TapoCAUTION
🦀 Rust API, 🐍 Python API, and 🤖 MCP Server for TP-Link Tapo smart devices
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
[![License][licensebadge]][license] [![Crates][cratesbadge]][crates] [![Documentation][cratesdocumentationbadge]][cratesdocumentation] [![Crates.io][cratesdownloadsbadge]][crates] [![PyPI][pypibadge]][pypi] [![Python][pypiversionsbadge]][pypi] [![PyPI][pypidownloadsbadge]][pypi]\ Unofficial Tapo API Client. Works with TP-Link Tapo smart devices. Tested with light bulbs (L510, L520, L530, L535, L610, L630), light strips (L900, L920, L930), plugs (P100, P105, P110, P110M, P115), power strips (P300, P304M, P306, P316M), hubs (H100), switches (S200B, S200D, S210), sensors (KE100, T100, T110, T300, T310, T315) and cameras (C210, C220, C225, C325WB, C520WS, TC40, TC70).
[licensebadge]: https://img.shields.io/crates/l/tapo.svg [license]: https://github.com/mihai-dinculescu/tapo/blob/main/LICENSE [cratesbadge]: https://img.shields.io/crates/v/tapo.svg?logo=rust&color=F75101 [crates]: https://crates.io/crates/tapo [cratesdocumentationbadge]: https://img.shields.io/docsrs/tapo.svg?logo=rust&color=F75101 [cratesdocumentation]: https://docs.rs/tapo [cratesdownloads_badge]: https://img.shields.io/crates/d/tapo?logo=rust&label=downloads&color=F75101
[pypibadge]: https://img.shields.io/pypi/v/tapo.svg?logo=pypi&color=00ADD4 [pypi]: https://pypi.org/project/tapo [pypiversionsbadge]: https://img.shields.io/pypi/pyversions/tapo.svg?logo=python&color=00ADD4 [pypidownloads_badge]: https://img.shields.io/pypi/dm/tapo?logo=python&color=00ADD4
Supported Devices
See [/SUPPORTEDDEVICES.md][supporteddevices] for the supported devices and feature matrix.
Rust Library
Usage
Cargo.toml
[dependencies] tapo = "0.9"
main.rs
let device = ApiClient::new("", "tapo-password")
.p110("")
.await?;
device.on().await?;Examples
export TAPO_USERNAME= export TAPO_PASSWORD= export IP_ADDRESS= cargo run --example tapo_l530
See all examples in [/tapo/examples][examples].
50450cb1fafaOBSERVED · 2026-09-27Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.
claude mcp add tapo-mcp:0.5.0 --env TAPO_MCP_USERNAME=${TAPO_MCP_USERNAME} --env TAPO_MCP_PASSWORD=${TAPO_MCP_PASSWORD} --env TAPO_MCP_API_KEY=${TAPO_MCP_API_KEY} -- docker run -i --rm ghcr.io/mihai-dinculescu/tapo-mcp:0.5.0:NoneTrust audit
CAUTIONgrade B · trust 89/100 Install with care. The audit found things worth knowing before you trust its output.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | WARN |
| L1 | Static analysis of the code | PASS |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- none-observed
- Network
- none-observed
- Shell
- none-observed
- Dependencies
- pinned
- Secrets in source
- none-found
Findings (11)
tapo-py/LICENSE
tapo/LICENSE
tapo-py/CHANGELOG.md
tapo-py/README.md
tapo/CHANGELOG.md
npx @modelcontextprotocol/inspector http://127.0.0.1:3000
npx @modelcontextprotocol/inspector --header "Authorization: Bearer $TAPO_MCP_API_KEY" http://127.0.0.1:3000
claude mcp add --transport http tapo http://127.0.0.1:3000
claude mcp add --transport http --header "Authorization: Bearer <YOUR_TAPO_MCP_API_KEY>" -- tapo http://127.0.0.1:3000
- The server URL (e.g. `http://192.168.1.100`)
Gates applied: no_behavioural_pass.
50450cb1fafafull audit observations/trust-audit/mcp-server/mihai-dinculescu__tapo.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-09-27 | 50450cb1fafa | CAUTION | B | 89 | first audit |
Questions
What is the Tapo MCP server?
🦀 Rust API, 🐍 Python API, and 🤖 MCP Server for TP-Link Tapo smart devices
Is Tapo safe to connect to an agent?
With care. The audit graded it B (89/100) and found 11 things worth knowing before you trust this server, listed below with the exact line each was found on.
What credentials does Tapo need?
It reads TAPO_MCP_API_KEY, TAPO_MCP_PASSWORD and TAPO_MCP_USERNAME from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How does Tapo run?
It speaks streamable-http, so it runs as a service you connect to over the network. It is published on PyPI as tapo.
How current is this page?
The grade is for one exact copy of the source (50450cb1fafa), read on 2026-09-27. The repository is watched and re-audited when it changes.