|
|
29
|
-
|
|
30
|
-
|
|
31
|
-
|
|
32
|
-
|
|
33
|
-
|
|
34
|
-
|
|
35
|
-
|
|
36
|
-
|
|
37
|
-
|
|
38
|
-
|
|
39
|
-
|
|
40
|
-
|
|
41
|
-
|
|
42
|
-
```
|
|
43
|
-
|
|
44
|
-
|
|
45
|
-
|
|
46
|
-
|
|
47
|
-
|
|
48
|
-
|
|
49
|
-
|
|
50
|
-
|
|
51
|
-
|
|
52
|
-
|
|
53
|
-
|
|
54
|
-
|
|
55
|
-
|
|
56
|
-
|
|
57
|
-
|
|
58
|
-
|
|
59
|
-
|
|
60
|
-
|
|
61
|
-
|
|
62
|
-
|
|
63
|
-
|
|
64
|
-
|
|
65
|
-
|
|
66
|
-
|
|
67
|
-
|
|
|
68
|
-
|
|
69
|
-
|
|
70
|
-
|
|
71
|
-
|
|
72
|
-
|
|
73
|
-
`
|
|
74
|
-
|
|
75
|
-
|
|
76
|
-
|
|
77
|
-
|
|
78
|
-
|
|
79
|
-
|
|
80
|
-
|
|
81
|
-
|
|
82
|
-
|
|
83
|
-
|
|
84
|
-
|
|
85
|
-
|
|
86
|
-
|
|
87
|
-
```
|
|
88
|
-
|
|
89
|
-
|
|
90
|
-
|
|
91
|
-
|
|
92
|
-
|
|
93
|
-
|
|
94
|
-
|
|
95
|
-
|
|
96
|
-
|
|
97
|
-
|
|
98
|
-
|
|
99
|
-
|
|
100
|
-
|
|
101
|
-
|
|
102
|
-
|
|
103
|
-
|
|
104
|
-
|
|
105
|
-
|
|
106
|
-
|
|
107
|
-
"
|
|
108
|
-
|
|
109
|
-
|
|
110
|
-
|
|
111
|
-
|
|
112
|
-
|
|
113
|
-
|
|
114
|
-
"
|
|
115
|
-
"
|
|
116
|
-
}
|
|
117
|
-
],
|
|
118
|
-
"
|
|
119
|
-
|
|
120
|
-
|
|
121
|
-
|
|
122
|
-
}
|
|
123
|
-
|
|
124
|
-
|
|
125
|
-
|
|
126
|
-
|
|
127
|
-
|
|
128
|
-
|
|
129
|
-
|
|
130
|
-
|
|
131
|
-
|
|
132
|
-
|
|
133
|
-
- **
|
|
134
|
-
- **
|
|
135
|
-
- **
|
|
136
|
-
|
|
137
|
-
|
|
138
|
-
|
|
139
|
-
|
|
140
|
-
|
|
141
|
-
|
|
142
|
-
|
|
143
|
-
|
|
144
|
-
|
|
145
|
-
|
|
146
|
-
|
|
147
|
-
|
|
148
|
-
|
|
149
|
-
|
|
|
150
|
-
|
|
151
|
-
| `
|
|
152
|
-
| `
|
|
153
|
-
| `
|
|
154
|
-
|
|
155
|
-
|
|
156
|
-
|
|
157
|
-
|
|
158
|
-
|
|
159
|
-
|
|
160
|
-
|
|
161
|
-
|
|
162
|
-
|
|
163
|
-
|
|
164
|
-
|
|
165
|
-
|
|
1
|
+
# @taplid/mcp
|
|
2
|
+
|
|
3
|
+
Official MCP for the hosted Taplid audit API.
|
|
4
|
+
|
|
5
|
+
- Docs: https://taplid.com/docs
|
|
6
|
+
- Audit page: https://taplid.com/audit
|
|
7
|
+
|
|
8
|
+
|
|
9
|
+
Local MCP (Model Context Protocol) server exposing Taplid's artifact audit as a single tool for AI coding agents.
|
|
10
|
+
|
|
11
|
+
Use Taplid from Claude Desktop, Cursor, or any MCP-aware client to verify AI-generated artifacts (implementation plans, code reviews, PR reviews, generated technical reports, proposed code changes) against supplied context before trusting, applying, merging, sending, or acting on them.
|
|
12
|
+
|
|
13
|
+
## What it does
|
|
14
|
+
|
|
15
|
+
Registers one MCP tool, `taplid_audit`, that accepts three text fields and returns ALLOW / REVIEW / BLOCK with a 0-100 trust score and a structured summary.
|
|
16
|
+
|
|
17
|
+
- One tool only. No file reading. No command execution. No repo scanning.
|
|
18
|
+
- Stdio transport. Local process launched by the MCP client.
|
|
19
|
+
- HTTP caller boundary to the existing Taplid API. No engine code is imported.
|
|
20
|
+
|
|
21
|
+
## Install and configure
|
|
22
|
+
|
|
23
|
+
The package is invoked as a local binary by an MCP-aware client (Claude Desktop, Cursor, others). It does not need to be globally installed; `npx` resolves it on first invocation.
|
|
24
|
+
|
|
25
|
+
### Claude Desktop / Cursor (cross-platform)
|
|
26
|
+
|
|
27
|
+
Add this block to your MCP client's `mcpServers` config and `npx` will resolve the package on first invocation:
|
|
28
|
+
|
|
29
|
+
```json
|
|
30
|
+
{
|
|
31
|
+
"mcpServers": {
|
|
32
|
+
"taplid": {
|
|
33
|
+
"command": "npx",
|
|
34
|
+
"args": ["-y", "@taplid/mcp"],
|
|
35
|
+
"env": {
|
|
36
|
+
"TAPLID_API_KEY": "tap_live_...",
|
|
37
|
+
"TAPLID_API_URL": "https://api.taplid.com"
|
|
38
|
+
}
|
|
39
|
+
}
|
|
40
|
+
}
|
|
41
|
+
}
|
|
42
|
+
```
|
|
43
|
+
|
|
44
|
+
### Local development (Windows path)
|
|
45
|
+
|
|
46
|
+
For local development against a Taplid API running on your machine:
|
|
47
|
+
|
|
48
|
+
```json
|
|
49
|
+
{
|
|
50
|
+
"mcpServers": {
|
|
51
|
+
"taplid-local": {
|
|
52
|
+
"command": "node",
|
|
53
|
+
"args": ["C:\\code\\taplid\\packages\\taplid-mcp\\dist\\server.js"],
|
|
54
|
+
"env": {
|
|
55
|
+
"TAPLID_API_KEY": "tap_live_...",
|
|
56
|
+
"TAPLID_API_URL": "http://127.0.0.1:7000"
|
|
57
|
+
}
|
|
58
|
+
}
|
|
59
|
+
}
|
|
60
|
+
}
|
|
61
|
+
```
|
|
62
|
+
|
|
63
|
+
Compatible with MCP-aware clients such as Claude Desktop and Cursor where stdio MCP servers are supported. Specific clients may use their own config formats.
|
|
64
|
+
|
|
65
|
+
## Environment variables
|
|
66
|
+
|
|
67
|
+
| Variable | Default | Purpose |
|
|
68
|
+
|---|---|---|
|
|
69
|
+
| `TAPLID_API_KEY` | required | Bearer token for the Taplid API. Set this in your MCP client config block. Never passed as a tool input. |
|
|
70
|
+
| `TAPLID_API_URL` | falls back to `TAPLID_PUBLIC_API_URL`, then `https://api.taplid.com` | Base URL for the Taplid API. |
|
|
71
|
+
| `TAPLID_MCP_TIMEOUT_MS` | `60000` | AbortController deadline for each request. Range 1000-600000ms; out-of-range values revert to default. |
|
|
72
|
+
| `TAPLID_MCP_DEBUG` | `false` | When `"true"`, successful responses include a `_debug` object with `{latencyMs, bytesIn, httpStatus}`. Bodies and secrets are never included. |
|
|
73
|
+
| `TAPLID_MCP_LOG_LEVEL` | `info` | Pino log level: `trace`, `debug`, `info`, `warn`, `error`, `fatal`, `silent`. |
|
|
74
|
+
|
|
75
|
+
Logs go to stderr only. Stdout is reserved for the MCP protocol.
|
|
76
|
+
|
|
77
|
+
## Tool: `taplid_audit`
|
|
78
|
+
|
|
79
|
+
`MAX_REVIEW_FIELD_CHARS` characters (120,000). Oversize input is rejected before the network call.
|
|
80
|
+
|
|
81
|
+
`TAPLID_API_KEY` is read from the MCP client env block.
|
|
82
|
+
|
|
83
|
+
### Worked example
|
|
84
|
+
|
|
85
|
+
Input:
|
|
86
|
+
|
|
87
|
+
```json
|
|
88
|
+
{
|
|
89
|
+
"context": "The number is 1.",
|
|
90
|
+
"prompt": "What is the number?",
|
|
91
|
+
"response": "The number is 2."
|
|
92
|
+
}
|
|
93
|
+
```
|
|
94
|
+
|
|
95
|
+
Expected envelope:
|
|
96
|
+
|
|
97
|
+
```json
|
|
98
|
+
{
|
|
99
|
+
"auditId": "AUD-XXX...",
|
|
100
|
+
"decision": "BLOCK",
|
|
101
|
+
"trustScore": 0,
|
|
102
|
+
"summary": "This answer conflicts with the provided context.",
|
|
103
|
+
"issues": [
|
|
104
|
+
{
|
|
105
|
+
"message": "Contradicts the provided context.",
|
|
106
|
+
"snippet": "The number is 2.",
|
|
107
|
+
"reason": "The answer says the opposite of what the context says."
|
|
108
|
+
}
|
|
109
|
+
],
|
|
110
|
+
"nextStep": "Do not use this yet. Adjust the answer to match the provided context, then re-run the check.",
|
|
111
|
+
"repairActions": [
|
|
112
|
+
{
|
|
113
|
+
"action": "Rewrite the answer so it aligns with the provided context.",
|
|
114
|
+
"priority": "high",
|
|
115
|
+
"target": "response"
|
|
116
|
+
}
|
|
117
|
+
],
|
|
118
|
+
"claims": [
|
|
119
|
+
{
|
|
120
|
+
"status": "contradicted",
|
|
121
|
+
"text": "The number is 2."
|
|
122
|
+
}
|
|
123
|
+
],
|
|
124
|
+
"details": {
|
|
125
|
+
"passThreshold": 80,
|
|
126
|
+
"reviewThreshold": 60
|
|
127
|
+
}
|
|
128
|
+
}
|
|
129
|
+
```
|
|
130
|
+
|
|
131
|
+
### Response fields
|
|
132
|
+
|
|
133
|
+
- **auditId** — unique identifier for this audit run
|
|
134
|
+
- **decision** — `ALLOW`, `REVIEW`, or `BLOCK`
|
|
135
|
+
- **trustScore** — 0 to 100 public trust signal
|
|
136
|
+
- **summary** — short explanation for the verdict
|
|
137
|
+
- **issues** — concrete problems found in the response
|
|
138
|
+
- **nextStep** — practical guidance for what to do next
|
|
139
|
+
- **repairActions** — prioritized steps to fix the response
|
|
140
|
+
- **claims** — individual claims extracted and verified against the context
|
|
141
|
+
- **details.passThreshold / details.reviewThreshold** — decision thresholds set on your account
|
|
142
|
+
|
|
143
|
+
`repairActions` and `auditId` are present only when the API returns them.
|
|
144
|
+
|
|
145
|
+
## Error codes
|
|
146
|
+
|
|
147
|
+
The MCP tool returns structured errors with stable codes; no stack traces, no raw upstream bodies.
|
|
148
|
+
|
|
149
|
+
| Code | When |
|
|
150
|
+
|---|---|
|
|
151
|
+
| `INVALID_INPUT` | A required field is missing or not a non-empty string. |
|
|
152
|
+
| `INPUT_TOO_LARGE` | One of `context`, `prompt`, `response` exceeds 120,000 characters. Detected pre-network. |
|
|
153
|
+
| `MISSING_API_KEY` | `TAPLID_API_KEY` is not set. Detected pre-network. |
|
|
154
|
+
| `UPSTREAM_AUTH_FAILED` | The Taplid API returned 401 or 403. |
|
|
155
|
+
| `UPSTREAM_RATE_LIMITED` | The Taplid API returned 429. |
|
|
156
|
+
| `UPSTREAM_TIMEOUT` | The request did not complete within `TAPLID_MCP_TIMEOUT_MS`. |
|
|
157
|
+
| `UPSTREAM_UNAVAILABLE` | The Taplid API returned 5xx or the host was unreachable. |
|
|
158
|
+
| `UPSTREAM_BAD_RESPONSE` | The Taplid API returned a body that was not valid JSON or not the expected shape. |
|
|
159
|
+
| `MCP_INTERNAL` | Unexpected internal error. |
|
|
160
|
+
|
|
161
|
+
## Security model
|
|
162
|
+
|
|
163
|
+
- One MCP tool. No file I/O, no shell, no process spawning, no inbound network listener.
|
|
164
|
+
- Stdio transport launched by the MCP client. The threat model includes hostile tool input and hostile generated artifacts.
|
|
165
|
+
- `TAPLID_API_KEY` is read from the environment only and is never accepted as a tool input.
|
|
166
|
+
- Logs redact the API key, the `Authorization` header, and the bodies of `context`, `prompt`, `response`. Stdout is reserved for the MCP protocol.
|
|
167
|
+
- The package never imports core Taplid engine code. The audit pipeline is reached via Taplid's public HTTP audit endpoint, which preserves all server-side guards.
|
|
168
|
+
|
|
169
|
+
## License
|
|
170
|
+
|
|
171
|
+
Same license as the parent Taplid workspace.
|
package/dist/mcp-output.js
CHANGED
package/dist/server.js
CHANGED
package/dist/taplid-client.js
CHANGED
|
@@ -16,14 +16,13 @@ export async function postArtifactReview(req, cfg, deps = {}) {
|
|
|
16
16
|
try {
|
|
17
17
|
try {
|
|
18
18
|
res = await Promise.race([
|
|
19
|
-
fetchImpl(`${cfg.baseUrl}/
|
|
19
|
+
fetchImpl(`${cfg.baseUrl}/review`, {
|
|
20
20
|
method: 'POST',
|
|
21
21
|
headers: {
|
|
22
22
|
'content-type': 'application/json',
|
|
23
23
|
authorization: `Bearer ${cfg.apiKey}`,
|
|
24
24
|
},
|
|
25
25
|
body: JSON.stringify({
|
|
26
|
-
auditMode: 'artifact',
|
|
27
26
|
context: req.context,
|
|
28
27
|
prompt: req.prompt,
|
|
29
28
|
response: req.response,
|
package/dist/tool.js
CHANGED
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@taplid/mcp",
|
|
3
|
-
"version": "0.4.
|
|
3
|
+
"version": "0.4.7",
|
|
4
4
|
"description": "Local MCP (Model Context Protocol) server exposing Taplid artifact audit as a single tool for AI coding agents.",
|
|
5
5
|
"keywords": [
|
|
6
6
|
"taplid",
|
|
@@ -36,7 +36,7 @@
|
|
|
36
36
|
],
|
|
37
37
|
"dependencies": {
|
|
38
38
|
"@modelcontextprotocol/sdk": "^1.29.0",
|
|
39
|
-
"@taplid/contract": "0.4.
|
|
39
|
+
"@taplid/contract": "0.4.7",
|
|
40
40
|
"pino": "^9.0.0",
|
|
41
41
|
"zod": "^3.0.0"
|
|
42
42
|
},
|