tashan

sh.tashanPublished by tashan.shv0.1.4Updated Oct 24, 2026

Check any MCP server or agent skill before installing: upkeep, real adoption, and OSV advisories.

VerifiedSTDIODesktop onlyDeveloper ToolsSecurity & Monitoring

Overview

AI-generated overview

Checks MCP servers, plugins and skills before installation, reporting upkeep, adoption, advisories and permission surface.

What you can do
The tashan CLI inspects the MCP servers, plugins and skills you already run, or a named one you are considering, and reports what needs attention: deprecated, archived, abandoned, removed or malicious items and known advisories with the fixing version. It scores each item against public evidence such as publisher, downloads, stars, provenance and documentation grade, and shows the permission surface and which tools can pull third-party text into context. It also summarizes local usage from Claude Code history and recent changes such as ownership changes or new install scripts.
When to use it
Use it when deciding whether to install a given MCP server or skill, or when auditing the toolbox already configured in your agent. It is also useful in CI, since it exits with code 2 when something needs attention.
Requirements
Runs locally as an npm package via npx; Node 18 or higher and no dependencies. It reads the public index over the network by default, and can instead read a local index file or point at another deployment through environment variables. Pro features require signing in or setting an API key in CI.
Before you install
It reads local client configuration and Claude Code usage history (tool names and dates only, per the README, and nothing is uploaded). Pro is a paid subscription at $6 per month after a 7-day trial, and CI use requires the TASHAN_KEY environment variable. Findings come from declared dependencies and public records, so they are advisory rather than a guarantee.

Installation

In SourceWeft

  1. Open tashan in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Desktop only via STDIO. STDIO servers start a local process, so they need the SourceWeft desktop host.

Other MCP clients

Follow the launch instructions in the repository.

README

tashan CLI

The trusted directory for your agent's toolbox, in your terminal. Checks what you run against tashan.sh, which measures every MCP server, plugin and skill it can find on public evidence: npm, GitHub, OSV and the MCP registry. Nobody can pay for a position in it.

bash
npx tashan-cli                 # check the toolbox you already have (the default)npx tashan-cli info context7   # should I install this? The verdict first, then the evidencenpx tashan-cli search database # find capabilities, ranked on public evidence

What tashan (doctor) tells you

  • What needs attention. Anything deprecated, archived, abandoned, removed from the registry, malicious, or carrying a known advisory. It gives the advisory id, the version that fixes it, and the exact command a package runs at install time.
  • Your stack, scored. Each server, plugin and skill we measure gets its tashan score, where it stands in its category ("above 98% of browser"), and the evidence behind the score: publisher, downloads, stars, provenance, documentation grade.
  • What you use. From your local Claude Code history: which servers were called in the last 30 days, which were never called, and how many skills you use. Only tool names and dates are read, and nothing leaves the machine. Cursor and Claude Desktop keep no such record, so they get no usage figure. That is not a zero.
  • What it can reach. The permission surface your agent carries (files, network, browser, shell, credentials), and which tools can bring third-party text into the model's context. This comes from declared dependencies; nothing is executed.
  • What changed. Ownership changes, new install scripts, widened permissions and abandonment in the last 30 days, for the things you run. These are the same events as tashan.sh/changes.html.
  • What you have. Counts across every project, what arrived since the last run, and which skills no plugin maintains.

Exit code 2 when something needs attention, so it can gate CI.

tashan Pro

Every finding above is free, in full. Pro adds time: the daily score series behind each capability you run, drawn as a sparkline with its direction. When something you depend on dies, Pro names the measured replacement. $6/mo, 7 days free: tashan.sh/pricing. Sign in with tashan login; in CI, set TASHAN_KEY=<key>.

Flags

  • --all: list every item, including the ones no public record describes
  • --json: machine-readable output (pipe into jq)
  • --limit <n>: cap the rows for search (default 20)
  • --client <c>: claude · cursor · desktop · codex · npx (for add)

How it works

Zero dependencies, Node ≥ 18. It reads the public index at tashan.sh/data/lookup.json and your local config. Your config is never uploaded. Every score can be re-derived from public evidence.

TASHAN_DATA=<path> reads a local index.json instead of the network (dev/offline); TASHAN_SITE=<url> points at a different deployment.

bash
node tashan.test.mjs        # pure-logic tests, no network

Source: cli/README.md at commit d58ac0f

Tools

0
SourceWeft has not started this package in its sandbox yet, so its tools are not known.

Version history

1
  1. v0.1.4LatestSep 16, 2026

Score

40% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 days25 pts

    Keep the endpoint answering the MCP handshake; SourceWeft probes it every 30 days.

  • Auth declared10 pts

    Declare the credential headers in the registry entry, or keep the endpoint answering the probe so its auth can be classified.

  • Tools listed15 pts

    Answer tools/list without a credential, or ship a package that starts in a sandbox without one.

  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts

    Declare a license in the repository or the registry entry.