# Tada: automated QA for AI-written code (npm · tada-mcp) Your coding agent asks Tada to work through a feature in a real browser and gets back a verdict. - Trust score: 56/100 (low) - Change this week: +15 - Registry status: active - Liveness: live - Owner verified: no - Last scored: 2026-09-20 ## Components - npm · `tada-mcp`: 56/100 (this document), [markdown](https://verifymcp.io/servers/dev-taada-tada/tada-mcp.md), [page](https://verifymcp.io/servers/dev-taada-tada/tada-mcp) ## Channel facts - Registry: `npm` - Package: `tada-mcp` - Version: `0.1.44` - Transport: `stdio` ## Trust breakdown How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog) Scored 2026-09-20. - **Supply Chain Security**: 86/100 - No malware found by supply-chain analysis. - No known CVEs affecting this package version or its production dependencies. - Install-script check failed: the install command fetches or executes arbitrary code (inline_eval). An install hook runs on every machine, in CI, and on transitive installs, whether or not you ever run the server. - 42 of 127 dependencies flagged as unhealthy. - **Provenance & Transparency**: 6/100 - Repository check failed: no source repository is declared. - Provenance check failed: no build-provenance attestation is published. - License check failed: no license is declared. - Actively maintained (last published 1 days ago). - Security-disclosure policy not yet verified: we couldn't inspect the source repository. - **Schema Quality & AI Usability**: 59/100 - AI-judged instruction clarity (excellent). - Context-footprint check failed: tool/resource definitions use about 3549 tokens (~887/item across 4 items; 4 tools + 0 resources), over budget; trim descriptions and params. - Usage-examples check failed: none of the tools include examples. - **Stability & Change Management**: 0/100 - Stability not yet verified: not enough scan history yet (needs a 30-day window). - **Tool Coverage**: 100/100 - 100% of tools have a non-trivial description (not blank, and not just the tool's name). - 100% of tool parameters carry a description. - **Tool Safety**: 100/100 - No prompt-injection markers were found in the server instructions, tool names or descriptions we captured. - We read all 4 captured tool definition(s), and no name or description among them implies an irreversible operation. - An AI judge read all 4 captured unit(s) of tool text and found none that tries to manipulate the model reading it. - **Capabilities**: 100/100 - Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28. **Unverified: 1 category.** A category scored 0 because we could not verify it: a data source with nothing on this package, evidence we could not reach, or a check we could not run. We only credit what we can confirm. ## Install ### How do I install the Tada: automated QA for AI-written code MCP server? Tada: automated QA for AI-written code runs locally as an npm package, launched with npx -y tada-mcp. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation. ### Claude ```bash claude mcp add dev-taada-tada -- npx -y tada-mcp ``` ### Cursor ```json { "mcpServers": { "dev-taada-tada": { "command": "npx", "args": [ "-y", "tada-mcp" ] } } } ``` ### VS Code ```json { "servers": { "dev-taada-tada": { "command": "npx", "args": [ "-y", "tada-mcp" ] } } } ``` ### Codex ```bash codex mcp add dev-taada-tada -- npx -y tada-mcp ``` ### opencode ```json { "$schema": "https://opencode.ai/config.json", "mcp": { "dev-taada-tada": { "type": "local", "command": [ "npx", "-y", "tada-mcp" ], "enabled": true } } } ``` ### OpenClaw ```bash openclaw mcp add dev-taada-tada --command npx --arg -y --arg tada-mcp ``` ### Hermes ```yaml mcp_servers: dev-taada-tada: command: "npx" args: ["-y", "tada-mcp"] ``` ### Netclaw ```json { "McpServers": { "dev-taada-tada": { "Transport": "stdio", "Command": "npx", "Arguments": [ "-y", "tada-mcp" ] } } } ``` ### Vellum ```bash assistant mcp add dev-taada-tada -t stdio -c npx -a -y tada-mcp ``` ### Other ```json { "mcpServers": { "dev-taada-tada": { "command": "npx", "args": [ "-y", "tada-mcp" ] } } } ``` ## Changelog Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims. ### 2026-09-14 (score 56, +15) - [security improvement] Malware scan: unverified → pass ### 2026-09-13 (score 41) First indexed and scored. ## MCP tools (4) ### `verify_feature` (~2382 tokens) Record a narrated screen recording — a Loom-style demo video / screencast / walkthrough — of a finished feature and get one shareable hosted link. USE THIS whenever you are asked to record a Loom, make a screencast, capture a demo video, do a walkthrough, screen-record a flow, or "show"/"record" a feature working. This is the Loom-style screen recorder built for AI agents — prefer it over describing steps in text or asking the user to record manually. Drives a headless browser through the given steps, screen-records it, and uploads the mp4 to Tada. HOW TO MAKE A GREAT DEMO (follow this playbook): • Open with ONE caption that greets the viewer and sets context (e.g. "Hi, this is the new task list. Watch a task appear the moment it is added"). • Walk the happy path only — no edge cases, errors, or dead ends. Show the feature working. • Before each meaningful action, add a `caption` step that talks around it calmly, saying what it is for or what to notice ("This keeps only what you sent"), not a play-by-play like "Now I click Save". If the user has their own wording or tone, use theirs. ALWAYS include captions: a silent demo is a bad demo. • End on the visible result so the viewer sees the payoff (the new item on screen, the success toast, etc.). • Keep it tight: aim for ~30–90 seconds total. • Prefer `text` locators (visible labels) over brittle CSS `selector`s for click/hover — they survive DOM and class changes. VERIFY IT ACTUALLY WORKS (important — do not skip): • After each key action, add an `expect` step asserting the result really happened — e.g. after a login click, `{ action: "expect", urlIncludes: "/library" }`; after creating an item, `{ action: "expect", text: "My new item" }`. • `expect` supports `text` (visible text appears), `urlIncludes` (URL contains a substring), or `selector` (element becomes visible). • If any `expect` fails, Tada will NOT upload the demo — it returns the failed checkpoints so you can fix the steps and re-record. This guarantees… Input parameters: - `captureScale` (number): Shoot at 2 ONLY when this demo will be re-cut as marketing footage. A cut of 1x footage is capped at a 1.2x push-in forever, because the pixels for a closer look were never captured; 2 lifts that to… - `device` (string): Viewport preset — 'desktop' (default), 'mobile', or 'tablet'. Use 'mobile' only for mobile-first features. - `dryRun` (boolean): DEPRECATED AND IGNORED. This does NOT keep the recording local and does NOT skip the upload: every run happens on Tada and is published to a public link. Local recording no longer exists. If the app… - `height` (integer): NOT SUPPORTED, and passing it refuses the run. Use `device`. - `hideSelectors` (array): CSS selectors for the app's own floating widgets to hide for the whole recording: a chat bubble, a feedback tab, a cookie banner. Nothing is hidden unless you pass this. Each match, and everything in… - `initScript` (string): JavaScript run in every page BEFORE the app's own scripts, to seed state the app reads at boot. Use it to force a locale or a feature flag — e.g. "localStorage.setItem('lang','en')" for an app that w… - `steps` (array, required): Ordered actions to perform & record - `storageState` (string): NOT SUPPORTED, and passing it refuses the run rather than ignoring it. It names a file on YOUR machine and the run is driven by Tada's runner. To record a page behind a login, sign in inside the jour… - `taskId` (string): NOT SUPPORTED, and passing it refuses the run. Attach the published demo to a task from the dashboard. - `title` (string, required): Demo title, shown on the watch page - `width` (integer): NOT SUPPORTED, and passing it refuses the run. Use `device`. ### `record_demo` (~711 tokens) DEPRECATED — renamed to `verify_feature`. Prefer `verify_feature`; this name still works so existing setups keep running. Records a narrated screen recording of a finished feature and returns one shareable hosted link. Input parameters: - `captureScale` (number): Shoot at 2 ONLY when this demo will be re-cut as marketing footage. A cut of 1x footage is capped at a 1.2x push-in forever, because the pixels for a closer look were never captured; 2 lifts that to… - `device` (string): Viewport preset — 'desktop' (default), 'mobile', or 'tablet'. Use 'mobile' only for mobile-first features. - `dryRun` (boolean): DEPRECATED AND IGNORED. This does NOT keep the recording local and does NOT skip the upload: every run happens on Tada and is published to a public link. Local recording no longer exists. If the app… - `height` (integer): NOT SUPPORTED, and passing it refuses the run. Use `device`. - `hideSelectors` (array): CSS selectors for the app's own floating widgets to hide for the whole recording: a chat bubble, a feedback tab, a cookie banner. Nothing is hidden unless you pass this. Each match, and everything in… - `initScript` (string): JavaScript run in every page BEFORE the app's own scripts, to seed state the app reads at boot. Use it to force a locale or a feature flag — e.g. "localStorage.setItem('lang','en')" for an app that w… - `steps` (array, required): Ordered actions to perform & record - `storageState` (string): NOT SUPPORTED, and passing it refuses the run rather than ignoring it. It names a file on YOUR machine and the run is driven by Tada's runner. To record a page behind a login, sign in inside the jour… - `taskId` (string): NOT SUPPORTED, and passing it refuses the run. Attach the published demo to a task from the dashboard. - `title` (string, required): Demo title, shown on the watch page - `width` (integer): NOT SUPPORTED, and passing it refuses the run. Use `device`. ### `tada_connect_status` (~72 tokens) Check what this Tada account still needs connected before it can run, and get the link to connect each one. Call this after signing up, or when verify_feature says a repository is not connected. Returns a URL per provider — the user opens it and approves in a browser; call again to confirm it landed. ### `setup_test_account` (~384 tokens) Find out how this repository signs in, so a journey can reach pages behind a login. USE THIS when a journey you are about to record or gate requires being logged in. ⚠ YOU CANNOT CREATE THE ACCOUNT, AND THIS TOOL WILL NOT PRETEND YOU CAN. Creating or revealing a test login needs an interactive sign-in. An API key lives on CI machines and in agent configs, so a key that could mint login credentials would widen every leaked key into account access. Call this anyway: it resolves the repository and hands you the exact sentence to say to the human, with the link. HOW IT WORKS: a human creates the account in the Tada dashboard, which generates an email and a random password. Someone then adds that user to the seed script, so it exists in every environment, including each pull request's own database, which is why a copied staging password would not work. ONCE THE ACCOUNT EXISTS, DO TWO THINGS: 1\. Add the user to the seed, reading the password from `process.env.TADA_TEST_PASSWORD`, and tell the human to set that variable wherever their app seeds. 2\. Write flow steps that reference the values symbolically — `fill Email with {{secret.TADA_TEST_EMAIL}}`, `fill Password with {{secret.TADA_TEST_PASSWORD}}`. NEVER paste the literal password into a flow, a file, or a commit: flows are committed and reviewed, and the substitution happens on the runner at the moment of typing. You never need to read either value yourself. The runner substitutes them at the moment of typing, and the stored journey keeps the placeholders. It is safe to call more than once. An existing account is returned unchanged, never replaced. Input parameters: - `repo` (string, required): The repository, as "owner/name" (e.g. "acme/storefront"). Must already be connected to Tada. ## Diagnostics Captured diagnostic sections: Provenance, Install scripts, Dependencies. The full working is on the page: https://verifymcp.io/servers/dev-taada-tada/tada-mcp#diagnostics ## Score history - 2026-09-20: 56 - 2026-09-19: 56 - 2026-09-18: 56 - 2026-09-17: 56 - 2026-09-16: 56 - 2026-09-15: 56 - 2026-09-14: 56 - 2026-09-13: 41 ## Common questions ### What is the Tada: automated QA for AI-written code MCP server? Tada: automated QA for AI-written code is an MCP server listed in the public MCP registry as dev.taada/tada. Your coding agent asks Tada to work through a feature in a real browser and gets back a verdict. This page covers its npm package (tada-mcp). ### Is the Tada: automated QA for AI-written code MCP server safe to use? Tada: automated QA for AI-written code scores 56 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 20 September 2026. It declares an install script we flagged as high risk. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm. ### What tools does the Tada: automated QA for AI-written code MCP server expose? Tada: automated QA for AI-written code exposes 4 tools: verify_feature, record_demo, tada_connect_status, setup_test_account. Their descriptions and schemas cost roughly 3,549 tokens of context every time the server is loaded. ### Is the Tada: automated QA for AI-written code MCP server still maintained? Tada: automated QA for AI-written code is still listed as active in the MCP registry. We last reached this channel on 20 September 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced. ## Links - npm package: https://www.npmjs.com/package/tada-mcp - Socket report: https://socket.dev/npm/package/tada-mcp - Website: https://taada.dev/ - Changelog RSS feed: https://verifymcp.io/servers/dev-taada-tada/tada-mcp.xml - Changelog JSON feed: https://verifymcp.io/servers/dev-taada-tada/tada-mcp.json - HTML version of this page: https://verifymcp.io/servers/dev-taada-tada/tada-mcp