designesy-orgCAUTION
Scores any URL against a 44-check design contract (A-F grade), validates DTCG tokens, and checks drift and AI readiness.
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
[](https://pypi.org/project/designesy-mcp/) [](https://www.npmjs.com/package/@designesy/score) [](https://registry.modelcontextprotocol.io/v0.1/servers?search=designesy) [](https://smithery.ai/servers/le-vai/designesy) [](https://glama.ai/mcp/servers/LE-VAI/designesy-org) [](LICENSE)
A 12-second loop, recorded from the homepage. It plays once and rests on the verdict, and shows a still frame if you prefer reduced motion. Watch it run on designesy.org.
Design quality gate for AI-generated UI: score any URL on 44 deterministic checks, A–F grade. Live at designesy.org.
Quick Start
Score any URL in 5 seconds — no install:
npx @designesy/score@latest https://your-site.com
Add to Claude Desktop, Cursor, or any MCP client:
# Remote (zero install, no auth): claude mcp add designesy --transport http https://www.designesy.org/api/mcp # Or local stdio via PyPI: pip install designesy-mcp && designesy-mcp
Clone this repo? The `.mcp
186395b2060eOBSERVED · 2026-10-12Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.
claude mcp add designesy-mcp -- uvx designesy-mcp==1.13.8
Exposed tools (18)
18 read · 0 write · 0 destructive.
| Tool | Risk | Description |
|---|---|---|
designesy_a11y_score | read | |
designesy_agent_json | read | |
designesy_catalog | read | |
designesy_compare | read | |
designesy_contract | read | |
designesy_design_review | read | |
designesy_drift_score | read | |
designesy_guardrails | read | |
designesy_llms_full_txt | read | |
designesy_llms_txt | read | |
designesy_monitor_score | read | |
designesy_motion_score | read | |
designesy_readiness_score | read | |
designesy_report | read | |
designesy_score | read | |
designesy_skill_md | read | |
designesy_tokens_score | read | |
name | read |
Trust audit
CAUTIONgrade F · trust 57/100 Install with care. The audit found things worth knowing before you trust its output.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | WARN |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- none-observed
- Network
- declared (2 observation(s))
- Shell
- declared (1 observation(s))
- Dependencies
- not all pinned
- Secrets in source
- found
Findings (25)
" "
['tokens-whitespace-trim', HTML_WITH_FIELD, ':root { --paper: #ffffff; --ink: #111111; }'],token: '--surface-card-gradient',
token: '--glass-filter-regular',
acoustic-tokens.opus
acoustics.opus
cadence.opus
design-review.opus
designesy.a11y.opus
.lychee.toml
exec(): Promise<unknown>;
return new Function(`${outputText}\nreturn { ${names.join(', ')} };`)();new Function('exports', 'require', 'module', out.outputText)(mod.exports, req, mod);const grade = (passCount, failCount) => new Function('passCount', 'failCount', `${m[1]}\nreturn { score, grade };`)(passCount, failCount);return new Function(`${outputText}\nreturn { ${names.join(', ')} };`)();return require('node:crypto').createHash('sha1').update(`${key}258EAFA5-E914-47DA-95CA-C5AB0DC85B11`).digest('base64');console.log(` ${r.ground.padEnd(6)} ${r.name.padEnd(12)} ${r.colour} ${r.token.padEnd(21)} ${r.onGround.toFixed(2)}`);console.log(` ${r.grade} ${String(r.colour).padEnd(12)} ${String(r.token ?? '-').padEnd(14)} ${String(r.text ?? '-').padEnd(7)} ${r.textOnColour == null ? '-' : r.textOnColour.toFixed(2)}`);console.log(`mcp-tool-parity: OK — the hosted token checks match the shared golden on ${tokens.compared} token file(s), and the generated fixtures are current`);import { openIndex } from '../../lib/open-index';import { AI_CATALOG_MEDIA_TYPE, buildAiCatalog, discoveryHeaders } from '../../lib/mcp-server-card';import { MCP_SERVER_VERSION } from '../../../lib/mcp-version';import { buildServerCard, discoveryHeaders } from '../../../lib/mcp-server-card';import { readUsage } from '../../../lib/usage';`http://169.254.169.254/` (AWS IMDS) and the engine would follow it. The
Gates applied: no_behavioural_pass.
186395b2060efull audit observations/trust-audit/mcp-server/le-vai__designesy-org.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-12 | 186395b2060e | CAUTION | F | 57 | first audit |
Questions
What is the designesy-org MCP server?
Scores any URL against a 44-check design contract (A-F grade), validates DTCG tokens, and checks drift and AI readiness.
What tools does designesy-org expose?
18 in total: 18 read-only, 0 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.
Is designesy-org safe to connect to an agent?
With care. The audit graded it F (57/100) and found 25 things worth knowing before you trust this server, listed below with the exact line each was found on.
What credentials does designesy-org need?
It reads CRON_SECRET, GITHUB_TOKEN, PSI_API_KEY, RESEND_API_KEY and UPSTASH_REDIS_REST_TOKEN from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How does designesy-org run?
It speaks stdio and streamable-http, so it runs as a local process your client starts. It is published on npm as @vai/motion at 0.1.0.
How current is this page?
The grade is for one exact copy of the source (186395b2060e), read on 2026-10-12. The repository is watched and re-audited when it changes.