B+

app.tascan.io

https://app.tascan.io/mcp
89/100 · MCP Trust Grade · checked 3d ago · MCP 2025-06-18

Is the app.tascan.io MCP server safe to use?

Independent trust grade B+ (89/100). No blocking issues found in the static + spec checks. wmcp.sh continuously watches app.tascan.io for tool drift and rug-pulls. The grade is free and identical whether or not the operator pays.

⚠ Rug-pull watch: this server's tool surface has changed 3× since baseline — last 3d ago. Continuously watched by wmcp.sh for drift & rug-pulls.

What it offers — 142 tools · Developer Tools

tascan_list_projects

List TaScan projects in the organization (each with its number, e.g. P-00001, external_refs, report_options and its calendar_url, webcal_url, map_url

tascan_create_project

Create a new TaScan project (top-level container for events). number is optional (the next P-number is assigned when omitted; a number already used in

tascan_get_project

Get details of a specific project

tascan_update_project

Update a project (name, location, status, dates, number, external_refs, labor_rules, report_options). A number already used in the org is refused 409;

tascan_delete_project

Delete a project that has NO history, after typing its name. Refused 409 project_has_history (with the counts) when it has any task or subtask complet

tascan_create_event

Create a new event (task list) within a project. Supports team_mode (shared completions) and multi_instance (each worker gets isolated copy — great fo

tascan_list_events

List all events (task lists) within a project

tascan_get_event

Get details of a specific event (task list) including its tasks

tascan_update_event

Update an event / task list (name, description, team_mode, multi_instance, timer_mode). team_mode and multi_instance cannot both be true.

tascan_delete_event

Delete an event (task list) and all its tasks and completions. This action is irreversible.

tascan_add_tasks

Add one or more tasks to an event (task list). Supports bulk creation. IMPORTANT: Set response_type correctly — use "text" for info collection (names,

tascan_get_signature_bundle

Fetch the signature bundle for one signed document by signature assertion id (the signature_assertion_id inside the response value of a completed sign

tascan_dispatch_to_agent

PREFERRED tool for sending work to an AI agent. Dispatches a task to the agent's inbox — picked up and executed automatically. No list ID needed. REQU

tascan_list_agents

List all registered AI agents with their capabilities, inbox IDs, and status. Like reading input labels on a video matrix — discover which agents are

tascan_register_agent

Register a new AI agent in the agent registry. The agent will appear in tascan_list_agents and can receive dispatched tasks. Self-registration for AI

tascan_list_tasks

List the tasks in an event (task list). status "open" returns only tasks with no completion yet: use it when checking for work to do, so a long list i

tascan_get_task

Get details of a specific task including completions and subtasks. Each completion carries photo_url (raw storage path, stable) and photo_signed_url (

tascan_get_receipt

Fetch the signed Action Receipt (Ed25519 JWS) for one completed task by completion_id (tascan_get_task -> completions[].id). Returns a readable summar

+124 more tools

Spec conformance20%100
Security (OWASP MCP)30%100
Reliability / performance20%84
Tool hygiene15%56
Transparency / provenance15%90

Observed behavior

No proxied traffic observed for this host yet. Connect it at /connect and its grade gains a measured Reliability score + per-tool behavioral evidence — the half a static scan can't produce.

Findings

No blocking issues found in the static + spec checks.
Grade another server

We re-grade app.tascan.io on a schedule and alert your Slack/webhook the moment its tools change or its grade drops — rug-pull insurance for the connection.

Run app.tascan.io? Claim it (free) to get drift alerts and show an independently-verified trust badge. The grade stays free — claiming just ties it to you.

Share this report card

A 1200×630 card with the grade + audit — drop it in a post, Slack, or your repo.

MCP Trust report card — app.tascan.io grade B+
Share on X Open card image

Embed this grade

A live badge — it re-verifies itself and shows current stability. Static scorecards can't. Paste it in your README or site to show users you're independently audited.

MCP Trust Grade B+ · wmcp.sh
[![MCP Trust Grade B+](https://wmcp.sh/mcp/grade/app.tascan.io/badge.svg)](https://wmcp.sh/mcp/grade/app.tascan.io)
<a href="https://wmcp.sh/mcp/grade/app.tascan.io"><img src="https://wmcp.sh/mcp/grade/app.tascan.io/badge.svg" alt="MCP Trust Grade B+ · wmcp.sh"></a>

Agents: check this before connecting

Add the wmcp.sh trust oracle as an MCP server and call grade_mcp_server / check_mcp_drift in your agent's pre-connection gate:

https://wmcp.sh/mcp/trust
How this grade is computed. An open, independent rubric — Spec conformance (20%), Security mapped to the OWASP MCP Top 10 (30%), Reliability (20%), Tool hygiene (15%), Transparency (15%) — run by connecting to the server and inspecting its real MCP surface. The grade is free and identical whether or not the operator pays. v1 uses static + spec signals from a single connection; continuous uptime, real latency, and annotation-truthing (declared readOnly vs observed behavior) layer on via the wmcp.sh proxy.