MCP Observatory
3m ago Tracked 59,469 Last 3m ago 24h 2,466
github TypeScript re-analysis due

LE-VAI/designesy-org

v1.12.0
github

40-check design contract verification engine — score any URL, gate your CI, enforce DTCG 2025.10 tokens. MCP server + GitHub Action + stylelint plugin + CLI.

maintainer
LE-VAI
licence
MIT
first seen
2026-08-05
last seen
2026-09-17
releases · 30d
3
short id

Drift inferred · capture-to-capture

No drift recorded — single capability capture; advisories appear once its surface changes.

capabilities 17 tools
transport stdio · streamable-http · http verified reported listed in the official MCP registry counts 17 tools · 0 res · 0 prompts permission surface via code analysis

tools

  • designesy_a11y_score
  • designesy_agent_json
  • designesy_catalog
  • designesy_compare
  • designesy_contract
  • designesy_design_review
  • designesy_drift_score
  • designesy_guardrails
  • designesy_llms_full_txt
  • designesy_llms_txt
  • designesy_monitor_score
  • designesy_motion_score
  • designesy_readiness_score
  • designesy_report
  • designesy_score
  • designesy_skill_md
  • designesy_tokens_score
skills & danger signals github-tarball
prompt-surface shipped agent-instruction files + hidden-content / dangerous-code findings — quoted from the analyzed source

analyzed commit 12528fb · analyzer v33 · 11h ago

skills & prompt files 1

danger signals5

code evidence vv1.12.0 · github-tarball
evidence-backed findings quoted directly from the published source artifact — not inferred

code files: 447

filesystem 22

  • fs LE-VAI-designesy-org-12528fb/action/dist/index.js :15 const fs = require('node:fs');
  • fs LE-VAI-designesy-org-12528fb/apps/site/node24-win-readlink-shim.cjs :16 const fs = require('fs');
  • fs (weak) LE-VAI-designesy-org-12528fb/apps/site/scripts/blind-comparison.mjs :32 import { writeFileSync, readFileSync } from 'node:fs';
  • fs (weak) LE-VAI-designesy-org-12528fb/apps/site/scripts/check-contract-drift.js :24 const fs = require('node:fs');
  • fs (weak) LE-VAI-designesy-org-12528fb/apps/site/scripts/postbuild-pagefind.js :27 const fs = require('node:fs');
  • fs (weak) LE-VAI-designesy-org-12528fb/apps/site/scripts/rank-bounds.mjs :29 import { writeFileSync } from 'node:fs';
  • fs (weak) LE-VAI-designesy-org-12528fb/apps/site/scripts/replace-rgba.js :9 const fs = require('fs');
  • fs (weak) LE-VAI-designesy-org-12528fb/apps/site/scripts/replace-spacing.js :14 const fs = require('fs');
  • fs (weak) LE-VAI-designesy-org-12528fb/apps/site/scripts/score-diff.mjs :31 import { writeFileSync } from 'node:fs';
  • fs (weak) LE-VAI-designesy-org-12528fb/apps/site/scripts/sensitivity-analysis.mjs :24 import { writeFileSync } from 'node:fs';
  • fs LE-VAI-designesy-org-12528fb/packages/cli/src/index.ts :25 import { existsSync, readFileSync } from 'node:fs';
  • fs LE-VAI-designesy-org-12528fb/packages/designesy-mcp/cdp-cwv-expr.cjs :14 const fs = require('fs');
show 10 more
  • fs LE-VAI-designesy-org-12528fb/packages/lab-builder/src/index.js :14 import { mkdir, writeFile, readdir, readFile, access } from 'node:fs/promises';
  • fs LE-VAI-designesy-org-12528fb/packages/stylelint-plugin-dtcg-tokens/src/index.ts :37 import { readFile } from 'node:fs/promises';
  • fs LE-VAI-designesy-org-12528fb/packages/stylelint-plugin-dtcg-tokens/src/postcss-plugin.ts :23 import { readFileSync } from 'node:fs';
  • fs (weak) LE-VAI-designesy-org-12528fb/packages/stylelint-plugin-dtcg-tokens/test/test.js :3 import { readFile } from 'node:fs/promises';
  • fs LE-VAI-designesy-org-12528fb/packages/tokens/src/cli.ts :15 import { readFileSync } from 'node:fs';
  • fs (weak) LE-VAI-designesy-org-12528fb/packages/tokens/test/test.js :12 import { readFileSync } from 'node:fs';
  • fs LE-VAI-designesy-org-12528fb/packages/vai-icons/demo/serve.mjs :6 import { readFile } from 'node:fs/promises';
  • fs LE-VAI-designesy-org-12528fb/packages/vai-motion/demo/serve.mjs :9 import { readFile } from 'node:fs/promises';
  • fs (weak) LE-VAI-designesy-org-12528fb/scripts/deploy-prod.mjs :25 import { readFileSync } from 'fs';
  • fs (weak) LE-VAI-designesy-org-12528fb/scripts/rescore-leaderboard.mjs :19 import { readFileSync, writeFileSync, existsSync } from 'node:fs';

shell / exec 5

  • shell (weak) LE-VAI-designesy-org-12528fb/apps/site/scripts/build-win.js :12 const { spawnSync } = require('child_process');
  • shell (weak) LE-VAI-designesy-org-12528fb/apps/site/scripts/postbuild-pagefind.js :26 const { execFileSync } = require('node:child_process');
  • shell LE-VAI-designesy-org-12528fb/packages/cli/src/index.ts :23 import { spawn } from 'node:child_process';
  • shell (weak) LE-VAI-designesy-org-12528fb/packages/score/test/cli.test.mjs :12 import { execFileSync } from 'node:child_process';
  • shell (weak) LE-VAI-designesy-org-12528fb/scripts/deploy-prod.mjs :24 import { spawnSync } from 'child_process';

network 39

  • net LE-VAI-designesy-org-12528fb/action/dist/index.js :76 const res = await fetch(apiUrl, {
  • net LE-VAI-designesy-org-12528fb/apps/site/app/api/compare/route.ts :524 fetch(new URL('/api/score', 'https://www.designesy.org'), {
  • net LE-VAI-designesy-org-12528fb/apps/site/app/api/cron/rescore/route.ts :34 const res = await fetch(`${baseUrl}/api/score`, {
  • net LE-VAI-designesy-org-12528fb/apps/site/app/api/leaderboard/submit/route.ts :78 const scoreResponse = await fetch(new URL('/api/score', request.url).toString(), {
  • net LE-VAI-designesy-org-12528fb/apps/site/app/api/mcp/route.ts :247 const res = await fetch(scoreUrl, {
  • net LE-VAI-designesy-org-12528fb/apps/site/app/api/report/route.ts :107 fetch(new URL('/api/score', BASE_URL), {
  • net LE-VAI-designesy-org-12528fb/apps/site/app/api/score/audit/route.ts :125 const resp = await fetch(psiUrl.href, {
  • net LE-VAI-designesy-org-12528fb/apps/site/app/api/waitlist/continuity/route.ts :150 const res = await fetch('https://api.resend.com/emails', {
  • net LE-VAI-designesy-org-12528fb/apps/site/app/compare/compare-form.tsx :105 const resp = await fetch('/api/compare', {
  • net LE-VAI-designesy-org-12528fb/apps/site/app/continuity/waitlist-form.tsx :35 const res = await fetch('/api/waitlist/continuity', {
  • net LE-VAI-designesy-org-12528fb/apps/site/app/drift/drift-form.tsx :59 const resp = await fetch('/api/drift', {
  • net LE-VAI-designesy-org-12528fb/apps/site/app/guardrails/guardrails-form.tsx :86 const resp = await fetch('/api/guardrails', {
show 27 more
  • net LE-VAI-designesy-org-12528fb/apps/site/app/leaderboard/submit-form/submit-form.tsx :34 const res = await fetch('/api/leaderboard/submit', {
  • net LE-VAI-designesy-org-12528fb/apps/site/app/lib/command-palette.tsx :212 pagefindPromise = fetch(`${PAGEFIND_DIR}/pagefind-version.json`, { cache: 'no-store' })
  • net LE-VAI-designesy-org-12528fb/apps/site/app/lib/report-app-html.ts :325 fetch(API, { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: body })
  • net LE-VAI-designesy-org-12528fb/apps/site/app/lib/url-guard.ts :33 // DNS-rebinding (TOCTOU) note: fetch() re-resolves DNS at connect time, so a
  • net LE-VAI-designesy-org-12528fb/apps/site/app/monitor/monitor-form.tsx :139 const resp = await fetch('/api/monitor', {
  • net LE-VAI-designesy-org-12528fb/apps/site/app/readiness/readiness-form.tsx :60 const resp = await fetch('/api/readiness', {
  • net LE-VAI-designesy-org-12528fb/apps/site/app/report/report-form.tsx :72 const resp = await fetch('/api/report', {
  • net LE-VAI-designesy-org-12528fb/apps/site/app/score/report/score-report.tsx :122 const res = await fetch('/api/score', {
  • net LE-VAI-designesy-org-12528fb/apps/site/app/score/score-form.tsx :388 const resp = await fetch('/api/score', {
  • net LE-VAI-designesy-org-12528fb/apps/site/app/score/verify-form.tsx :435 fetch('/api/report', {
  • net LE-VAI-designesy-org-12528fb/apps/site/batch-run.mjs :9 const lb = await (await fetch(`${BASE}/api/leaderboard`)).json();
  • net (weak) LE-VAI-designesy-org-12528fb/apps/site/scripts/blind-comparison.mjs :46 return fetch(`http://${CDP_HOST}:${CDP_PORT}/json/new?${encodeURIComponent(url)}`, { method: 'PUT' })
  • net (weak) LE-VAI-designesy-org-12528fb/apps/site/scripts/rank-bounds.mjs :107 const lb = await (await fetch(`${BASE}/api/leaderboard`)).json();
  • net (weak) LE-VAI-designesy-org-12528fb/apps/site/scripts/score-diff.mjs :132 const lb = await (await fetch(`${BASE}/api/leaderboard`)).json();
  • net (weak) LE-VAI-designesy-org-12528fb/apps/site/scripts/sensitivity-analysis.mjs :166 const lb = await (await fetch(`${BASE}/api/leaderboard`)).json();
  • net LE-VAI-designesy-org-12528fb/cli/designesy-score.mjs :32 import https from 'node:https';
  • net LE-VAI-designesy-org-12528fb/packages/designesy-mcp/cdp-cwv-expr.cjs :11 const http = require('http');
  • net LE-VAI-designesy-org-12528fb/packages/designesy-mcp/cdp-viewport-check.cjs :17 const http = require('http');
  • net LE-VAI-designesy-org-12528fb/packages/score/src/engine.ts :21 import { get as httpsGet } from 'node:https';
  • net (weak) LE-VAI-designesy-org-12528fb/packages/score/test/engine.test.mjs :10 import { createServer } from 'node:http';
  • net (weak) LE-VAI-designesy-org-12528fb/packages/score/test/parity.test.mjs :14 import { request as httpsRequest } from 'node:https';
  • net LE-VAI-designesy-org-12528fb/packages/tokens/src/cli.ts :16 import { get } from 'node:https';
  • net LE-VAI-designesy-org-12528fb/packages/vai-icons/demo/serve.mjs :5 import { createServer } from 'node:http';
  • net LE-VAI-designesy-org-12528fb/packages/vai-icons/src/core.js :71 const r = await fetch(url);
  • net LE-VAI-designesy-org-12528fb/packages/vai-motion/demo/serve.mjs :8 import { createServer } from 'node:http';
  • net (weak) LE-VAI-designesy-org-12528fb/scripts/deploy-prod.mjs :102 const resp = await fetch('https://www.designesy.org', {
  • net (weak) LE-VAI-designesy-org-12528fb/scripts/rescore-leaderboard.mjs :92 const res = await fetch(SCORE_API, {

secrets 8

  • secrets LE-VAI-designesy-org-12528fb/action/dist/index.js :239 const ghToken = readInput('github-token', '') || process.env.GITHUB_TOKEN || '';
  • secrets LE-VAI-designesy-org-12528fb/apps/site/app/api/admin/limiter-health/route.ts :33 const cronSecret = process.env.CRON_SECRET;
  • secrets LE-VAI-designesy-org-12528fb/apps/site/app/api/admin/purge/route.ts :24 const cronSecret = process.env.CRON_SECRET;
  • secrets LE-VAI-designesy-org-12528fb/apps/site/app/api/cron/rescore/route.ts :22 const cronSecret = process.env.CRON_SECRET;
  • secrets LE-VAI-designesy-org-12528fb/apps/site/app/api/monitor/route.ts :628 const apiKey = process.env.RESEND_API_KEY;
  • secrets LE-VAI-designesy-org-12528fb/apps/site/app/api/score/audit/route.ts :106 const apiKey = process.env.PSI_API_KEY;
  • secrets LE-VAI-designesy-org-12528fb/apps/site/app/api/waitlist/continuity/route.ts :6 const RESEND_API_KEY = process.env.RESEND_API_KEY || '';
  • secrets LE-VAI-designesy-org-12528fb/apps/site/middleware.ts :89 const redisToken = process.env.UPSTASH_REDIS_REST_TOKEN;

tool registrations 17

  • designesy_catalog LE-VAI-designesy-org-12528fb/apps/site/app/api/mcp/route.ts :70
  • designesy_contract LE-VAI-designesy-org-12528fb/apps/site/app/api/mcp/route.ts :107
  • designesy_design_review LE-VAI-designesy-org-12528fb/apps/site/app/api/mcp/route.ts :136
  • designesy_skill_md LE-VAI-designesy-org-12528fb/apps/site/app/api/mcp/route.ts :177
  • designesy_agent_json LE-VAI-designesy-org-12528fb/apps/site/app/api/mcp/route.ts :191
  • designesy_llms_txt LE-VAI-designesy-org-12528fb/apps/site/app/api/mcp/route.ts :205
  • designesy_llms_full_txt LE-VAI-designesy-org-12528fb/apps/site/app/api/mcp/route.ts :219
  • designesy_score LE-VAI-designesy-org-12528fb/apps/site/app/api/mcp/route.ts :235
  • designesy_tokens_score LE-VAI-designesy-org-12528fb/apps/site/app/api/mcp/route.ts :272
  • designesy_a11y_score LE-VAI-designesy-org-12528fb/apps/site/app/api/mcp/route.ts :560
  • designesy_motion_score LE-VAI-designesy-org-12528fb/apps/site/app/api/mcp/route.ts :665
  • designesy_drift_score LE-VAI-designesy-org-12528fb/apps/site/app/api/mcp/route.ts :861
show 5 more
  • designesy_readiness_score LE-VAI-designesy-org-12528fb/apps/site/app/api/mcp/route.ts :893
  • designesy_guardrails LE-VAI-designesy-org-12528fb/apps/site/app/api/mcp/route.ts :925
  • designesy_monitor_score LE-VAI-designesy-org-12528fb/apps/site/app/api/mcp/route.ts :959
  • designesy_compare LE-VAI-designesy-org-12528fb/apps/site/app/api/mcp/route.ts :1006
  • designesy_report LE-VAI-designesy-org-12528fb/apps/site/app/api/mcp/route.ts :1050

install hooks 4

  • prepublishOnly LE-VAI-designesy-org-12528fb/packages/cli/package.json :58 npm run build
  • prepublishOnly LE-VAI-designesy-org-12528fb/packages/score/package.json :53 npm run build
  • prepublishOnly LE-VAI-designesy-org-12528fb/packages/stylelint-plugin-dtcg-tokens/package.json :92 npm run build
  • prepublishOnly LE-VAI-designesy-org-12528fb/packages/tokens/package.json :66 npm run build

obfuscation 1

  • dynamic require()/import() LE-VAI-designesy-org-12528fb/packages/vai-icons/src/core.js :68 import(`../icons/${contract.file}?raw`).catch(async () => {

perm:untrusted 5

  • untrusted LE-VAI-designesy-org-12528fb/apps/site/batch-run.mjs :9 const lb = await (await fetch(`${BASE}/api/leaderboard`)).json();
  • untrusted (weak) LE-VAI-designesy-org-12528fb/apps/site/scripts/blind-comparison.mjs :217 const lb = await (await fetch(`${BASE}/api/leaderboard`)).json();
  • untrusted (weak) LE-VAI-designesy-org-12528fb/apps/site/scripts/rank-bounds.mjs :107 const lb = await (await fetch(`${BASE}/api/leaderboard`)).json();
  • untrusted (weak) LE-VAI-designesy-org-12528fb/apps/site/scripts/score-diff.mjs :132 const lb = await (await fetch(`${BASE}/api/leaderboard`)).json();
  • untrusted (weak) LE-VAI-designesy-org-12528fb/apps/site/scripts/sensitivity-analysis.mjs :166 const lb = await (await fetch(`${BASE}/api/leaderboard`)).json();