Tares

Why this score

Installs in real projects: we can't search for this one (it has no fixed package name or address), so it's scored as a typical MCP server.

Popularity score: 60/100 from public GitHub signals only. It shows how widely used and maintained this is, not how well it works. Not included yet: the fake-star check. The security scan is shown separately and doesn't change the score. How we rank

Security

Scanned Nov 4, 2026 at the PyPI package tares@1.55.1, first 300 source files (it's a large repo), with Cisco's open-source skill-scanner.

What its code does:

• Reads environment variables and sends network requests with them API clients do this to send your key to the service. Check which service it talks to.tares/daemon.py, tares/login.py, tares/mcp_server.py and 6 more
• Runs shell commands Common for dev tools. Read the commands it runs.claude-plugin/hooks/guard.sh:35, scripts/check-shared-mcp.sh:54, scripts/e2e-github-tickets.sh:68 and 8 more
• Makes network requestsclaude-plugin/scripts/grok.py:86, claude-plugin/scripts/ship.py:94, scripts/seed_factory_demo.py:28 and 13 more
• Reads environment variables, where API keys usually livetares/cli.py:223
• Uses dependencies without a pinned version A later version of a dependency could change what runs.pyproject.toml:20 and 15 more

Web addresses in its code:

• api.github.comtares/connectors/github.py:32
• docs.glassflow.aitares/cli.py:32
• raw.githubusercontent.comskills/ai-sre/SKILL.md:56
• api.anthropic.comtares/config.py:1090
• api.githubcopilot.comtares/daemon.py:177
• api.open-meteo.comtares/connectors/http_poll.py:8
• api.openai.comtares/models.py:259
• console.tares-glassflow.comtares/cli.py:306
• api.linear.apptares/linear.py:30
• api.x.aiclaude-plugin/scripts/grok.py:19
• docs.astral.shscripts/factory-dev.sh:19
• eu.console.rius-glassflow.comtares/tracing.py:83
• ingest.eu.console.rius-glassflow.comtares/tracing.py:82
• slack.comtares/slack.py:32
• tares.glassflow.aitares/providers.py:234

These are the sites named in the code, so it's where your data could go. It isn't a complete list: code can build addresses while it runs, and a few of these may be links rather than calls. Whatever you send also goes to the AI model you use.

A scan lists patterns in the code. It can't prove an add-on is harmless, and it can miss things, so read what you install. How we scan

Alternatives

Nothing from another maker does quite the same job yet.