mcpField
T
tashan

tashan

Local
tashan.shSecurity0Updated today
RepositoryVisit website

About tashan

tashan is a command-line tool for checking MCP servers, plugins, and skills before installation or while reviewing an existing toolbox. It presents public evidence about maintenance, security, adoption, and permissions, and can gate CI through its exit code.

Key features

  1. 01Flags deprecated, malicious, or advisory-bearing projects
  2. 02Shows scores and supporting public evidence
  3. 03Analyzes local Claude Code usage history
  4. 04Reviews permissions and recent changes
  5. 05Gates CI with its exit code

Use cases

  1. 01Check an MCP server or skill before installation
  2. 02Review an existing agent toolbox
  3. 03Block flagged projects in CI

MCP support

tashan evaluates public information about MCP servers and related projects; it does not provide tools or resources to MCP clients.

Configuration

Local server config is the same for every client. Copy it into your client’s MCP config file.

mcp.json · Universal config
{
  "mcpServers": {
    "sh-tashan-tashan": {
      "command": "npx",
      "args": [
        "-y",
        "tashan-cli"
      ]
    }
  }
}
Run commandnpx -y tashan-cli

Local servers need a runtime on your machine (e.g. Node.js 18+). Config file locations differ by client; see your client’s docs.

Packages
npmtashan-cli0.1.4

Tools

3

Saved tool list · updated 2w ago

ParameterTypeRequiredDescription
taskstringYesWhat the user wants to do, e.g. 'search the web', 'work with PDFs', 'query postgres'
limitnumberNoHow many candidates to return (default 3)
clientenumNoTarget client for the install command: claude, cursor, desktop, codex or npxclaude | cursor | desktop | codex | npx

Details

From the project README

tashan CLI

The trusted directory for your agent's toolbox, in your terminal. Checks what you run against tashan.sh, which measures every MCP server, plugin and skill it can find on public evidence: npm, GitHub, OSV and the MCP registry. Nobody can pay for a position in it.

npx tashan-cli                 # check the toolbox you already have (the default)
npx tashan-cli info context7   # should I install this? The verdict first, then the evidence
npx tashan-cli search database # find capabilities, ranked on public evidence

What tashan (doctor) tells you

  • What needs attention. Anything deprecated, archived, abandoned, removed from the registry, malicious, or carrying a known advisory. It gives the advisory id, the version that fixes it, and the exact command a package runs at install time.
  • Your stack, scored. Each server, plugin and skill we measure gets its tashan score, where it stands in its category ("above 98% of browser"), and the evidence behind the score: publisher, downloads, stars, provenance, documentation grade.
  • What you use. From your local Claude Code history: which servers were called in the last 30 days, which were never called, and how many skills you use. Only tool names and dates are read, and nothing leaves the machine. Cursor and Claude Desktop keep no such record, so they get no usage figure. That is not a zero.
  • What it can reach. The permission surface your agent carries (files, network, browser, shell, credentials), and which tools can bring third-party text into the model's context. This comes from declared dependencies; nothing is executed.
  • What changed. Ownership changes, new install scripts, widened permissions and abandonment in the last 30 days, for the things you run. These are the same events as tashan.sh/changes.html.
  • What you have. Counts across every project, what arrived since the last run, and which skills no plugin maintains.

Exit code 2 when something needs attention, so it can gate CI.

tashan Pro

Every finding above is free, in full. Pro adds time: the daily score series behind each capability you run, drawn as a sparkline with its direction. When something you depend on dies, Pro names the measured replacement. $6/mo, 7 days free: tashan.sh/pricing. Sign in with tashan login; in CI, set TASHAN_KEY=<key>.

Flags

  • --all: list every item, including the ones no public record describes
  • --json: machine-readable output (pipe into jq)
  • --limit <n>: cap the rows for search (default 20)
  • --client <c>: claude · cursor · desktop · codex · npx (for add)

How it works

Zero dependencies, Node ≥ 18. It reads the public index at tashan.sh/data/lookup.json and your local config. Your config is never uploaded. Every score can be re-derived from public evidence.

TASHAN_DATA=<path> reads a local index.json instead of the network (dev/offline); TASHAN_SITE=<url> points at a different deployment.

node tashan.test.mjs        # pure-logic tests, no network

Comments

Markdown supported

New to MCP?

From what the protocol is to installing your first server, these answers cover most first questions.

An open protocol that defines how AI applications connect to external tools and data in a uniform way. Clients talk to the model; MCP servers provide tools, resources and prompt templates. They exchange standard messages, so one server can be reused by many clients.