Taplid

io.github.taplidPublished by GitHub account taplidv1.0.1Updated Oct 24, 2026

Audit AI responses and artifacts with ALLOW, REVIEW, or BLOCK decisions and trust scores.

VerifiedSTDIODesktop onlyDeveloper ToolsSecurity & Monitoring

Overview

AI-generated overview

Taplid audits AI responses and structured artifacts, returning ALLOW, REVIEW or BLOCK decisions with trust scores, and can retrieve and verify saved audits.

What you can do
Run Standard or Artifact audits against supplied context, schema, code, config or policy, returning ALLOW, REVIEW or BLOCK decisions with trust scores. Validate structured artifacts such as JSON Schema, SQL/DDL, Docker and Kubernetes YAML, Terraform/IaC, API and CORS contracts, and security or auth-header rules. Check AI code reviews, implementation plans and agent workflow claims against the material they reference. Retrieve a persisted public audit result by its audit ID. Verify a saved audit's signed attestation, issuer, signed fields and result hash.
When to use it
Useful when an assistant produces code, configs, schemas or review claims that need a pass/fail gate before being trusted or shipped, or when you want to confirm that a saved audit result is authentic and unaltered.
Requirements
Runs as a local stdio process from the npm package @taplid/mcp, so Node.js is needed. The TAPLID_API_KEY environment variable is required for running audits; retrieval and verification do not need a key. An optional TAPLID_API_URL variable overrides the default API base URL. Network access to the Taplid API is required.
Before you install
The TAPLID_API_KEY secret is sent to the Taplid service, and the content you submit for auditing (code, configs, schemas, policies, review claims) is sent to that third-party API. Audits may be persisted as retrievable public results, so avoid submitting secrets or sensitive material. The optional TAPLID_API_URL override redirects requests to another endpoint, so only point it at a trusted host.

Installation

In SourceWeft

  1. Open Taplid in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Desktop only via STDIO. STDIO servers start a local process, so they need the SourceWeft desktop host.

Other MCP clients

Follow the launch instructions in the repository.

README

Taplid

Audit AI outputs and validate structured artifacts before you trust them.

Taplid checks LLM responses, AI code reviews, SQL, Docker, Kubernetes YAML, JSON Schema, API contracts, configs, security rules, and technical review claims against supplied context, schema, code, config, or policy.

Start here

What Taplid does

Taplid has three core operations:

  1. Run an audit
    Run a Standard or Artifact audit against supplied context, schema, code, config, or policy.

  2. Retrieve an audit
    Retrieve a persisted public audit result by auditId.

  3. Verify an audit
    Verify the signed attestation, issuer, signed fields, and result hash for a saved audit.

Artifact and schema validation

Artifact mode works as a schema checker, config validator, SQL schema checker, Docker/Kubernetes checker, API contract validator, and AI code-review verifier.

Use it for:

  • JSON Schema and structured output checks
  • SQL schema and DDL validation
  • Docker, Kubernetes YAML, and Terraform/IaC checks
  • API, HTTP, CORS, and policy contract checks
  • Security, secrets, credentials, and auth-header checks
  • AI code reviews, implementation plans, and agent workflows

Packages

PackagePurpose
@taplid/clientServer-side SDK
@taplid/cliLocal and CI audit checks
@taplid/mcpMCP server for Claude, Cursor, OpenAI-compatible agents, and other MCP clients

Documentation

The full integration guide, code examples, response format, CLI commands, MCP setup, OpenAI-compatible usage, retrieval, and verification examples are maintained here:

https://taplid.com/docs

This README intentionally stays small so the official documentation remains the source of truth.

Source: README.md at commit a93c8ae

Tools

0
SourceWeft has not started this package in its sandbox yet, so its tools are not known.

Version history

1
  1. v1.0.1LatestSep 16, 2026

Score

40% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 days25 pts

    Keep the endpoint answering the MCP handshake; SourceWeft probes it every 30 days.

  • Auth declared10 pts

    Declare the credential headers in the registry entry, or keep the endpoint answering the probe so its auth can be classified.

  • Tools listed15 pts

    Answer tools/list without a credential, or ship a package that starts in a sandbox without one.

  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts

    Declare a license in the repository or the registry entry.