inspo-mcpCAUTION
Real websites for your coding agent to learn design from, searchable over MCP.
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
Inspo
Real production websites your coding agent can study, over MCP, before it writes UI. inspomcp.dev
With and without
Same brief, same model, no design skill on either run. The only difference: the page on the right was built with Inspo MCP on the session.
That gap is the product. Agents have tools but not taste, and the open web already holds every reference they need: Inspo assembles, tags, and addresses it.
What's inside
- 2,320 pages across 832 real sites, each captured on desktop and mobile, with traced palettes, real fonts, detected tech, and a fold-by-fold autopsy on every page.
- 68 canonical reference components (heroes, pricing, footers, navs, and more), each demonstrating one named macrostructure, with copy-pasteable JSX.
- A DESIGN.md for every site, extracted from its DOM: semantic palette roles, type ramp, spacing scale, CSS variables, container width.
Fifteen tools expose all of it; recommend(brief) composes most of them into one call. The full tool table lives in apps/mcp/README.md.
Tech stack
- TypeScript MCP server with two transports: stdio via npm, and Streamable HTTP served by the site's own Vercel deployment. No database at query time; the catalogue ships as a static seed.
- Next.js 16 + Tailwind v4 gallery: the archive browser and the curator dashboard.
- Playwright capture worker: desktop and mobile shots, palette, type ramp and CSS variable extraction, tag and autopsy passes via Together AI.
- Together AI embeddings behind semantic search
2c2feb9a2a8fOBSERVED · 2026-10-11Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.
claude mcp add inspo-mcp --env TOGETHER_API_KEY=${TOGETHER_API_KEY} -- npx -y [email protected]Trust audit
CAUTIONgrade B · trust 85/100 Install with care. The audit found things worth knowing before you trust its output.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | WARN |
| L1 | Static analysis of the code | WARN |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (5 observation(s))
- Network
- declared (5 observation(s))
- Shell
- declared (2 observation(s))
- Dependencies
- not all pinned
- Secrets in source
- none-found
Findings (23)
metadata.sqlite
metadata.sqlite-shm
metadata.sqlite-wal
`spread check — σx=${stdX.toFixed(3)} σy=${stdY.toFixed(3)} (>0.15 each is healthy)`,.vercelignore
const localBin = resolve(__dirname, "../../mcp/bin/inspo-mcp.js");
import { chromium } from "../../worker/node_modules/playwright/index.mjs";copyFileSync(out, resolve(here, "../../../docs/img/og.png"));
const OUT = resolve("../../packages/db/src/reference-components.json");const SEED_PATH = resolve("../../packages/db/src/static-screens.json");kleur, @types/node, tsx, typescript
@modelcontextprotocol/sdk, @neondatabase/serverless, drizzle-orm, zod, @types/node, dotenv, esbuild, tsx
@vercel/analytics, @vercel/blob, better-auth, cmdk, drizzle-orm, lucide-react, sharp, @tailwindcss/postcss
@hono/node-server, @neondatabase/serverless, @vercel/blob, drizzle-orm, hono, node-vibrant, playwright, sharp
turbo, typescript
packages/db/src/embeddings-rows.bin
packages/db/src/embeddings.bin
packages/db/src/static-screens.json
<code><span>$</span> curl -fsSL https://ferrite.sh/install | sh</code>
<button class="copy" data-copy="curl -fsSL https://ferrite.sh/install | sh" aria-label="Copy install command">
<div class="cmd"><code><span>$</span> curl -fsSL https://ferrite.sh/install | sh</code><button class="copy" data-copy="curl -fsSL https://ferrite.sh/install | sh" aria-label="Copy command"><svg viewBo
<div class="cmd"><code><span>$</span> curl -fsSL https://ferrite.sh/install | sh</code><button class="copy" data-copy="curl -fsSL https://ferrite.sh/install | sh" aria-label="Copy command"><svg viewBo
Gates applied: no_behavioural_pass.
2c2feb9a2a8ffull audit observations/trust-audit/mcp-server/nutlope__inspo.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-11 | 2c2feb9a2a8f | CAUTION | B | 85 | first audit |
Questions
What is the inspo-mcp MCP server?
Real websites for your coding agent to learn design from, searchable over MCP.
Is inspo-mcp safe to connect to an agent?
With care. The audit graded it B (85/100) and found 23 things worth knowing before you trust this server, listed below with the exact line each was found on.
What credentials does inspo-mcp need?
It reads BETTER_AUTH_SECRET, BETTER_AUTH_URL, BLOB_READ_WRITE_TOKEN, INSPO_API_KEY, INSPO_WORKER_TOKEN, NEXT_PUBLIC_BETTER_AUTH_URL and TOGETHER_API_KEY from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How does inspo-mcp run?
It speaks stdio and streamable-http, so it runs as a local process your client starts. It is published on npm as teaser at 1.0.0.
How current is this page?
The grade is for one exact copy of the source (2c2feb9a2a8f), read on 2026-10-11. The repository is watched and re-audited when it changes.