Is Tarotap safe? Security scan and tools

Log in / Join

Tarotap

By Tarotap· tarotap.com

PluginRemote MCPHome & lifestyle Scan passed

Get

What we checked

Pinned tool set

History

Every scan of this listing, newest first.

Every rescan is logged, even when nothing changed.

When a server changes its tools

Nothing new reaches your agent until a person has looked at it.

1Ask the live serverWe connect the way your agent does and list its tools. We never call one.
2Pin every toolEach tool’s name, description and input schema is hashed, so any change shows up as a diff.
3Read it like an attackerRules look for hidden instructions, invisible text, credential grabs, download-and-run and data leaving.
4Hold what failsFlagged listings are taken down until a person reviews them, new versions included.

Scanned on every change, and again when our rules improve.

What we checked

Pinned tool set

History

Every scan of this listing, newest first.

Every rescan is logged, even when nothing changed.

Browse plugins, skills and use-case recipes by category.

All categories

Tarotap

By Tarotap· tarotap.com

PluginRemote MCPHome & lifestyle Scan passed

Get

Passed

Safe to install in every agent it supports. Runs remotely on tarotap.com · answering.

Download report (JSON)

Last scan: 47 min ago
Version scanned: 1.0.1
Tools pinned: 2
Tool changes: None since Oct 26

What we checked

We read every description in its 2 tools, from the live server, and the listing for 1.0.1. 6 checks, no findings.

Hidden instructionsNothing tells the agent to override its rules or keep things from you.
Passed
Invisible textNo invisible or direction-flipping characters.
Passed
Access to credentialsNo reaching for SSH keys, cloud credentials, wallets or the keychain.
Passed
Downloads and runs codeNo piping downloads into a shell or running encoded payloads.
Passed
Sends data outNo uploads of credential files or catch-all collection endpoints.
Passed
Leaked secretsNo API keys, tokens or private keys published by mistake.
Passed

Pinned tool set2

None change data · none can delete. Each tool is fingerprinted; every rescan compares against these hashes. Dashed access is read from the name.

Tool	Access	Description	Pinned hash
draw_cards	read	Draw Tarot Cards · Shuffle a full 78-card Rider-Waite-Smith deck with server-side randomness and show it face-down in an interactive widget, where the user picks their cards by hand. Where the widget renders, the tool result does not contain the drawn cards: the widget sends the cards the user picked to the conversation once the last one is revealed. In a text-only host the cards are drawn server-side and returned in the result. Takes a spread_id from list_spreads to draw into that spread's positions, or a card_count (1-10) for a free-form draw such as a single card of the day. Card names, position names and the widget text follow locale.	sha256:72c6…c585
list_spreads	read	List Tarot Spreads · List the tarot spreads available for a reading, with each spread's id, name, tagline, number of cards, and position names, in the requested language. The ids are the values draw_cards accepts as spread_id and are the same in every language.	sha256:e74c…8b46

Set pinned as sha256:1276…7da0 · still listed 48 min ago

What we checked

Pinned tool set

History

Every scan of this listing, newest first.

Oct 26, 2026 · Tools changedVersion 1.0.1 · no findings
Passed
Oct 25, 2026 · First scanVersion 1.0.1 · no findings
Passed

Every rescan is logged, even when nothing changed.

History

Every scan of this listing, newest first.

Every rescan is logged, even when nothing changed.

When a server changes its tools

Nothing new reaches your agent until a person has looked at it.

1Ask the live serverWe connect the way your agent does and list its tools. We never call one.
2Pin every toolEach tool’s name, description and input schema is hashed, so any change shows up as a diff.
3Read it like an attackerRules look for hidden instructions, invisible text, credential grabs, download-and-run and data leaving.
4Hold what failsFlagged listings are taken down until a person reviews them, new versions included.

Scanned on every change, and again when our rules improve.

Passed

Safe to install in every agent it supports. Runs remotely on tarotap.com · answering.

Download report (JSON)

Last scan: 47 min ago
Version scanned: 1.0.1
Tools pinned: 2
Tool changes: None since Oct 26

What we checked

We read every description in its 2 tools, from the live server, and the listing for 1.0.1. 6 checks, no findings.

Hidden instructionsNothing tells the agent to override its rules or keep things from you.
Passed
Invisible textNo invisible or direction-flipping characters.
Passed
Access to credentialsNo reaching for SSH keys, cloud credentials, wallets or the keychain.
Passed
Downloads and runs codeNo piping downloads into a shell or running encoded payloads.
Passed
Sends data outNo uploads of credential files or catch-all collection endpoints.
Passed
Leaked secretsNo API keys, tokens or private keys published by mistake.
Passed

Pinned tool set2

None change data · none can delete. Each tool is fingerprinted; every rescan compares against these hashes. Dashed access is read from the name.

Tool	Access	Description	Pinned hash
draw_cards	read	Draw Tarot Cards · Shuffle a full 78-card Rider-Waite-Smith deck with server-side randomness and show it face-down in an interactive widget, where the user picks their cards by hand. Where the widget renders, the tool result does not contain the drawn cards: the widget sends the cards the user picked to the conversation once the last one is revealed. In a text-only host the cards are drawn server-side and returned in the result. Takes a spread_id from list_spreads to draw into that spread's positions, or a card_count (1-10) for a free-form draw such as a single card of the day. Card names, position names and the widget text follow locale.	sha256:72c6…c585
list_spreads	read	List Tarot Spreads · List the tarot spreads available for a reading, with each spread's id, name, tagline, number of cards, and position names, in the requested language. The ids are the values draw_cards accepts as spread_id and are the same in every language.	sha256:e74c…8b46

Set pinned as sha256:1276…7da0 · still listed 48 min ago

History

Every scan of this listing, newest first.

Oct 26, 2026 · Tools changedVersion 1.0.1 · no findings
Passed
Oct 25, 2026 · First scanVersion 1.0.1 · no findings
Passed

Every rescan is logged, even when nothing changed.

What we checked

Pinned tool set

History

About

Ratings and reviews

Tarotap

What we checked

Pinned tool set

History

When a server changes its tools

What we checked

Pinned tool set

History

Browse plugins, skills and use-case recipes by category.

Tarotap

What we checked

Pinned tool set2

What we checked

Pinned tool set

History

History

When a server changes its tools

What we checked

Pinned tool set2

History

What we checked

Pinned tool set

History

About

Ratings and reviews

Security of Tarotap

What we checked

Pinned tool set

History

When a server changes its tools

What we checked

Pinned tool set

History

Browse plugins, skills and use-case recipes by category.

Security of Tarotap

What we checked

Pinned tool set2

What we checked

Pinned tool set

History

History

When a server changes its tools

What we checked

Pinned tool set2

History