TAR Engine for VS Code

io.github.qingxuantang/tar-engine

Audit AI skill safety before you ship. Static, semantic, adversarial, supply chain scans.

client:VS Code transport:stdio runtime:pypi

Install TAR Engine in VS Code

.vscode/mcp.json

{
  "inputs": [
    {
      "type": "promptString",
      "id": "tar-engine-url",
      "description": "TAR_ENGINE_URL",
      "password": true
    },
    {
      "type": "promptString",
      "id": "tar-engine-byok-openai-key",
      "description": "TAR_ENGINE_BYOK_OPENAI_KEY",
      "password": true
    },
    {
      "type": "promptString",
      "id": "tar-engine-byok-anthropic-key",
      "description": "TAR_ENGINE_BYOK_ANTHROPIC_KEY",
      "password": true
    }
  ],
  "servers": {
    "tar-engine": {
      "type": "stdio",
      "command": "uvx",
      "args": [
        "tar-engine"
      ],
      "env": {
        "TAR_ENGINE_URL": "${input:tar-engine-url}",
        "TAR_ENGINE_BYOK_OPENAI_KEY": "${input:tar-engine-byok-openai-key}",
        "TAR_ENGINE_BYOK_ANTHROPIC_KEY": "${input:tar-engine-byok-anthropic-key}"
      }
    }
  }
}

VS Code prompts for each input the first time the server starts, so no secret is written to the file. VS Code docs

TAR Engine in other clients

TAR Engine MCP server