@google/stitch-sdkSAFE
Generate UI screens from text prompts and extract their HTML and screenshots programmatically.
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
[](https://www.npmjs.com/package/@google/stitch-sdk)
Generate UI screens from text prompts and extract their HTML and screenshots programmatically.
Quick Start
Set your API key and generate a screen:
import { stitch } from "@google/stitch-sdk";
// STITCH_API_KEY must be set in the environment
const project = stitch.project("your-project-id");
const screen = await project.generate(
"A login page with email and password fields",
);
const html = await screen.getHtml();
const imageUrl = await screen.getImage();html is a download URL for the screen's HTML. imageUrl is a download URL for the screenshot.
Need to create a project first? Use the tool client:
const result = await stitch.callTool("create_project", { title: "My App" });Install
npm install @google/stitch-sdk
To use stitchTools() with the Vercel AI SDK, install ai as well:
npm install @google/stitch-sdk ai
Working with Projects and Screens
List existing projects
import { stitch } from "@google/stitch-sdk";
const projects = await stitch.projects();
for (const project of projects) {
console.log(project.id, project.projectId);
const screens = await project.screens();
console.log(` ${screens.length} screens`);
}Reference a project by ID
If you already have a project ID, reference it directly:
const project = stitch.project("4044680601076201931");
// Call methods on it — each method fetches data as needed
const screens = await project.screens();Edit a screen
const screen = await project.generate("A dashboard with charts");
const edited = await screen.edit("Make the background dark and add a sidebar");
const editedHtml = await edited.getHtml();Generate variants
const variants = await screen.variants("Try different color schemes", {
variantCount: 3,
creativeRa43755ebf57a6OBSERVED · 2026-10-12Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.
claude mcp add stitch-sdk --env GEMINI_API_KEY=${GEMINI_API_KEY} --env GOOGLE_GENERATIVE_AI_API_KEY=${GOOGLE_GENERATIVE_AI_API_KEY} --env STITCH_ACCESS_TOKEN=${STITCH_ACCESS_TOKEN} --env STITCH_API_KEY=${STITCH_API_KEY} -- npx -y @google/[email protected]{
"mcpServers": {
"stitch-sdk": {
"command": "npx",
"args": [
"-y",
"@google/[email protected]"
],
"env": {
"GEMINI_API_KEY": "${GEMINI_API_KEY}",
"GOOGLE_GENERATIVE_AI_API_KEY": "${GOOGLE_GENERATIVE_AI_API_KEY}",
"STITCH_ACCESS_TOKEN": "${STITCH_ACCESS_TOKEN}",
"STITCH_API_KEY": "${STITCH_API_KEY}"
}
}
}
}Exposed tools (19)
11 read · 7 write · 1 destructive. Blast radius: 1 tool can delete or overwrite — an agent that can be talked into calling a tool can be talked into calling this one.
| Tool | Risk | Description |
|---|---|---|
apply_design_system | write | Applies a design system to a list of screens. Use this tool when the user wants to update one or more screens to match the style of a design system.\nThis tool applies the selected design system |
create_design_system | write | Defines DesignTheme and ColorPalette in $defs |
create_design_system_from_design_md | write | Creates a design system for a project, with user uploaded DESIGN.md file, and displays the design system in the UI.\n\n**Instructions for Tool Call:**\n* Should call |
create_project | write | Creates a new Stitch project. A project is a container for UI designs and frontend code.\n |
delete_project | destructive | Deletes a specific Stitch project using its project name.\n\n**Instructions for Tool Call:**\n\n* This action cannot be undone. Please confirm with |
download_assets | read | Download screens and assets to a local directory |
edit_screens | write | Edits existing screens within a project using a text prompt.\n\n**Instructions for Tool Call:**\n* This action can take a few minutes to complete. Please be patient. DO NOT RETRY.\n* If the tool call fails due to connection error, the process may still succeed.\n |
generate_screen_from_text | read | Generates a new screen within a project from a text prompt.\n\n**Instructions for Tool Call:**\n* This action can take a few minutes to complete. Please be patient. DO NOT RETRY.\n* If the tool fails with a timeout, don\ |
generate_variants | read | Generates variants of existing screens within a project using a text prompt.\n\n**Instructions for Tool Call:**\n* If the tool fails with a timeout, don |
get_project | read | Retrieves the details of a specific Stitch project using its project name.\n |
get_screen | read | Retrieves the details of a specific screen within a project.\n |
list_design_systems | read | Lists all design systems for a given project.\n |
list_projects | read | Lists all Stitch projects accessible to the user. By default, it lists projects owned by the user.\n |
list_screens | read | Lists all screens within a given Stitch project.\n |
remote_tool | read | Remote |
simple_tool | read | No schema |
stitch-tool-client | read | Authenticated tool pipe for Stitch MCP Server |
update_design_system | write | References DesignTheme without defining it or ColorPalette |
upload_design_md | write | Uploads DESIGN.md to a Stitch project. Use this tool when the user wants to create a design system from a DESIGN.md file.\n\n**Instructions for Tool Call:**\n* Call |
Trust audit
SAFEgrade B · trust 89/100 Nothing in the source contradicts what it says it does. Grade A is reserved for packages that have also passed the behavioural sandbox.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | PASS |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | WARN |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (6 observation(s))
- Network
- declared (5 observation(s))
- Shell
- declared (1 observation(s))
- Dependencies
- not all pinned
- Secrets in source
- none-found
Findings (14)
delete_project
.prettierignore
const fn = new Function("raw", `return ${js}`);const hash = crypto.createHash("md5").update(url).digest("hex");import { type StitchToolClientSpec } from "../../src/spec/client.js";import { StitchError } from "../../src/spec/errors.js";import { Generation, emptyGenerationError } from "../../src/generation.js";import { Screen } from "../../src/screen-ext.js";import { type StitchToolClientSpec } from "../../src/spec/client.js";@types/bun, @types/react, firebase-tools, ink, prettier, react, ts-morph, turbo
@google/stitch-sdk
@modelcontextprotocol/sdk, cheerio, zod, @a2a-js/sdk, @google-cloud/storage, @google/adk, @google/genai, @mikro-orm/core
| `STITCH_ACCESS_TOKEN` | No | OAuth access token (alternative to API key) |
| `STITCH_ACCESS_TOKEN` | No | OAuth access token (alternative to API key) |
Gates applied: no_behavioural_pass.
43755ebf57a6full audit observations/trust-audit/mcp-server/google-labs-code__stitch-sdk.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-12 | 43755ebf57a6 | SAFE | B | 89 | first audit |
Questions
What is the @google/stitch-sdk MCP server?
Generate UI screens from text prompts and extract their HTML and screenshots programmatically.
What tools does @google/stitch-sdk expose?
19 in total: 11 read-only, 7 that write, and 1 that can delete or overwrite (delete_project). Every one is listed on this page with its risk.
Is @google/stitch-sdk safe to connect to an agent?
The audit found nothing in the source that contradicts what it says it does, and graded it B (89/100). Grade A is held back for packages that have also passed a sandboxed behavioural run, which is why a clean server reads B. Separately from the audit: 1 of its tools can destroy data, so scope the token you give it to what you actually need.
What credentials does @google/stitch-sdk need?
It reads GEMINI_API_KEY, GOOGLE_GENERATIVE_AI_API_KEY, STITCH_ACCESS_TOKEN and STITCH_API_KEY from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How does @google/stitch-sdk run?
It speaks stdio and streamable-http, so it runs as a local process your client starts. It is published on npm as @google/stitch-sdk at 0.4.0.
How current is this page?
The grade is for one exact copy of the source (43755ebf57a6), read on 2026-10-12. The repository is watched and re-audited when it changes.