Integrate Taplid into your product, pipeline, or agent stack.

1. Load an example in Taplid Audit.

   Try it

2. Open PowerShell and run this - package installs, runs and outputs a result.

   bash@taplid/cli

   npx @taplid/cli audit request.json

3. Use the SDK or API when integrating into your backend.

   bash@taplid/client

   npm install @taplid/client

4. Use the MCP server from Claude, Cursor, or any MCP-capable agent.

   bash@taplid/mcp

   npx @taplid/mcp

5. Use OpenAI-compatible mode to run, retrieve, and verify from OpenAI-style tools and gateways.

TAPLID_API_KEY is required for creating audits through the public API. Audit retrieval and Verify Audit do not require an API key. The other variables are optional request defaults.

• TAPLID_API_KEY= (required)
• TAPLID_CONTEXT=
• TAPLID_PROMPT=
• TAPLID_RESPONSE=
• TAPLID_AUDIT_MODE=
• TAPLID_CONTEXT_FILE_LOCATION=
• TAPLID_PROMPT_FILE_LOCATION=
• TAPLID_RESPONSE_FILE_LOCATION=
• TAPLID_REVIEW_THRESHOLD=
• TAPLID_PASS_THRESHOLD=

The CLI is a thin wrapper over the API. It can run audits, retrieve saved audits, and verify signed attestations.

npx @taplid/cli audit request.json

Retrieval and verification do not require an API key.

npx @taplid/cli audit get --audit-id AUD-xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx --pretty
npx @taplid/cli audit verify --audit-id AUD-xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx --pretty
npx @taplid/cli audit verify --token "eyJ..." --json

Prefer to skip the file? Pass context, prompt, and response as inline flags:

npx @taplid/cli audit --context "The number is 1." --prompt "What is the number?" --response "The number is 2." --audit-mode standard

Output

By default the CLI writes the full audit result JSON to a sibling file:

• Input - request.json
• Output - request.response.json
• No-input mode output - taplid.response.json

Optional Flags

npx @taplid/cli audit request.json --out custom-response.json
npx @taplid/cli audit --response "Inline response only"
npx @taplid/cli audit --response-file-location ./bundle/response.txt
npx @taplid/cli audit --prompt "Inline prompt" --response-file-location ./bundle/response.txt
npx @taplid/cli audit request.json --audit-mode artifact
npx @taplid/cli audit request.json --api-url http://127.0.0.1:7000
npx @taplid/cli audit request.json --api-key your_api_key
npx @taplid/cli audit request.json --envfile .env.taplid
npx @taplid/cli audit request.json --pass-threshold 85 --review-threshold 65
npx @taplid/cli audit get --audit-id AUD-xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx --pretty
npx @taplid/cli audit verify --audit-id AUD-xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx --pretty
npx @taplid/cli audit verify --token "eyJ..." --json

• --context <text> sets context text for this run.
• --prompt <text> sets prompt text for this run.
• --response <text> sets response text for this run.
• --audit-mode <standard|artifact> overrides auditMode for this run. Default artifact. Artifact mode is recommended for code reviews, PRs, implementation plans, long answers, and structured outputs. Standard mode is best for factual, policy, refund, pricing, and entitlement issues. In JSON request files, use auditMode. In CLI flags, use --audit-mode. If both are provided, the CLI flag overrides the value in the request file.
• --context-file-location <path> resolves context text from a file.
• --prompt-file-location <path> resolves prompt text from a file.
• --response-file-location <path> resolves response text from a file.
• --out <path> writes the response JSON to a custom output path.
• --api-url <url> overrides the default API origin.
• --api-key <key> sends a bearer token for audit and eval. It is not required for audit get or audit verify.
• --audit-id <AUD-...> retrieves a persisted hosted audit with audit get or verifies it with audit verify.
• --token <jwt> verifies a signed attestation token with audit verify.
• --envfile <path> loads TAPLID env defaults from an explicit env file.
• --pass-threshold <0-100> overrides the pass threshold for this run.
• --review-threshold <0-100> overrides the review threshold for this run.

Optional Environment Loading

The CLI supports three ways of providing TAPLID env values:

1. Shell or process environment
2. Explicit --envfile <path>
3. Auto-loaded local .env from the current working directory

If --envfile is provided, the CLI loads that file and does not auto-load the local .env.

If --envfile is not provided, the CLI checks process.cwd() for .env and continues silently if the file is absent.

If --envfile is provided but the file does not exist, the CLI fails fast.

Example shell usage:

$env:TAPLID_API_KEY = "your_api_key"
$env:TAPLID_AUDIT_MODE = "artifact"
npx @taplid/cli audit request.json

Example explicit env file usage:

npx @taplid/cli audit request.json --envfile .env.taplid

Optional Environment Defaults

Supported variables:

• TAPLID_PUBLIC_API_URL=
• TAPLID_API_KEY=
• TAPLID_CONTEXT=
• TAPLID_PROMPT=
• TAPLID_RESPONSE=
• TAPLID_AUDIT_MODE=
• TAPLID_CONTEXT_FILE_LOCATION=
• TAPLID_PROMPT_FILE_LOCATION=
• TAPLID_RESPONSE_FILE_LOCATION=
• TAPLID_REVIEW_THRESHOLD=
• TAPLID_PASS_THRESHOLD=

Blank env values are ignored.

context, prompt, and response can come from CLI text flags, CLI file-location flags, shell env, --envfile, the auto-loaded local .env, or request.json.

Precedence

1. Text fields (context, prompt, response): CLI > shell env > --envfile > local .env > request.json
2. Non-text fields: CLI flags > request.json > shell env > --envfile > local .env > built-in defaults

Hosted usage limits are enforced per access mode. Use /api/review for anonymous access, or API keys for authenticated account usage and saved dashboard thresholds.

• Anonymous Artifact: 5 total
• Anonymous Standard: 5 total
• Free Artifact: 50 / month
• Free Standard: 10 / month
• Starter Artifact: 1,000 / month
• Starter Standard: 1,000 / month
• Pro Artifact: 10,000 / month
• Pro Standard: 10,000 / month

Use audit to run an audit and write the result JSON. Use eval as a CI threshold gate - it exits non-zero when the trust score is below --pass-threshold.

npx @taplid/cli eval request.json --api-key tap_live_... --pass-threshold 80

Claude Desktop / Cursor (local stdio MCP)

The package does not need to be globally installed. Claude Desktop, Cursor, or any MCP-aware client can run it through npx. You only need Node.js/npm installed so the npx command is available. Your Taplid API key stays in the client config, not in the prompt. The server exposestaplid_audit, taplid_get_audit, and taplid_verify_audit.

For reliability, pin the exact MCP package version instead of using @taplid/mcp or @taplid/mcp@latest. Some MCP clients can keep using a cached package even after restart. When Taplid publishes a new MCP version, update the version number manually, then fully quit and reopen the MCP client. Check the latest published version on npm.

npx @taplid/[email protected]

{
  "mcpServers": {
    "taplid": {
      "command": "npx",
      "args": ["-y", "@taplid/[email protected]"],
      "env": {
        "TAPLID_API_KEY": "tap_live_...",
        "TAPLID_API_URL": "https://api.taplid.com"
      }
    }
  }
}

{
  "mcpServers": {
    "taplid-local": {
      "command": "node",
      "args": ["C:\\code\\taplid\\packages\\taplid-mcp\\dist\\server.js"],
      "env": {
        "TAPLID_API_KEY": "tap_live_...",
        "TAPLID_API_URL": "http://127.0.0.1:7000"
      }
    }
  }
}

After updating the config file, completely close and reopen Claude Desktop / Cursor. Restarting the chat is not enough.

OpenAI Responses API (remote MCP)

Pass a Taplid MCP tool block in the tools array of any OpenAI Responses API call. The same MCP server exposes audit, retrieval, and verification tools.

{
  "type": "mcp",
  "server_label": "taplid",
  "server_url": "https://api.taplid.com/mcp",
  "require_approval": "never",
  "headers": {
    "Authorization": "Bearer <taplid_api_key>"
  }
}

Anthropic Messages API (remote MCP)

Add a Taplid MCP server to your Anthropic Messages API request using the mcp_servers field. Include the anthropic-beta: mcp-client-2025-11-20 header.

{
  "mcp_servers": [
    {
      "url": "https://api.taplid.com/mcp",
      "authorization_token": "<taplid_api_key>"
    }
  ]
}

anthropic-beta: mcp-client-2025-11-20

Install npm install openai dotenv. This route supports the same three operations through explicit taplid.operation routing: run an audit, retrieve an audit, or verify an audit. The default operation is audit.

import OpenAI from 'openai';

const response = await fetch(
  "https://api.taplid.com/v1/chat/completions",
  {
    method: "POST",
    headers: {
      "Content-Type": "application/json",
      Authorization: `Bearer ${API_KEY}`,
    },
    body: JSON.stringify({
      model: "taplid-verify",
      messages: [
        { role: "system", content: "The number is 1." },
        { role: "user", content: "What is the number?" },
        { role: "assistant", content: "The number is 2." },
      ],
      taplid: {
        auditMode: "standard",
      },
    }),
  },
);

const result = await response.json();
console.log(result.taplid.decision);

{
  "taplid": {
    "operation": "audit | get_audit | verify_audit",
    "auditId": "AUD-xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
  }
}

Every completed hosted audit returns an auditId. Anyone who has the ID can retrieve the persisted public result — no API key required.

Treat the audit ID like a share link. Retrieval is a public lookup. Hosted audit results include an attestation object, which is the cryptographic proof layer.

curl https://api.taplid.com/review/audits/AUD-xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx

const taplid = new Taplid();

const audit = await taplid.getAudit(
  'AUD-xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx',
);

npx @taplid/cli audit get --audit-id AUD-xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx --pretty

{
  "auditId": "AUD-xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
}

{
  "model": "taplid",
  "messages": [
    {
      "role": "user",
      "content": "Retrieve this Taplid audit."
    }
  ],
  "taplid": {
    "operation": "get_audit",
    "auditId": "AUD-xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
  }
}

Verify a persisted audit ID or signed attestation token. No API key is required. Audit ID verification checks the saved public result, signed fields, issuer, signature, and result hash. Token-only verification checks the signature and issuer.

const taplid = new Taplid();

const report = await taplid.verifyAudit({
  auditId: 'AUD-xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx',
});

curl -X POST https://api.taplid.com/verify-audit \
  -H "Content-Type: application/json" \
  -d '{"auditId":"AUD-xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"}'

npx @taplid/cli audit verify --audit-id AUD-xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx --pretty

{
  "auditId": "AUD-xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
}

{
  "model": "taplid",
  "messages": [
    {
      "role": "user",
      "content": "Verify this Taplid audit."
    }
  ],
  "taplid": {
    "operation": "verify_audit",
    "auditId": "AUD-xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
  }
}

Hosted Taplid audit responses include an attestation object: an ES256-signed proof that Taplid issued this decision for the audited input and the returned public result.

Public verification keys are available at https://api.taplid.com/.well-known/jwks.json. Consumers can verify the signature directly, or use Verify Audit through the SDK, HTTP API, CLI, or MCP.

• Hosted Taplid audit responses include an attestation object.
• The attestation is an ES256-signed proof that Taplid issued the decision for the audited input and returned public result.
• Public verification keys are available at https://api.taplid.com/.well-known/jwks.json.
• The signed token payload includes auditId, auditMode, decision, trustScore, inputHash, and resultHash.