github HTML analyzed 728cd8d deep scan · partial (90/1,753 files)

a2uicatalog/a2ui

Typed UI vocabulary for AI agents using the a2ui protocol — 474 atoms an agent composes into real rendered interfaces across web, Google Meet, Apps Script, Google Chat and MCP Apps. MCP server, no signup.

maintainer: a2uicatalog
licence: MIT
first seen: 2026-07-31
last seen: 2026-09-08
releases · 30d: 0
short id

Drift inferred · capture-to-capture

HIGH 2026-09-08 code analysis flagged dynamic code execution ×2 in a2uicatalog/a2ui
HIGH 2026-09-07 code analysis flagged dynamic code execution ×2 in a2uicatalog/a2ui
HIGH 2026-09-06 code analysis flagged dynamic code execution ×2 in a2uicatalog/a2ui
HIGH 2026-09-06 code analysis flagged dynamic code execution ×2 in a2uicatalog/a2ui
HIGH 2026-09-06 code analysis flagged dynamic code execution ×2 in a2uicatalog/a2ui
HIGH 2026-09-05 code analysis flagged dynamic code execution ×2 in a2uicatalog/a2ui
HIGH 2026-09-05 code analysis flagged dynamic code execution ×2 in a2uicatalog/a2ui
HIGH 2026-09-05 code analysis flagged dynamic code execution ×2 in a2uicatalog/a2ui
HIGH 2026-09-05 code analysis flagged dynamic code execution ×2 in a2uicatalog/a2ui
HIGH 2026-09-05 code analysis flagged dynamic code execution ×2 in a2uicatalog/a2ui
HIGH 2026-09-05 code analysis flagged dynamic code execution ×2 in a2uicatalog/a2ui
HIGH 2026-09-03 code analysis flagged dynamic code execution ×2 in a2uicatalog/a2ui
HIGH 2026-09-02 code analysis flagged dynamic code execution ×2 in a2uicatalog/a2ui
HIGH 2026-09-02 code analysis flagged dynamic code execution ×2 in a2uicatalog/a2ui
HIGH 2026-09-02 code analysis flagged dynamic code execution ×2 in a2uicatalog/a2ui
HIGH 2026-09-01 code analysis flagged dynamic code execution ×2 in a2uicatalog/a2ui
HIGH 2026-09-01 code analysis flagged dynamic code execution ×2 in a2uicatalog/a2ui
HIGH 2026-09-01 code analysis flagged dynamic code execution ×2 in a2uicatalog/a2ui
HIGH 2026-09-01 code analysis flagged dynamic code execution ×2 in a2uicatalog/a2ui
HIGH 2026-08-29 code analysis flagged dynamic code execution ×2 in a2uicatalog/a2ui

capabilities 6 tools

transport stdio counts 6 tools · 0 res · 0 prompts permission surface via code analysis

tools

build_app
encode_url
get_atom_schema
get_ui
list_atoms
validate_payload

skills & danger signals github-tarball

prompt-surface shipped agent-instruction files + hidden-content / dangerous-code findings — quoted from the analyzed source

analyzed commit 728cd8d · analyzer v33 · 4h ago

skills & prompt files 22

agent-rules a2uicatalog-a2ui-728cd8d/AGENTS.md
agent-rules a2uicatalog-a2ui-728cd8d/CLAUDE.md
skill a2uicatalog-a2ui-728cd8d/SKILL.md
prompt-file a2uicatalog-a2ui-728cd8d/knowledge-catalogue/prompts/00-schema-generator.md
prompt-file a2uicatalog-a2ui-728cd8d/knowledge-catalogue/prompts/01-extraction-generic-demo.md
prompt-file a2uicatalog-a2ui-728cd8d/knowledge-catalogue/prompts/01-extraction.md
prompt-file a2uicatalog-a2ui-728cd8d/knowledge-catalogue/prompts/01b-grounding-check.md
prompt-file a2uicatalog-a2ui-728cd8d/knowledge-catalogue/prompts/02-suitability.md
prompt-file a2uicatalog-a2ui-728cd8d/knowledge-catalogue/prompts/03-transformer.md
prompt-file a2uicatalog-a2ui-728cd8d/prompts/a2ui-builder-gem-offline.md
prompt-file a2uicatalog-a2ui-728cd8d/prompts/a2ui-builder-gem.md
prompt-file a2uicatalog-a2ui-728cd8d/prompts/atom_generator.md
prompt-file a2uicatalog-a2ui-728cd8d/prompts/perplexity_batch_blog_atoms.md
prompt-file a2uicatalog-a2ui-728cd8d/prompts/training-md-api.md
prompt-file a2uicatalog-a2ui-728cd8d/prompts/training-md-gem.md
agent-rules a2uicatalog-a2ui-728cd8d/public/agents.md
prompt-file a2uicatalog-a2ui-728cd8d/public/prompts/a2ui-builder-gem-offline.md
prompt-file a2uicatalog-a2ui-728cd8d/public/prompts/a2ui-builder-gem.md
prompt-file a2uicatalog-a2ui-728cd8d/public/prompts/training-md-gem.md
skill a2uicatalog-a2ui-728cd8d/skills/a2ui-catalog/SKILL.md
skill a2uicatalog-a2ui-728cd8d/skills/a2ui-compose/SKILL.md
skill a2uicatalog-a2ui-728cd8d/skills/a2ui-mcp/SKILL.md

danger signals8

dynamic code execution vm exec a2uicatalog-a2ui-728cd8d/apps-script-surface/gas-fakes-schema-renderer-private/local_render.mjs :23 vm.runInThisContext(code, { filename: f });
dynamic code execution vm exec a2uicatalog-a2ui-728cd8d/apps-script-surface/gas-schema-renderer/local_serve.js :36 vm.runInThisContext(code, { filename: f });
dynamic code execution new Function() a2uicatalog-a2ui-728cd8d/scripts/test_a2ui_updates_js.mjs :14 new Function("globalThis_", js.replace(/typeof window !== 'undefined' \? window : this/, "globalThis_"))(g);
dynamic code execution indirect eval a2uicatalog-a2ui-728cd8d/scripts/test_parser_parity.mjs :22 (0, eval)(readFileSync(join(ROOT, "apps-script-surface/gas-wired-renderer/training_parser.gs"), "utf8"));
dynamic code execution indirect eval a2uicatalog-a2ui-728cd8d/scripts/test_progress_persistence.mjs :31 (0, eval)(grab('_progressKey_') + '\n' + grab('a2uiLoadProgress') + '\n' + grab('a2uiSaveProgress'));
dynamic code execution indirect eval a2uicatalog-a2ui-728cd8d/scripts/test_roadmap_parity.mjs :22 (0, eval)(readFileSync(join(ROOT, "apps-script-surface/parsers/roadmap_parser.gs"), "utf8"));
over-broad OAuth scope https://mail.google.com/ a2uicatalog-a2ui-728cd8d/apps-script-surface/gas-fakes-schema-renderer-private/atoms_workspace.js :442 var gmailUrl = 'https://mail.google.com/mail/u/0/#inbox/' + em.id;
over-broad OAuth scope https://mail.google.com/ a2uicatalog-a2ui-728cd8d/apps-script-surface/gas-schema-renderer/atoms_workspace.js :442 var gmailUrl = 'https://mail.google.com/mail/u/0/#inbox/' + em.id;

code evidence vv1.0.2 · github-tarball

evidence-backed findings quoted directly from the published source artifact — not inferred

code files: 232

filesystem 14

fs a2uicatalog-a2ui-728cd8d/apps-script-surface/gas-fakes-schema-renderer-private/gas_entry_stub.js :8 import { readFileSync } from 'fs';
fs a2uicatalog-a2ui-728cd8d/apps-script-surface/gas-fakes-schema-renderer-private/gsfiles.mjs :7 import fs from 'fs';
fs a2uicatalog-a2ui-728cd8d/apps-script-surface/gas-fakes-schema-renderer-private/local_render.mjs :7 import fs from 'fs';
fs a2uicatalog-a2ui-728cd8d/apps-script-surface/gas-schema-renderer/local_serve.js :2 import { readFileSync } from 'fs';
fs a2uicatalog-a2ui-728cd8d/mcp/cli-test.mjs :10 import { writeFileSync, unlinkSync } from 'node:fs';
fs a2uicatalog-a2ui-728cd8d/mcp/cli.mjs :29 import { readFileSync, existsSync } from 'node:fs';
fs (weak) a2uicatalog-a2ui-728cd8d/mcp/demo.mjs :12 import { readFileSync } from "fs";
fs (weak) a2uicatalog-a2ui-728cd8d/mcp/scripts/sync-data.mjs :24 import { readFileSync, writeFileSync, mkdirSync } from "fs";
fs a2uicatalog-a2ui-728cd8d/mcp/server.mjs :19 import { readFileSync, realpathSync } from "fs";
fs (weak) a2uicatalog-a2ui-728cd8d/scripts/test_a2ui_updates_js.mjs :6 import { readFileSync } from "fs";
fs (weak) a2uicatalog-a2ui-728cd8d/scripts/test_parser_parity.mjs :8 import { readFileSync } from "fs";
fs (weak) a2uicatalog-a2ui-728cd8d/scripts/test_progress_persistence.mjs :6 import { readFileSync } from 'fs';

show 2 more

fs (weak) a2uicatalog-a2ui-728cd8d/scripts/test_roadmap_parity.mjs :8 import { readFileSync, existsSync, writeFileSync, unlinkSync } from "fs";
fs (weak) a2uicatalog-a2ui-728cd8d/scripts/verify_a2ui_updates_headless.mjs :7 import { readFileSync } from "fs";

shell / exec 3

shell a2uicatalog-a2ui-728cd8d/mcp/cli-test.mjs :9 import { execFileSync } from 'node:child_process';
shell (weak) a2uicatalog-a2ui-728cd8d/scripts/test_parser_parity.mjs :9 import { execFileSync } from "child_process";
shell (weak) a2uicatalog-a2ui-728cd8d/scripts/test_roadmap_parity.mjs :9 import { execFileSync } from "child_process";

network 17

net a2uicatalog-a2ui-728cd8d/apps-script-surface/gas-fakes-schema-renderer-private/Code.js :234 var r = UrlFetchApp.fetch(url, { muteHttpExceptions: true, followRedirects: true });
net a2uicatalog-a2ui-728cd8d/apps-script-surface/gas-fakes-schema-renderer-private/atoms_ai.js :31 var response = UrlFetchApp.fetch(endpoint, {
net a2uicatalog-a2ui-728cd8d/apps-script-surface/gas-fakes-schema-renderer-private/atoms_charts.js :2734 + ' fetch(sheetUrl)'
net a2uicatalog-a2ui-728cd8d/apps-script-surface/gas-fakes-schema-renderer-private/atoms_data.js :7 // Web surface → fetch() / XHR (future)
net (weak) a2uicatalog-a2ui-728cd8d/apps-script-surface/gas-fakes-schema-renderer-private/atoms_demo.js :382 + ' fetch(sheetUrl).then(function(r){return r.text();}).then(function(t){'
net a2uicatalog-a2ui-728cd8d/apps-script-surface/gas-fakes-schema-renderer-private/bundle.js :3945 var response = UrlFetchApp.fetch(endpoint, {
net a2uicatalog-a2ui-728cd8d/apps-script-surface/gas-schema-renderer/Code.js :269 var r = UrlFetchApp.fetch(url, { muteHttpExceptions: true, followRedirects: true });
net a2uicatalog-a2ui-728cd8d/apps-script-surface/gas-schema-renderer/atoms_ai.js :31 var response = UrlFetchApp.fetch(endpoint, {
net a2uicatalog-a2ui-728cd8d/apps-script-surface/gas-schema-renderer/atoms_charts.js :2734 + ' fetch(sheetUrl)'
net a2uicatalog-a2ui-728cd8d/apps-script-surface/gas-schema-renderer/atoms_data.js :7 // Web surface → fetch() / XHR (future)
net (weak) a2uicatalog-a2ui-728cd8d/apps-script-surface/gas-schema-renderer/atoms_demo.js :382 + ' fetch(sheetUrl).then(function(r){return r.text();}).then(function(t){'
net a2uicatalog-a2ui-728cd8d/cloud-run-renderer/static/a2ui-stream-runtime.v1.js :24 * TRANSPORT: SSE via fetch()+ReadableStream, NOT the native EventSource

show 5 more

net a2uicatalog-a2ui-728cd8d/components/extendlabs/ext-button.ts :117 await fetch(endpoint, {
net a2uicatalog-a2ui-728cd8d/components/extendlabs/ext_button.ts :117 await fetch(endpoint, {
net a2uicatalog-a2ui-728cd8d/mcp/cli.mjs :74 const res = await fetch(url, {
net a2uicatalog-a2ui-728cd8d/mcp/server.mjs :209 const res = await fetch(`${url}?api=training&token=${encodeURIComponent(token)}`, {
net a2uicatalog-a2ui-728cd8d/src/worker.js :46 const res = await env.ASSETS.fetch(new URL(path, request.url));

secrets 3

secrets a2uicatalog-a2ui-728cd8d/mcp/cli.mjs :35 const KEY = process.env.A2UI_RENDER_KEY || '';
secrets (weak) a2uicatalog-a2ui-728cd8d/mcp/demo.mjs :57 if (!process.env.BUILD_API_URL || !process.env.BUILD_API_TOKEN) {
secrets a2uicatalog-a2ui-728cd8d/mcp/server.mjs :119 if (process.env.BUILD_API_TOKEN) t = t.split(process.env.BUILD_API_TOKEN).join("***");

tool registrations 6

get_ui a2uicatalog-a2ui-728cd8d/mcp/server.mjs :139
list_atoms a2uicatalog-a2ui-728cd8d/mcp/server.mjs :152
get_atom_schema a2uicatalog-a2ui-728cd8d/mcp/server.mjs :163
validate_payload a2uicatalog-a2ui-728cd8d/mcp/server.mjs :177
encode_url a2uicatalog-a2ui-728cd8d/mcp/server.mjs :187
build_app a2uicatalog-a2ui-728cd8d/mcp/server.mjs :197

install hooks 1

prepublishOnly a2uicatalog-a2ui-728cd8d/mcp/package.json :46 npm run sync-data && npm test

declared dependencies 2

@modelcontextprotocol/sdk@^1.0.0
zod@^3.23.0

perm:untrusted 3

untrusted (weak) a2uicatalog-a2ui-728cd8d/apps-script-surface/gas-fakes-schema-renderer-private/atoms_demo.js :382 + ' fetch(sheetUrl).then(function(r){return r.text();}).then(function(t){'
untrusted a2uicatalog-a2ui-728cd8d/apps-script-surface/gas-fakes-schema-renderer-private/bundle.js :12500 + ' fetch(sheetUrl).then(function(r){return r.text();}).then(function(t){'
untrusted (weak) a2uicatalog-a2ui-728cd8d/apps-script-surface/gas-schema-renderer/atoms_demo.js :382 + ' fetch(sheetUrl).then(function(r){return r.text();}).then(function(t){'