Atlas / MCP servers / metrostar / Comet

CometBLOCK

Name: Comet
Author: metrostar

mcp/metrostar/comet

MCP server by metrostar · comet components · component library · components · Audited 2026-10-08

⚑ Report / re-scan Source ↗

React with TypeScript Component Library based on USWDS 3.0

Verdict

BLOCK

Grade

Trust score

67 /100

Exposed tools

7 6r · 1w · 0d

Transport

stdio

License

Apache-2.0

Stars

Overview

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

[](https://github.com/metrostar/comet/blob/main/LICENSE.md) [](https://github.com/metrostar/comet/actions) [](https://codecov.io/gh/metrostar/comet) [](https://www.npmjs.com/package/@metrostar/comet-uswds) [](https://www.npmjs.com/package/@metrostar/comet-uswds) [](https://www.npmjs.com/package/@uswds/uswds)

[](https://www.npmjs.com/package/@metrostar/comet-uswds) [](https://www.npmjs.com/package/@metrostar/comet-extras) [](https://www.npmjs.com/package/@metrostar/comet-data-viz) [](https://www.npmjs.com/package/@metrostar/comet-mcp)

Comet is a React with TypeScript Component Library based on the U.S. Web Design System (USWDS).

What started as a USWDS implementation has evolved into a comprehensive toolkit for building modern government and enterprise applications. Comet provides modular packages that accelerate developer productivity a

Read from source at commit 2d5347692e98OBSERVED · 2026-10-08

Connect

Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control.

claude-code

claude mcp add comet-uswds -- npx -y @metrostar/[email protected]

claude-desktop

{
  "mcpServers": {
    "comet-uswds": {
      "command": "npx",
      "args": [
        "-y",
        "@metrostar/[email protected]"
      ]
    }
  }
}

Exposed tools (7)

6 read · 1 write · 0 destructive.

Tool	Risk	Description
`add_comet`	write	Add comet packages and configurations to an existing app
`get_comet_version`	read	Get version information for Comet packages from package.json
`get_component_details`	read	Get detailed information about a specific Comet component
`get_env_variables`	read	Get current Node.js environment variables
`init_project`	read	Initialize a new Comet project (UI or API)
`list_components`	read	Get a list of all available Comet components from comet-uswds, comet-extras, and comet-data-viz packages
`search_uswds`	read	Search USWDS design system documentation for utilities, classes, design tokens, and other information from https://designsystem.digital.gov/

Trust audit

BLOCKgrade D · trust 67/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.

Layer	What it checks	Result
L0	Provenance & inventory	PASS
L1	Static analysis of the code	FAIL
L2	Instruction surface (what it tells the agent)	PASS
L3	Class-specific surface	PASS
L4	Behavioural (sandbox)	SKIPPED

What the source does

Filesystem: declared (5 observation(s))
Network: declared (1 observation(s))
Shell: declared (3 observation(s))
Dependencies: not all pinned
Secrets in source: none-found

Findings (13)

HIGHCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95

packages/comet-cli/src/index.ts:51

exec(command, (err: any) => {

Why it matters. evaluates text as code

Fix. remove; use a parser or a dispatch table

HIGHCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95

packages/comet-cli/src/index.ts:58

exec(gitCleanupCommand, (cleanupErr: any) => {

Why it matters. evaluates text as code

Fix. remove; use a parser or a dispatch table

HIGHCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95

packages/comet-cli/src/index.ts:105

exec(command, (err: any) => {

Why it matters. evaluates text as code

Fix. remove; use a parser or a dispatch table

LOWFilesystem / path · fs.traversal · CWE-22, CWE-59

packages/comet-data-viz/src/components/area-graph/area-graph.stories.tsx:3

import { AreaGraph } from '../../index';

LOWFilesystem / path · fs.traversal · CWE-22, CWE-59

packages/comet-data-viz/src/components/bar-graph/bar-graph.stories.tsx:3

import { BarGraph } from '../../index';

LOWFilesystem / path · fs.traversal · CWE-22, CWE-59

packages/comet-data-viz/src/components/line-graph/line-graph.stories.tsx:3

import { LineGraph } from '../../index';

LOWFilesystem / path · fs.traversal · CWE-22, CWE-59

packages/comet-data-viz/src/components/pie-chart/pie-chart.stories.tsx:3

import { PieChart } from '../../index';

LOWFilesystem / path · fs.traversal · CWE-22, CWE-59

packages/comet-data-viz/src/components/polar-axis/polar-axis.stories.tsx:3

import { PolarAxis } from '../../index';

LOWSupply chain · supply.unpinned · CWE-829, CWE-1357

package.json

@eslint/js, @rollup/plugin-commonjs, @rollup/plugin-image, @rollup/plugin-node-resolve, @rollup/plugin-terser, @testing-library/jest-dom, @vitejs/plugin-react, @vitest/browser-playwright

Why it matters. 25 dependency range(s) float