AiSAFE
Teach your AI assistant Wind UI, Magic Framework and more, across every major coding tool. Skills, a Claude Code marketplace and a hosted MCP server.
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
FlutterSDK AI
AI coding skills for the FlutterSDK ecosystem. Teach your AI assistant Wind UI, Magic Framework, and more, across every major coding tool.
Registry · Issues · Quick Start
Why?
AI coding assistants are powerful, but they don't know your frameworks. They hallucinate widget names, guess at API patterns, and miss conventions.
FlutterSDK AI fixes this. It gives your AI structured knowledge about Wind UI's className system, Magic Framework's Laravel-inspired architecture, and more, so it generates correct code on the first try.
One install, every tool:
3282a84b5028OBSERVED · 2026-10-12Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.
claude mcp add mcp -- npx -y @fluttersdk/[email protected]
Exposed tools (2)
2 read · 0 write · 0 destructive.
| Tool | Risk | Description |
|---|---|---|
other-tool | read | Some other tool |
search-docs | read | Search FlutterSDK documentation |
Trust audit
SAFEgrade B · trust 89/100 Nothing in the source contradicts what it says it does. Grade A is reserved for packages that have also passed the behavioural sandbox.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | WARN |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- none-observed
- Network
- none-observed
- Shell
- none-observed
- Dependencies
- not all pinned
- Secrets in source
- found
Findings (12)
final token = 'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...';
.nojekyll
@modelcontextprotocol/sdk, zod, @types/node, typescript, vitest
`BaseGuard` (and `Auth.fake()`'s fake guard) dispatch `AuthLogin`/`AuthLogout` through `Event`: `AuthLogin` at the end of a successful `startSession` (not on a restore), `AuthLogout` on every `logout(
Session.flash({'email': '[email protected]'});expect(Session.old('email'), '[email protected]');"INSERT INTO users (email, password) VALUES ('[email protected]', 'hashed_password')"| `BRIDGE_ALLOW_TOOLS` | `search-docs` | Comma-separated list of tool names to expose. Use `*` for unrestricted access. |
> result as text. Has full access to anything imported by
// Load .env file (called by Magic.init())
await Env.load(fileName: '.env');
| Reading the Sentry config through `Config.get` | `Config` is not loaded when `configure` runs; read `.env` through `Env`, as the published file does |
Gates applied: no_behavioural_pass.
3282a84b5028full audit observations/trust-audit/mcp-server/fluttersdk__ai.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-12 | 3282a84b5028 | SAFE | B | 89 | first audit |
Questions
What is the @fluttersdk/mcp MCP server?
Teach your AI assistant Wind UI, Magic Framework and more, across every major coding tool. Skills, a Claude Code marketplace and a hosted MCP server.
What tools does @fluttersdk/mcp expose?
2 in total: 2 read-only, 0 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.
Is @fluttersdk/mcp safe to connect to an agent?
The audit found nothing in the source that contradicts what it says it does, and graded it B (89/100). Grade A is held back for packages that have also passed a sandboxed behavioural run, which is why a clean server reads B.
What credentials does @fluttersdk/mcp need?
It reads KEY from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How does @fluttersdk/mcp run?
It speaks stdio and streamable-http, so it runs as a local process your client starts. It is published on npm as @fluttersdk/mcp at 1.1.3.
How current is this page?
The grade is for one exact copy of the source (3282a84b5028), read on 2026-10-12. The repository is watched and re-audited when it changes.