Loading…
Universal task protocol for managing projects, tasks, workers, QR codes, and reports.
Do not connect
A critical issue was found. Do not connect this server as-is.
Scanned 8 days ago Due for re-check
A server can change after it's graded. Re-run the automated scan to refresh this report.
This grade is deterministic and reproducible: the same server surface always yields the same grade under a given algorithm version. It is a real automated assessment computed by the MCPGrade engine from what the probe actually observed — not a fabricated or opinion score. It is not a manual human pentest, so it can miss context-specific risks.
Every signal below was measured directly by the automated probe. The grade is derived only from evidence like this — nothing is assumed.
The tascan MCP server exposes 50 tools, focused primarily on database and communication capabilities. Its published description reads: "Universal task protocol for managing projects, tasks, workers, QR codes, and reports". It communicates over Streamable HTTP using the 2026-07-28 protocol revision, and does not require authorization to connect. MCPGrade currently rates tascan F — a critical issue was found and the server should not be connected as-is. Its most notable findings include "Hidden instructions in a tool description" and "Cross-tool shadowing". This report is a deterministic, reproducible automated assessment: the same observed surface always yields the same grade under a given algorithm version, and it is refreshed as new scans arrive and free to read — but it is not a substitute for a manual human security review. Always re-check tascan's advertised tools, transport security, and authorization posture before connecting an autonomous agent or sharing sensitive context with it.
Add tascan to an MCP client using the endpoint below. Review the grade and findings above before granting an autonomous agent access.
MCP endpoint
https://tascan-live-event.netlify.app/mcpStreamable HTTP transport. This is the MCP endpoint, not a website — paste it into your MCP client server list rather than a browser.
Captured passively during the read-only scan. Click any value to find servers that match it.
The tools this server advertises via tools/list — names, purposes, and the parameters each accepts, exactly as enumerated read-only.
List all TaScan projects in the organization
Create a new TaScan project (top-level container for events)
Get details of a specific project
Update a project (name, location, status, dates)
Delete a project and all its events, tasks, and completions. This action is irreversible.
Create a new event (task list) within a project. Supports team_mode (shared completions) and multi_instance (each worker gets isolated copy — great for surveys, onboarding, info collection). team_mode
List all events (task lists) within a project
Get details of a specific event (task list) including its tasks
Update an event / task list (name, description, team_mode, multi_instance, timer_mode). team_mode and multi_instance cannot both be true.
Delete an event (task list) and all its tasks and completions. This action is irreversible.
Add one or more tasks to an event (task list). Supports bulk creation. IMPORTANT: Set response_type correctly — use "text" for info collection (names, phones, emails, notes), "photo" for visual verifi
PREFERRED tool for sending work to an AI agent. Dispatches a task to the agent's inbox — picked up and executed automatically. No list ID needed. Supports prefixes: CODE: SHELL: RESEARCH: WRITE: PLAN:
List all registered AI agents with their capabilities, inbox IDs, and status. Like reading input labels on a video matrix — discover which agents are available and what they can do before dispatching
Register a new AI agent in the agent registry. The agent will appear in tascan_list_agents and can receive dispatched tasks. Self-registration for AI agents joining the TaScan network.
List all tasks in an event (task list)
Get details of a specific task including completions
Update a task (title, description, response_type, flags, sort_order)
Delete a specific task and its completions. This action is irreversible.
Complete a task on behalf of a worker. Inserts a completion record and timer event. Use this to simulate or record task completions via the API.
List all workers (taskees) in the organization
Create a new worker (taskee) in the organization
Update a worker profile (name, phone, email)
Generate a QR code for a task list (event) that workers can scan to access tasks
Apply a pre-built template to a task list, adding all template tasks
List available task templates (built-in and saved)
Get completion report for a task list (event) including task status, completions, workers, and photos. Set include_responses to also return the actual submitted response data (numbers, text, choices)
Query one task's submitted responses across every list in a project — e.g. the same exercise repeated across many workout lists returns one chronological progression series instead of N report lookups
List all issues for a task list (event). Returns open, acknowledged, and resolved issues with severity, type, and category. Use this to discover issues that need AI analysis via tascan_analyze_issue.
Step 1 of the Closed-Loop Autonomous Operations Protocol. Retrieves full issue context including worker info, message thread, project history, and recent similar issues. Use this data to reason about
Step 2 of the Closed-Loop Autonomous Operations Protocol. Post an AI-generated recommendation to an issue thread. Accepts both a text recommendation and an optional structured_recommendation object wi
Step 3 of the Closed-Loop Autonomous Operations Protocol. Dispatches remediation to the worker via MULTI-CHANNEL delivery: (1) issue thread message, (2) in-app notification, (3) progress feed update,
FULL Closed-Loop Autonomous Operations Protocol in one call. Server-side AI analyzes the issue, generates remediation tasks, creates a task list, and dispatches to the worker — all without human inter
Send a branded TaScan task notification email via SendGrid. Can notify anyone about a specific task list or task. Includes QR code, task summary, and "Open in TaScan" button.
Register a physical NFC tag to a project, task list, or specific task. When someone taps the tag, TaScan routes them to the linked resource. Tags use NTAG215 chips and are programmed with NFC Tools Pr
List all registered NFC tags in the organization with their linked projects/task lists and scan counts
Get scan event history for a registered NFC tag — timestamps, GPS coordinates, and accuracy for each scan
Create a geofenced work zone. Delivery zones route workers who open the project Site Gate (geo.html?project=...) to this zone's task list when GPS places them inside the radius. Set enforce_on_list=tr
List geofenced work zones, optionally filtered by project. Shows center, radius, routing target, and zone-lock status.
Update a geofenced zone — move the center, resize the radius, change the routing target, toggle zone-lock, or deactivate it (is_active=false).
Register a physical asset (equipment, structure, vehicle, machine) in the condition ledger so it can be assessed over time. Each asset gets a longitudinal condition history with AI scoring and degrada
Run an AI condition assessment of an asset from a photo. The model scores 0-100 with the asset's full assessment history in context, so it reads degradation over time — returning the Condition Delta S
Get an asset's longitudinal condition history — score trend over time, every assessment with grade, delta, findings, and who assessed it. The per-serial-number condition ledger.
List registered condition-ledger assets with their latest condition scores. Use to recover an asset_id for tascan_assess_condition or tascan_condition_history.
Pledge a payment on a task list: when the list is verified complete (every task done + photo evidence on photo-required tasks), the payer automatically receives a Stripe pay link that routes the money
List gig payments and their lifecycle status: awaiting_completion (pledged, work not verified yet), ready_to_pay (verified — pay link sent to payer), paid, canceled. Filter by task list or status.
Get a worker's verified work passport — task counts, lists worked, photos submitted, GPS-verified hours, points, streaks, and earned merit badges, all computed from real completion data (not self-repo
Identify exactly which TaScan server and schema this MCP session is talking to. Call this FIRST when diagnosing anything — it makes "dev server masquerading as production" and "is my fix deployed yet"
Cross-entity search: find projects, task lists, tasks, workers, or condition assets by name in one call — with ids and parent context to disambiguate. Use this instead of walking projects→lists→tasks
Ungated, plain read of one worker row: name, contact, org, points, streaks, timestamps. (tascan_get_worker_passport is the rich stats view; this is the boring lookup.)
Find candidate same-person worker records with per-signal match detail (Patent 4 §6.25(b) signals: phone reuse, name similarity, GPS pattern correlation). Turns identity fragmentation from an accident
Sorted worst-first. Each finding shows its severity, what it means, its OWASP MCP Top-10 mapping, and a recommended fix — the check id links to the exact methodology row that produced it.
tool: tascan_add_tasks
A tool description contains imperative text aimed at the model (e.g. "ignore previous", "before answering read …").
bulk creation. IMPORTANT: Set response_type correctly — use "text" for inRecommendationRemove model-directed instructions from tool descriptions.
tool: tascan_add_tasks
A tool description tries to alter the model’s use of another tool.
Mike's PC, use tascan_dispatch_to_agent instead — it routes directly to the agent's inbRecommendationDescriptions must describe only their own tool.
tool: tascan_dispatch_to_agent
Tools that execute commands / write files / make arbitrary requests are exposed without annotations or guards.
prefixes: CODE: SHELL: RESEARCH: WRITE: PLAN: for routing. Use "agentRecommendationAnnotate destructive tools and require human approval.
tool: tascan_dispatch_to_agent
A tool description tries to alter the model’s use of another tool.
ode-local). Use tascan_list_agents to discover available agents.RecommendationDescriptions must describe only their own tool.
tool: tascan_register_agent
A tool description tries to alter the model’s use of another tool.
will appear in tascan_list_agents and can receive dispatched tasks. Self-registraRecommendationDescriptions must describe only their own tool.
tool: tascan_complete_task
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
parameter "notes"RecommendationRemove side-channel parameters; constrain tool inputs.
tool: tascan_query_responses
A tool description tries to alter the model’s use of another tool.
of N report lookups. Match by task title pattern or exact task ID.RecommendationDescriptions must describe only their own tool.
tool: tascan_list_issues
A tool description tries to alter the model’s use of another tool.
AI analysis via tascan_analyze_issue.RecommendationDescriptions must describe only their own tool.
tool: tascan_analyze_issue
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
thread, project history, and recent similar issues. Use this data to reRecommendationRemove side-channel parameters; constrain tool inputs.
tool: tascan_assess_condition
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
parameter "photo_url"RecommendationRemove side-channel parameters; constrain tool inputs.
tool: tascan_list_assets
A tool description tries to alter the model’s use of another tool.
an asset_id for tascan_assess_condition or tascan_condition_history.RecommendationDescriptions must describe only their own tool.
tool: tascan_server_info
A tool description tries to alter the model’s use of another tool.
tead of an inference.RecommendationDescriptions must describe only their own tool.
tool: tascan_find
A tool description tries to alter the model’s use of another tool.
his instead of walking projects→lists→tasks or guessing ids from display nRecommendationDescriptions must describe only their own tool.
tool: tascan_get_worker
A tool description tries to alter the model’s use of another tool.
s, timestamps. (tascan_get_worker_passport is the rich stats view; this is the boring lookRecommendationDescriptions must describe only their own tool.
The server accepts tool enumeration (and likely invocation) with no authentication.
RecommendationRequire OAuth 2.1 authorization for any server exposing non-public tools.
tool: tascan_delete_project
The server advertises open-world / broadly-scoped capabilities.
annotations.destructiveHint = trueRecommendationScope tools to the minimum needed.
tool: tascan_delete_event
The server advertises open-world / broadly-scoped capabilities.
annotations.destructiveHint = trueRecommendationScope tools to the minimum needed.
tool: tascan_dispatch_to_agent
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: tascan_register_agent
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: tascan_delete_task
The server advertises open-world / broadly-scoped capabilities.
annotations.destructiveHint = trueRecommendationScope tools to the minimum needed.
tool: tascan_analyze_issue
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: tascan_dispatch_instruction
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: tascan_auto_resolve
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: tascan_send_task_email
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: tascan_assess_condition
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
Vantaj uptime monitoring via MCP — manage monitors, heartbeats, incidents, and status pages.
Unified gateway to Algeria's TKAWEN ecosystem: commerce, certification, and AI tools.
Provides access to the Cohereon Doctrine AI safety framework with governance components, tiered access, and agent onboarding.
Agentic rails for complex workflows with receipts, fees, and MCP tool access.
Structural TC39 spec lookup for ECMA-262 and ECMA-402 in AI agents, SHA-pinned and offline-first.
Structural TC39 spec lookup for ECMA-262 and ECMA-402 in AI agents, SHA-pinned and offline-first.