Tako Mcp — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited Tako Mcp (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
An MCP (Model Context Protocol) server that provides access to Tako's knowledge base and data visualizations.
This MCP server enables AI agents to:
Use the hosted endpoint at `https://mcp.tako.com`. Three lines, no install:
export TAKO_API_TOKEN='<your-token-from-tako.com>'
claude mcp add tako-mcp --transport http https://mcp.tako.com/mcp \
--header "Authorization: Bearer $TAKO_API_TOKEN"That's it for new users. Detailed configs for Claude Code / Claude Desktop / Cursor / Windsurf are in the next section.
The fastest path: point your MCP client at https://mcp.tako.com with a Bearer token. No install, no local server.
Endpoints:
| Environment | URL |
|---|---|
| Production | https://mcp.tako.com/mcp |
| Staging (testing only) | https://mcp.staging.tako.com/mcp |
Authentication: every request needs Authorization: Bearer <TAKO_API_TOKEN>. Get a token at tako.com → account settings → API tokens.
export TAKO_API_TOKEN='<your-token>'
claude mcp add tako-mcp --transport http https://mcp.tako.com/mcp \
--header "Authorization: Bearer $TAKO_API_TOKEN"Verify with claude mcp list (should show tako-mcp connected) or /mcp inside a session.
Edit ~/Library/Application Support/Claude/claude_desktop_config.json (macOS) or %APPDATA%\Claude\claude_desktop_config.json (Windows):
{
"mcpServers": {
"tako-mcp": {
"type": "http",
"url": "https://mcp.tako.com/mcp",
"headers": {
"Authorization": "Bearer <your-tako-api-token>"
}
}
}
}Restart Claude Desktop. Tako MCP should appear in the available tools list.
Add to ~/.cursor/mcp.json (Cursor) or the equivalent Windsurf config:
{
"mcpServers": {
"tako-mcp": {
"type": "http",
"url": "https://mcp.tako.com/mcp",
"headers": {
"Authorization": "Bearer <your-tako-api-token>"
}
}
}
}tools/list handshake on connect — your client always sees the current tool surface, no manual list to keep in sync.api_token argument.mcp.staging.tako.com) for testing changes against an unstable build before they reach mcp.tako.com.Use this if you're connecting Tako from Claude.ai or ChatGPT — the consumer chat hosts that don't accept Bearer tokens. The hosted endpoint at https://mcp.tako.com/mcp runs an OAuth 2.1 flow that signs you in with your Tako account and connects on your behalf, no JSON config or CLI required.
If you're using Claude Code, Claude Desktop, Cursor, or Windsurf, see the Bearer-auth instructions above — those clients accept a static Authorization: Bearer header and don't need OAuth.Before connecting from Claude.ai or ChatGPT:
Step 2 is no longer required: the consent flow mints a per-host Tako API key for you on first authorize (named "MCP: <client>", visible and revocable at trytako.com → settings → API tokens). Minting is additive — connecting a new host never rotates another host's key — and Tako trims your oldest MCP key once you exceed ten. You only see a "too many API keys" page if your account is at the overall key cap, in which case revoke one and reconnect.
tako.com Settings → API Key with Regenerate button
The same three Tako-hosted screens appear regardless of which host (Claude.ai or ChatGPT) you're connecting from:
mcp.tako.com sign-in page showing Google + email magic-link options
mcp.tako.com consent page showing client name + signed-in identity
The host itself (Claude.ai or ChatGPT) may also display its own consent prompt before or after Tako's. That's normal — Tako confirms it's safe to share your account; the host confirms it's safe to invoke an external connector.
Requires Claude.ai Pro, Max, Team, or Enterprise.
Claude.ai Settings → Connectors landing page
_[Screenshot: Claude.ai "Add custom connector" dialog]_
https://mcp.tako.com/mcp and click Connect.Claude.ai connector list showing Tako connected
Requires ChatGPT Pro, Business, or Enterprise. Developer Mode must be enabled.
ChatGPT Settings → Connectors with the Developer Mode toggle
ChatGPT "Create custom connector" dialog
https://mcp.tako.com/mcp and click Connect.ChatGPT connector list showing Tako connected
In a fresh conversation, ask:
Show me Tako's chart on Intel vs Nvidia headcount.
A successful response includes a chart link or an inline chart render (depending on host) within a few seconds. If you instead see an authentication error, jump to Disconnecting & re-authorizing below.
There are two ways to break the connection, and they have different blast radius. Pick the one that matches what you actually want.
Per-host disconnect (Claude.ai or ChatGPT settings → remove the Tako connector). Stops that host from making MCP calls. Does not revoke the underlying Tako API token. Other connected hosts — and any Claude Code / Cursor Bearer-auth wiring on the same account — keep working unchanged.
Rotate the API token at [tako.com](https://tako.com) → settings → API tokens. This is the hard kill switch. Rotating creates a new token and invalidates the old one server-side, which means every previously-issued OAuth grant — across every host — stops authenticating immediately. To resume from any host, disconnect and reconnect; the new consent flow picks up your fresh token.
This kill-switch behavior is by design for v1. Per-grant scoped tokens (revoke a single host without touching the others) are tracked under TAKO-2679's known limitations.
Tools are discovered automatically via the MCP tools/list handshake; your client always sees the live surface. Auth is connection-level (Bearer token or OAuth) — there is no per-call api_token argument.
sources (["tako"] default, ["web"], or both) and effort (fast default | instant). For deep, multi-step research — or when search returns nothing — use tako_agent.["tako"], ["web"], or both (default).components (timeseries, bar, table, financial boxes, …); the card auto-renders inline and returns webpage_url / embed_url.tako_agent_start / tako_agent_wait pair to fit the host's tool-call timeout model.)tako_search with the querytako_answer to get a grounded prose answer with citationsget_chart_image), interactive-chart (open_chart_ui), chart-creation (create_chart), and report tools (create_report, get_report, list_reports, export_report) were removed.pip install tako-mcp / Docker) was removed in favor of the hosted Cloudflare Worker.Update any client config or agent prompts that referenced the old tool names or the Python SSE endpoint.
GET /health - Simple "ok" responseTako MCP is a Cloudflare Worker — a thin TypeScript proxy deployed at mcp.tako.com:
AI Agent (Claude Code/Desktop, Cursor, Claude.ai, ChatGPT, etc.)
↓
MCP Protocol (Streamable HTTP, POST /mcp)
↓
Cloudflare Worker ── Bearer auth / OAuth, tool dispatch
↓
Tako Django API (api.tako.com)The Worker extracts the Bearer token (or OAuth-derived token), validates the MCP request, calls the appropriate Django endpoint with the user's token forwarded as X-API-Key, and returns structured tool results. Code lives in workers/ of this repo.
Tako is published to the official MCP Registry as a remote server under the name io.github.TakoData/tako-mcp.
streamable-http entry pointing at https://mcp.tako.com/mcp. The registry schema does not list tools — hosts discover them at runtime via tools/list. (This is distinct from registry/server.json, the generated in-repo tool catalog used by npm run registry:gen / registry:check.)
.github/workflows/publish-mcp.yml. Itauthenticates with the registry via GitHub OIDC (no secret — the io.github.TakoData/* namespace is authorized because this repo lives in the TakoData org) and runs mcp-publisher publish. The version lives in code: bump server.json's version and merge to main and it publishes automatically. A merge that touches server.json without changing the version is a no-op (the workflow skips, so the registry never sees a duplicate). Manual workflow_dispatch publishes the checked-in version on demand.
requires DNS authentication: generate an Ed25519 key, add a TXT record on tako.com, and swap the workflow's login github-oidc step for login dns --domain tako.com --private-key ${{ secrets.MCP_PRIVATE_KEY }}.
MIT License - see LICENSE for details.
mcp.tako.com/mcp)io.github.TakoData/tako-mcp~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.