TAPD MCP Server (sun-jingtao/tapd-mcp-server) is an MCP server listed on the M8ven Trust Index. It scores 64 out of 100, grade C. It declares 18 tools. No publisher has claimed this listing.

C
Caution
64/100

TAPD MCP Server

Enables managing TAPD (Tencent Agile Product Development) bugs, requirements, PRD reviews, and test reports directly from IDE via natural language, with cross-project aggregation and built-in workflows.

Caution. Specific findings reduced this grade. They are listed on the page. Grades reflect the full trust pyramid: code, verification depth, and reputation. New projects cap at C until adoption is earned.

How we verified

Code Verified⚡ Live Monitored: not connected

Verified is a snapshot. Live keeps it current, and builds your track record.

⚡ Connect GitHub → continuous verification on every pushwhy connect →

Who stands behind it

sun-jingtao

Source: Glama · also listed on npm

Is this your MCP?

Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find. Or connect your repo for our deepest verification, Live Monitored: read-only, revoke anytime. What we access →

Install from

The grade above is for the source repository. Registries can serve a different version, so we mark the ones we were not able to read.

// key findings
⚠️
Known vulnerabilities in dependencies: 3 high
Affects packages this MCP installs at runtime. Upgrade or remove the affected dependency.
18 tools verified — handlers match their declared behaviour
10 read-only tools verified — handlers contain no write/delete/exec
No credential exfiltration, no sensitive file access, no obfuscation
Static analysis found nothing flowing your secrets to unexpected places.
Open source with a license and README
Anyone can audit the code, the license is declared, and the publisher documents what it does.
🔐
You'll be asked for 1 credential: TAPD_ACCESS_TOKEN
These are read from process.env at runtime. Make sure you trust where they’ll be sent.
// tools this server exposes18 tools

These names and descriptions are the publisher's own, read from the source code. We print them as written. Our assessment is the findings above, not this list.

tapd_list_bugs

查询 TAPD bug 列表,默认查询当前登录用户负责的缺陷;传入 current_owner 可查询指定处理人名下的缺陷。传入 id 或 story_id 时不限处理人(story_id 返回该需求全部处理人名下的关联缺陷),可查到已转给他人的缺陷;显式传入 current_owner 时再按该处理人取交集。传入 workspace_id 时只查该项目;不传 workspace_id 时会聚合处理人参与的所有项目的缺陷(按 story_id 过滤时仍需具体项目)。支持按字段过滤:缺陷 ID、关联需求、标题、描述、状态、报告人、处理人、创建时间,以及优先级、严重程度、中文状态、标签、迭代、模块

tapd_list_bug_changes

查询 TAPD bug 变更历史。bug_id、created 与 id 至少提供一个;可按变更人、变更字段过滤并自定义排序,include_add_bug=true 时返回创建缺陷的记录。状态变更会附带项目工作流中文名(如「接受/处理(in_progress) => 已解决(resolved)」)。

tapd_create_bug

在 TAPD 中创建一个已确认的新 bug,可选关联到指定需求,支持设置处理人、优先级、严重程度、模块、版本、迭代、排期、各类人员(测试/开发/参与人等)、工时、模板、自定义字段等。创建前建议先用 tapd_search_users 确认处理人的 nick;不传处理人则默认指派给当前登录用户。

tapd_get_bugs

批量获取多个 TAPD bug 的完整内容,包括描述、复现步骤、评论、附件、图片和视频等详细信息。状态会附带项目工作流中文名(如「已解决(resolved)」)

tapd_writeback

对 TAPD bug 执行一个或多个已确认操作:回填评论、更新标题、更新描述正文、更新状态、更新处理人,以及更新优先级、严重程度、模块、版本、迭代、排期、各类人员、工时、标签等标准字段和自定义字段。各功能相互独立且可自由组合,至少提供 comment、title、description、target_status、target_owners、标准字段或 custom_fields 之一。注意:各动作分多次请求提交、非事务,可能出现部分成功(结果会逐项标明成功/失败)。

tapd_upload_bug_attachment

把文件上传到指定缺陷的附件区(支持 png/jpg/mp4 等任意类型,单文件 ≤250MB)。文件内容用 base64 传入(Agent 通常无本地路径)。录屏、视频等应走此工具而非内嵌描述。上传后可用 tapd_get_bugs 在附件区核对。

tapd_upload_bug_image

上传图片到 TAPD 并返回 html_code(<img> 片段),用于嵌入缺陷描述。仅支持 png/gif/jpg/jpeg/bmp、单张 ≤5MB。本工具只上传图片、不修改描述:拿到 html_code 后需自行用 tapd_get_bugs 取原描述、拼接后再调 tapd_writeback 的 description(或直接用 tapd_append_bug_description_image 一步完成)。

tapd_append_bug_description_image

一步完成:上传图片 → 读取缺陷当前描述 → 把图片追加到描述末尾后整体回写。先读后写避免覆盖原有正文。仅支持 png/gif/jpg/jpeg/bmp、单张 ≤5MB。图片上传成功但描述写入失败时会明确提示(此时图片已上传,可改用 tapd_writeback 手动写回)。

tapd_call_api
tapd_list_stories

查询 TAPD 需求列表,默认查询当前登录用户负责的需求;传入 owner 可查询指定处理人名下的需求。传入 id 精确查询时不限处理人,可查到已转给他人的需求。传入 workspace_id 时只查该项目;不传 workspace_id 时会聚合处理人参与的所有项目的需求。支持按字段过滤:需求 ID、名称、描述、状态、创建人、处理人、创建时间,以及优先级、标签、版本、模块、迭代、分类、排期/修改/完成时间、父子需求、特性、技术风险、需求类别、发布计划、规模、测试重点、抄送/开发人、来源/类型、工时、自定义字段等,并可自定义排序(order)。返回的状态会附带项目工作流中文名(如「已实现(re

tapd_list_story_changes

查询 TAPD 需求变更历史和字段级变更详情。story_id、created 与 id 至少提供一个;可按变更人、变更字段、变更类型过滤并自定义排序;include_details=true 时返回 field_changes 变更详情。

tapd_create_story

在 TAPD 中创建一个已确认的新需求,支持设置处理人、优先级、迭代、父需求、标签、排期、工时、自定义字段等。创建前建议先用 tapd_search_users 确认处理人的 nick;不传处理人则默认指派给当前登录用户。

tapd_list_story_test_cases

查询指定 TAPD 需求直接关联的所有测试用例,支持按用例名称和状态在本地过滤

tapd_get_stories

批量获取多个 TAPD 需求的完整内容,包括描述、评论、附件、图片和视频等详细信息。状态会附带项目工作流中文名(如「已实现(resolved)」)

tapd_writeback_story

对 TAPD 需求执行一个或多个已确认操作:回填评论、更新描述正文、更新状态、更新处理人,以及更新标题、优先级、迭代、版本、工时、标签等标准字段和自定义字段。各功能相互独立且可自由组合,至少提供 comment、description、target_status、target_owners、标准字段或 custom_fields 之一。注意:各动作分多次请求提交、非事务,可能出现部分成功(结果会逐项标明成功/失败)。

tapd_list_workspaces

查询指定用户参与的所有 TAPD 项目(workspace),默认查询当前登录用户。默认过滤掉 category=organization 的公司/组织条目,只返回可用于查询缺陷和需求的具体项目。当用户名下存在多个 workspace_id 时,可先用此工具拿到全部项目 ID;tapd_list_bugs / tapd_list_stories 在不传 workspace_id 时即会跨这些项目聚合查询。

tapd_list_iterations

查询 TAPD 项目迭代列表,支持按迭代 ID、名称、状态过滤,以及描述、起止时间、迭代类别、计划应用、创建人、创建/修改/完成时间、锁定人、自定义字段等,并可自定义排序(order)与翻页;用于创建或更新需求时选择 iteration_id

tapd_search_users

按姓名、TAPD nick 或邮箱搜索项目成员。需要更新 bug 处理人前,应先用该工具确认目标处理人的 nick。

// known CVEs in dependencies3 high

Disclosed vulnerabilities in this server's declared npm dependencies (via OSV). Whether each is reachable depends on the installed versions.

high@modelcontextprotocol/sdk@1.12.1GHSA-345p-7cg4-v4c7

@modelcontextprotocol/sdk has cross-client data leak via shared server/transport instance reuse

high@modelcontextprotocol/sdk@1.12.1GHSA-8r9q-7v3j-jr4g

Anthropic's MCP TypeScript SDK has a ReDoS vulnerability

high@modelcontextprotocol/sdk@1.12.1GHSA-w48q-cv73-mx4w

Model Context Protocol (MCP) TypeScript SDK does not enable DNS rebinding protection by default

Depend on this server? Get alerted when its CVEs change.Watch this server free →
// environment variables
To run this server yourself, you supply these values. They go in your own MCP client configuration and stay on your machine. The secret label means the value is sensitive, not that the server mishandles it.
🔐 secretTAPD_ACCESS_TOKEN"": "你的访问令牌"
configTAPD_ALLOW_RAW_WRITE可选,默认关闭。设为 true 后才允许 tapd_call_api 发起 POST 写操作(每次调用仍需你在对话中确认),详见下文「通用透传」
Deployment configuration, supplied by whoever hosts the server. Users are not asked for these.
deployTAPD_MCP_SENTRY_DSN
// quality suggestions

Tool annotations

11/18 tools have annotations

Add readOnlyHint or destructiveHint annotations to every tool so hosts can warn users before invoking.

All four hints declared on every tool

18/18 tools missing one or more hints — tapd_list_bugs (missing: destructiveHint, idempotentHint, openWorldHint); tapd_list_bug_changes (missing: destructiveHint, idempotentHint, openWorldHint); tapd_create_bug (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint), +15 more. OpenAI's directory rejects tools where any of the four hints are missing or non-boolean.

For every tool, set all four hints (readOnlyHint, destructiveHint, idempotentHint, openWorldHint) to explicit true/false values that match the handler’s actual behaviour.

Production dependencies are patched

0 critical, 3 high severity in production deps — @modelcontextprotocol/sdk@1.12.1 (high), @modelcontextprotocol/sdk@1.12.1 (high)

Run npm audit fix, or upgrade the affected packages to a non-vulnerable version.

Claim the listing to review these findings one by one and send us a correction where you disagree, straight to the team. Claiming also means we tell you when the grade moves, and reach you first if we find anything urgent.

// full audit trail
The findings above are the summary. The full trail, every check we ran, each deduction, the network hosts observed and the dependency advisories, goes to verified publishers, along with an alert whenever a new one lands. Verified publishers can also review each finding and dispute it in one click. Publisher corrections have sharpened several of our checks this month, because the maintainer knows the codebase better than any scanner.
// improvement guidance — verified publishers only
We have 3 concrete improvements we can share with the publisher of this MCP. Each comes with specific guidance to raise the trust score.
// embed badge in your README
[![M8ven Verified](https://m8ven.ai/badge/mcp/sun-jingtao/tapd-mcp-server?variant=verified)](https://m8ven.ai/mcp/sun-jingtao/tapd-mcp-server)
Shows verification status without the grade. Want the grade badge instead? Remove ?variant=verified from the URL.
commit: 813783466eff9fee26a73d3223985666806c3780
code hash: 0e6a3f183aef5b0b1f736b5bc81e1ae419ff408f26f81b221182fc3cab80adeb
view raw JSON →
Check MCPs from inside your assistant
Tool Check · MCP

Vetting this one by hand? Tool Check is an MCP that scores other MCPs. Add it once and ask Claude, ChatGPT, or any MCP client to grade a server, surface CVEs, check the publisher, and suggest safer alternatives — before you install.

https://m8ven.ai/api/mcp/tool-check
check_toolsearch_toolscompare_toolsrecommend_alternativescheck_publisherreport_concern
How to add it →Free · no account needed · works in any MCP client