Atlas / MCP servers / taptap / TapTap Open API MCP 服务器

TapTap Open API MCP 服务器BLOCK

Name: TapTap Open API MCP 服务器
Author: taptap

mcp/taptap/instant-games-open-mcp

MCP server by taptap · dsh plugin · Audited 2026-10-12

⚑ Report / re-scan Source ↗

TapTap 小游戏开放能力 mcp

Verdict

BLOCK

Grade

Trust score

43 /100

Exposed tools

67 48r · 17w · 2d

Transport

stdio · streamable-http

License

—

Stars

Overview

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

基于 Model Context Protocol (MCP) 的 TapTap 小游戏和 H5 游戏服务器,提供排行榜、分享、多人联机、云存档,以及当前游戏 DC 数据查询、统计概览与评价操作能力,并支持 OAuth 2.0 零配置认证。

🔐 零配置 OAuth | 📚 完整文档 | 🎯 丰富 Tools & Resources | 🌍 小游戏 & H5 | 📦 单文件 Bundle

✨ 核心特性

🔐 零配置认证 - OAuth 2.0 Device Code Flow,扫码即用
📖 完整 API 文档 - 6 个排行榜 API + 详细代码示例
⚙️ 服务端管理 - 创建/管理排行榜,自动处理 ID
🎮 H5 游戏支持 - 上传、发布、状态查询
📺 广告接入闭环 - 仅用于 TapTap 小游戏/H5,自动查询广告状态和广告位 ID;方向缺失时先刷新

服务端应用信息,确认仍未设置后引导用户选择方向,不与 Maker MCP 混用

🧭 当前游戏 DC 能力 - 商店/评价/社区统计概览、商店快照、论坛内容、评价列表、评价点赞、官方回复
🦞 OpenClaw Plugin - 提供一个原生 OpenClaw plugin 子包,内部复用 TapTap MCP 运行时并暴露 raw JSON 工具 + bundled skill
🚀 三种传输模式 - stdio(本地)、SSE(远程/实时)、HTTP(兼容)
🔌 多客户端并发 - 独立会话管理,无限并发
📦 单文件 Bundle - 零依赖,包体积减少 96%(567 KB)
🤖 智能引导 - AI Agent 自动验证前置条件,主动询问用户选择

NPM: @taptap/instant-games-open-mcp Maker NPM: @taptap/maker

Maker 创作画布的 UI 设计稿、多轮识别、去文字、分层图集和独立 PNG 导出流程见 Maker UI 工作流。

控制台新增「UI 编辑器」页签:直接读取当前项目的 .ui.json,支持节点编辑、左右设计稿对照、透明度叠加和按需查看变更,保存直接写入当前项目。刷新文件列表保留编辑草稿和撤销历史。编辑器随 Maker 包内置,无需另装或启动服务;顶部问号链接到在线示例。控制台各页签统一使用紧凑顶部;深浅色切换同步自由画布和 UI 编辑器,无需刷新,不丢失草稿。 UI 编辑器与控制台共用配色:普通按钮为中性色,保存、选中态和勾选控件采用黄色强调。旧项目写在 Lua 中的 UI 可由内置 lua-ui-to-json Skill 提取为可编辑的 .ui.json,并运行静态检查; 默认保留游戏入口和行为逻辑,已有 JSON 不覆盖用户编辑。模板与示例媒体不装入 npm 包,首次使用按需从 CDN 下载,失败时尝试 GitHub,校验后缓存到本机。官方模板图片统一运行 npm run maker:resources:prepare 做无损压缩与像素核对;未处理或未上传 CDN 会阻止打包,发布时再验证两个下载源。维护流程见示例资源维护。对 AI 说“把设计稿做成游戏 UI”“拆 UI 素材”或“把切图拼成 UI.json”,通过内置 maker-ui-workflow Skill 从对应阶段继续,不新增 MCP tools。 UI 复原使用 Skill 自带组装脚本:按稳定编号与原稿坐标组装,保留备用切图, 再通过 UI 编辑器对照截图记录纠偏;由 AI 分阶段执行与复核,详见同一工作流文档。

Maker 支持本地控制台管理项目、构建和 Git 历史,并在文件不冲突时拉取远端代码;项目页可查看所有项目共用的本机 Runtime 与独立 Lua LSP 安装状态,构建页可单独检查 Lua,构建前默认可选检查。构建失败信息默认展开。构建与本地预览快捷操作会自动切换到对应工作页。构建页按当前阶段显示真实进度, 构建详情与 Runtim

Read from source at commit 38e77230e982OBSERVED · 2026-10-12

Connect

Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.

claude-code

claude mcp add taptap-mcp-proxy --env BUILD_CLIENT_SECRET=${BUILD_CLIENT_SECRET} --env TAPTAP_MAKER_TAP_TOKEN_URL=${TAPTAP_MAKER_TAP_TOKEN_URL} --env TAPTAP_MCP_CLIENT_SECRET=${TAPTAP_MCP_CLIENT_SECRET} --env TAPTAP_MCP_MAC_TOKEN=${TAPTAP_MCP_MAC_TOKEN} -- npx -y [email protected]

claude-desktop

{
  "mcpServers": {
    "taptap-mcp-proxy": {
      "command": "npx",
      "args": [
        "-y",
        "[email protected]"
      ],
      "env": {
        "BUILD_CLIENT_SECRET": "${BUILD_CLIENT_SECRET}",
        "TAPTAP_MAKER_TAP_TOKEN_URL": "${TAPTAP_MAKER_TAP_TOKEN_URL}",
        "TAPTAP_MCP_CLIENT_SECRET": "${TAPTAP_MCP_CLIENT_SECRET}",
        "TAPTAP_MCP_MAC_TOKEN": "${TAPTAP_MCP_MAC_TOKEN}"
      }
    }
  }
}

Exposed tools (67)

48 read · 17 write · 2 destructive. Blast radius: 2 tools can delete or overwrite — an agent that can be talked into calling a tool can be talked into calling this one.

Tool	Risk	Description
`add_test_whitelist`	write	Add one TapTap user to the test whitelist
`audition_voices_for_character`	read	Generate voice candidates for one character
`batch_generate_images`	read	Generate several images
`batch_sound_effects`	read	Generate several sound effects
`build`	read	Hidden remote build tool
`check_ads_status`	read	[Step 2 of Ads Workflow] Check server-side ads monetization status and cache the current selected app
`check_environment`	read	Check environment configuration and user authentication status. Use this to verify the current TAPTAP_MCP_ENV, signer mode, TAPTAP_MCP_MAC_TOKEN, and TAPTAP_MCP_CLIENT_ID configuration. If the user asks how to switch between production and RND, call get_environment_switch_guide.
`check_environment_raw`	read	[Raw JSON] Return structured environment, signer, and authentication status for agent/plugin consumption.
`check_multiplayer_code`	read	✅ Check multiplayer code before deployment. Detects: - Missing rate limiting - Wrong field names (playerId vs id) - Missing playerId save - Uninitialized remote players - Protocol inconsistency Use when: Before finalizing code, or when debugging.
`clear_auth_data`	destructive	Clear all cached authentication data and app selection. Use this when: 1) MAC Token expired or invalid, 2) Want to switch accounts, 3) Need to reset authentication. This will clear both OAuth token file and app cache.
`clear_auth_data_raw`	destructive	[Raw JSON] Clear cached OAuth token and/or selected app cache, returning structured result JSON.
`complete_oauth_authorization`	read	[Auth] Complete OAuth authorization after user has scanned QR code. Call this after user confirms they have completed authorization in browser. This tool will poll for the authorization result and save the token.
`complete_oauth_authorization_raw`	read	[Raw JSON] Complete OAuth authorization after the user scanned and approved the QR code. Returns structured authorization result JSON.
`confirm_character_voice`	read	Confirm one voice candidate
`create_3d_asset`	write	Create or continue a controlled 3D asset generation lifecycle
`create_app`	write	Create a new app/game on TapTap platform. The newly created app will be automatically selected - no need to call select_app afterwards. Use this when user wants to create a new app.
`create_developer`	write	Create a new unverified developer identity on TapTap platform. Use this when user wants to create a new developer account.
`create_leaderboard`	write	PREREQUISITE: An app MUST be selected first. Before calling this tool, ALWAYS call get_current_app_info to verify an app is selected. If not, guide user through: 1) Call list_developers_and_apps, 2) Show list to user and ASK them to choose, 3) Call select_app with user
`create_share_template`	write	PREREQUISITE: An app MUST be selected first. Before calling this tool, ALWAYS call get_current_app_info to verify an app is selected. If not, guide user through: 1) Call list_developers_and_apps, 2) Show list to user and ASK them to choose, 3) Call select_app with user
`create_video_task`	write	Create a text-to-video generation task
`diagnose_multiplayer_issues`	read	🔍 Diagnose common multiplayer issues. Use when user reports: - Players not visible / 看不到其他玩家 - Position not syncing / 位置不同步 - Connection failed / 连接失败 - Data not received / 收不到数据 Returns: Checklist with solutions for each issue.
`edit_image`	write	Edit an image
`generate_image`	read	Generate one image
`generate_local_guide`	read	📄 Generate MULTIPLAYER_GUIDE.md for user project root. Creates persistent reference with API rate limits, playerId rules, data structures. Enables context persistence across conversations. Use at project start.
`generate_multiplayer_code`	write	🎯 One-click: Generate complete multiplayer files ready to save. Generates: 1. js/MultiplayerManager.js (complete template with comments) 2. MULTIPLAYER_GUIDE.md (quick reference for project) Returns: File paths and contents, ready to save. Use when: User wants quick setup, or says
`generate_test_qrcode`	read	Generate a test QR code for mobile testing
`get_ad_config`	write	Sync ad config into project settings
`get_ad_integration_guide`	read	[Step 3 of Ads Workflow] Get the TapTap Minigame/H5 ads integration guide with the current selected app
`get_api_data_structures`	read	📊 Get complete API return value structures and event callback data structures. Includes all core APIs (connect, matchRoom, sendCustomMessage, etc) and events (playerEnterRoom, onCustomMessage, etc). Use when implementing API calls to avoid guessing data structures.
`get_app_status`	read	Get the review status of an app/game. Use this to check if the app is published, under review, or rejected.
`get_code_template`	read	Get complete MultiplayerManager.js template (350+ lines). Core methods: - 📤 sendData(data) → Send your action to others - 📥 onDataReceived(data, fromId) → Receive others
`get_current_app_community_overview`	read	PREREQUISITE: An app MUST be selected first. Before calling this tool, ALWAYS verify the selected app context. Get community overview metrics for the currently selected app, including topic count, favorite count, page views, feed count, and trend data for an optional date range.
`get_current_app_community_overview_raw`	read	[Raw JSON] Return current-app community overview data as structured JSON for agent/plugin consumption.
`get_current_app_forum_contents`	read	PREREQUISITE: An app MUST be selected first. Read forum contents for the currently selected app only. Use this to inspect the game forum feed before summarizing community topics. This tool is scoped to the selected app and MUST NOT be used for cross-game browsing.
`get_current_app_forum_contents_raw`	read	[Raw JSON] Return current-app forum contents as structured JSON for agent/plugin consumption.
`get_current_app_info_raw`	read	[Raw JSON] Return the currently selected app/cache payload as structured JSON for agent/plugin consumption.
`get_current_app_review_overview`	read	PREREQUISITE: An app MUST be selected first. Before calling this tool, ALWAYS verify the selected app context. Get review overview metrics for the currently selected app, including rating summary, rating score, positive/neutral/negative review counts, and trend data for an optional date range.
`get_current_app_review_overview_raw`	read	[Raw JSON] Return current-app review overview data as structured JSON for agent/plugin consumption.
`get_current_app_reviews`	read	PREREQUISITE: An app MUST be selected first. List reviews for the currently selected app only. Use this before like/reply actions so the user can inspect the review list and confirm the target review_id. Supports sort, pagination, collapsed reviews, and platform filter.
`get_current_app_reviews_raw`	read	[Raw JSON] Return current-app reviews as structured JSON for agent/plugin consumption.
`get_current_app_store_overview_raw`	read	[Raw JSON] Return current-app store overview data as structured JSON for agent/plugin consumption.
`get_current_app_store_snapshot_raw`	read	[Raw JSON] Return current-app store snapshot data as structured JSON for agent/plugin consumption.
`get_debug_feedbacks`	read	Download debug feedbacks and query game session logs
`get_debug_logger`	read	🔧 Get on-screen debug logger / 屏幕日志系统 / 调试日志工具. CALL THIS WHEN user says: -
`get_extended_apis`	read	🟡 Get extended APIs quick reference: createRoom, getRoomList, joinRoom, kickRoomPlayer, disconnect, updatePlayerCustomStatus. ONLY use when user explicitly requests room list UI, custom room creation, friend invitation, or player kick functionality. These are OPTIONAL.
`get_leaderboard_integration_guide`	write	⭐ READ THIS FIRST when user wants to integrate/接入/setup/add leaderboard功能. Returns complete step-by-step workflow. CRITICAL: Emphasizes NO SDK installation - tap is global object. Call this BEFORE making any implementation plans.
`get_player_id_guide`	read	🔑 Get Player ID usage guide: how to get local player ID from connect(), check
`get_protocol_template`	read	⚠️ CRITICAL - Communication protocol template to ensure consistency. PURPOSE: Prevent AI from using different protocols for different features. COMMON MISTAKE (AI often does this): - Feature 1: { type:
`get_sync_strategy`	write	🎮 Get synchronization strategy guide for joystick/WASD controls and click-based movement. Includes timer-based sync pattern (100ms interval) and change detection. Use when implementing position synchronization or continuous input handling.
`get_user_leaderboard_scores`	read	Get user leaderboard scores. Requires MAC Token authentication.
`like_current_app_review_raw`	read	[Raw JSON] Like a current-app review and return the structured upstream response.
`list_developers_and_apps_raw`	read	[Raw JSON] List all developers and their apps/games, including level and non-level apps, as structured JSON.
`list_leaderboards`	read	PREREQUISITE: An app MUST be selected first. Before calling this tool, ALWAYS call get_current_app_info to verify an app is selected. If not, guide user through: 1) Call list_developers_and_apps, 2) Show list to user and ASK them to choose, 3) Call select_app with user
`list_share_templates`	read	PREREQUISITE: An app MUST be selected first. Before calling this tool, ALWAYS call get_current_app_info to verify an app is selected. If not, guide user through: 1) Call list_developers_and_apps, 2) Show list to user and ASK them to choose, 3) Call select_app with user
`maker_status_lite`	read	status
`prepare_h5_upload`	write	[H5 Game Upload Workflow - Step 1] Use this tool when user wants to publish/upload/deploy H5 game (
`query_video_task`	read	Query a text-to-video generation task
`reply_current_app_review_raw`	read	[Raw JSON] Reply to a current-app review and return the structured upstream response.
`select_app_raw`	read	[Raw JSON] Select a specific developer/app pair and return the cached selection payload as structured JSON.
`share`	read	TapTap Share 功能
`start_oauth_authorization`	write	[Auth] Start OAuth 2.0 Device Code Flow to get authorization URL. Use this when: 1) User explicitly wants to authorize, 2) User needs to login or switch account, 3) Token expired or invalid. Returns a QR code URL for user to scan with TapTap App.
`start_oauth_authorization_raw`	write	[Raw JSON] Start OAuth 2.0 Device Code Flow and return device_code, qrcode_url, auth_url, and expiry information as structured JSON.
`text_to_dialogue`	read	Generate character dialogue
`text_to_music`	read	Generate music from text
`text_to_sound_effect`	read	Generate one sound effect
`update_app_info`	write	Update the app
`upload_image`	write	Upload an image to TapTap server and get a URL. Use this to upload icon, banner, or screenshots before calling update_app_info. Accepts either a local file path or base64 encoded image data.

Trust audit

BLOCKgrade F · trust 43/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.

Layer	What it checks	Result
L0	Provenance & inventory	WARN
L1	Static analysis of the code	FAIL
L2	Instruction surface (what it tells the agent)	PASS
L3	Class-specific surface	WARN
L4	Behavioural (sandbox)	SKIPPED

What the source does

Filesystem: declared (11 observation(s))
Network: declared (10 observation(s))
Shell: declared (8 observation(s))
Dependencies: not all pinned
Secrets in source: found

Findings (25)

HIGHCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95

scripts/test-maker-canvas-card-status.mjs:36

new Function(html.match(/<script>([\s\S]*?)<\/script>/i)[1]);

Why it matters. evaluates text as code

Fix. remove; use a parser or a dispatch table

HIGHCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95

src/maker/console/gitPull.ts:304

const result = await exec(

Why it matters. evaluates text as code

Fix. remove; use a parser or a dispatch table

HIGHCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95

src/maker/console/projects.ts:48

const result = await exec(

Why it matters. evaluates text as code

Fix. remove; use a parser or a dispatch table

MEDIUMInventory / provenance · inv.binary · CWE-1104

src/.DS_Store

.DS_Store

Why it matters. a compiled or binary member cannot be reviewed from source

Fix. ship source, or explain the binary in the README

MEDIUMInformation disclosure · disclose.log_secret · CWE-209, CWE-532

src/server.ts:726

logger.warning(`Failed to parse MAC Token from header: ${error}`);

MEDIUMNetwork egress · net.raw_ip · CWE-200, CWE-319

scripts/test-maker-canvas-card-status.mjs:147

await page.goto('http://127.0.0.1/canvas?project=status-test');

MEDIUMNetwork egress · net.raw_ip · CWE-200, CWE-319

scripts/test-maker-canvas-export.mjs:150

await page.goto('http://127.0.0.1/canvas?project=export-test');