MCP Observatory
3m ago Tracked 59,469 Last 3m ago 24h 2,466
github TypeScript analyzed f8b2ba4

southleft/story-ui

github

AI-powered Storybook story generator — works with any framework, any design system, any LLM provider

maintainer
southleft
licence
MIT
first seen
2026-07-03
last seen
2026-09-06
releases · 30d
54
short id

Drift inferred · capture-to-capture

  1. HIGH code analysis flagged dynamic code execution in southleft/story-ui
  2. HIGH code analysis flagged dynamic code execution in southleft/story-ui
  3. HIGH code analysis flagged dynamic code execution in southleft/story-ui
  4. HIGH code analysis flagged dynamic code execution in southleft/story-ui
  5. HIGH code analysis flagged dynamic code execution in southleft/story-ui
capabilities 8 tools
transport stdio · streamable-http · http · sse counts 8 tools · 0 res · 0 prompts permission surface via code analysis

tools

  • delete-story
  • generate-story
  • get-component-props
  • get-story
  • list-components
  • list-stories
  • test-connection
  • update-story
skills & danger signals github-tarball
prompt-surface shipped agent-instruction files + hidden-content / dangerous-code findings — quoted from the analyzed source

analyzed commit f8b2ba4 · analyzer v33 · 1w ago

skills & prompt files 1

danger signals2

code evidence vv5.17.8 · github-tarball
evidence-backed findings quoted directly from the published source artifact — not inferred

code files: 298

filesystem 103

  • fs (weak) southleft-story-ui-f8b2ba4/__tests__/attachments-and-tokens.test.ts :2 import fs from 'fs';
  • fs (weak) southleft-story-ui-f8b2ba4/__tests__/canvas-scope-and-versions.test.ts :2 import fs from 'fs';
  • fs (weak) southleft-story-ui-f8b2ba4/__tests__/checker-props.test.ts :14 import fs from 'fs';
  • fs (weak) southleft-story-ui-f8b2ba4/__tests__/component-shape.test.ts :13 import fs from 'fs';
  • fs (weak) southleft-story-ui-f8b2ba4/__tests__/deep-import-path-resolves.test.ts :12 import fs from 'fs';
  • fs (weak) southleft-story-ui-f8b2ba4/__tests__/federated-barrel-props.test.ts :21 import fs from 'fs';
  • fs (weak) southleft-story-ui-f8b2ba4/__tests__/generation-narration.test.ts :20 import fs from 'fs';
  • fs (weak) southleft-story-ui-f8b2ba4/__tests__/helpers/hostProject.ts :27 import fs from 'fs';
  • fs (weak) southleft-story-ui-f8b2ba4/__tests__/host-contract.test.ts :20 import fs from 'fs';
  • fs (weak) southleft-story-ui-f8b2ba4/__tests__/icon-vocabulary.test.ts :8 import fs from 'fs';
  • fs (weak) southleft-story-ui-f8b2ba4/__tests__/import-isolation.test.ts :2 import fs from 'fs';
  • fs (weak) southleft-story-ui-f8b2ba4/__tests__/init-nondestructive.test.ts :6 import fs from 'fs';
show 28 more
  • fs (weak) southleft-story-ui-f8b2ba4/__tests__/init-noninteractive.test.ts :7 import fs from 'fs';
  • fs (weak) southleft-story-ui-f8b2ba4/__tests__/init-workspace.test.ts :15 import fs from 'fs';
  • fs (weak) southleft-story-ui-f8b2ba4/__tests__/install-fidelity.test.ts :8 import fs from 'fs';
  • fs (weak) southleft-story-ui-f8b2ba4/__tests__/installer-fresh-project.test.ts :12 import fs from 'fs';
  • fs (weak) southleft-story-ui-f8b2ba4/__tests__/integration/editable-props-local-source.test.ts :18 import fs from 'fs';
  • fs (weak) southleft-story-ui-f8b2ba4/__tests__/integration/generation-pipeline.test.ts :12 import * as fs from 'fs';
  • fs (weak) southleft-story-ui-f8b2ba4/__tests__/integration/helpers/fixtureProject.ts :1 import * as fs from 'fs';
  • fs (weak) southleft-story-ui-f8b2ba4/__tests__/knowledge-cache-fingerprint.test.ts :12 import fs from 'fs';
  • fs (weak) southleft-story-ui-f8b2ba4/__tests__/layout-behaviour.test.ts :18 import fs from 'fs';
  • fs (weak) southleft-story-ui-f8b2ba4/__tests__/library-source-dependencies.test.ts :8 import fs from 'fs';
  • fs (weak) southleft-story-ui-f8b2ba4/__tests__/local-component-facts.test.ts :13 import fs from 'fs';
  • fs (weak) southleft-story-ui-f8b2ba4/__tests__/local-named-imports.test.ts :18 import fs from 'fs';
  • fs (weak) southleft-story-ui-f8b2ba4/__tests__/local-prop-facts-conformance.test.ts :10 import fs from 'fs';
  • fs (weak) southleft-story-ui-f8b2ba4/__tests__/manifest-updated-at.test.ts :11 import fs from 'fs';
  • fs (weak) southleft-story-ui-f8b2ba4/__tests__/prop-conformance.test.ts :12 import fs from 'fs';
  • fs (weak) southleft-story-ui-f8b2ba4/__tests__/prop-doc-extraction.test.ts :15 import fs from 'fs';
  • fs (weak) southleft-story-ui-f8b2ba4/__tests__/prop-extractor-local-root.test.ts :12 import fs from 'fs';
  • fs (weak) southleft-story-ui-f8b2ba4/__tests__/props-cache-per-package-root.test.ts :17 import fs from 'fs';
  • fs (weak) southleft-story-ui-f8b2ba4/__tests__/reexport-discovery.test.ts :18 import fs from 'fs';
  • fs (weak) southleft-story-ui-f8b2ba4/__tests__/relocate-imports.test.ts :2 import fs from 'fs';
  • fs (weak) southleft-story-ui-f8b2ba4/__tests__/source-facts-jsdoc.test.ts :13 import fs from 'fs';
  • fs (weak) southleft-story-ui-f8b2ba4/__tests__/spacing-vocabulary.test.ts :12 import fs from 'fs';
  • fs (weak) southleft-story-ui-f8b2ba4/__tests__/story-artifacts.test.ts :2 import fs from 'fs';
  • fs (weak) southleft-story-ui-f8b2ba4/__tests__/story-file-name.test.ts :7 import fs from 'fs';
  • fs (weak) southleft-story-ui-f8b2ba4/__tests__/story-history.test.ts :16 import fs from 'fs';
  • fs (weak) southleft-story-ui-f8b2ba4/__tests__/storybook-config.test.ts :16 import fs from 'fs';
  • fs (weak) southleft-story-ui-f8b2ba4/__tests__/storybook-watcher.test.ts :15 import fs from 'fs';
  • fs (weak) southleft-story-ui-f8b2ba4/__tests__/styling-facts.test.ts :22 import fs from 'fs';

63 more not shown — this panel samples each group; the count above is the real total.

shell / exec 7

  • shell southleft-story-ui-f8b2ba4/bench/resolution.mjs :685 const { spawnSync } = await import('child_process');
  • shell southleft-story-ui-f8b2ba4/cli/deploy.ts :1 import { execSync, spawnSync } from 'child_process';
  • shell southleft-story-ui-f8b2ba4/cli/index.ts :4 import { spawn } from 'child_process';
  • shell southleft-story-ui-f8b2ba4/cli/setup.ts :13 import { execSync } from 'child_process';
  • shell southleft-story-ui-f8b2ba4/cli/update.ts :3 import { execSync } from 'child_process';
  • shell southleft-story-ui-f8b2ba4/mcp-server/routes/canvasGenerate.ts :20 import { exec } from 'child_process';
  • shell southleft-story-ui-f8b2ba4/mcp-server/routes/handoff.ts :21 import { execFile } from 'child_process';

network 34

  • net (weak) southleft-story-ui-f8b2ba4/__tests__/component-shape.test.ts :85 class Api { fetch() { return 1; } }
  • net (weak) southleft-story-ui-f8b2ba4/__tests__/recompile-wait.test.ts :15 import http from 'http';
  • net (weak) southleft-story-ui-f8b2ba4/__tests__/workspace-chrome.test.ts :83 expect(cleanNotice('Storybook was unreachable\n at fetch (node:internal)\n at run')).toBe('Storybook was unreachable');
  • net southleft-story-ui-f8b2ba4/bench/componentSelection.mjs :372 const res = await fetch(`${MCP}/mcp/generate-story-stream`, {
  • net southleft-story-ui-f8b2ba4/bench/fidelity.mjs :210 const r = await fetch(`${opts.server}${route}`, { signal: AbortSignal.timeout(120_000) });
  • net southleft-story-ui-f8b2ba4/bench/fidelity/screenshot.mjs :36 const res = await fetch(`${base}/index.json?t=${Date.now()}`, { headers: { 'Cache-Control': 'no-cache' }, signal: AbortSignal.timeout(5000) });
  • net southleft-story-ui-f8b2ba4/bench/fidelity/sse.mjs :34 res = await fetch(`${server.replace(/\/+$/, '')}/mcp/generate-story-stream`, {
  • net southleft-story-ui-f8b2ba4/bench/firstAttempt.mjs :118 const res = await fetch(`${server}/mcp/generate-story-stream`, {
  • net southleft-story-ui-f8b2ba4/bench/resolution.mjs :469 const res = await fetch(`${env.storybook.replace(/\/+$/, '')}/manifests/components.json`, {
  • net southleft-story-ui-f8b2ba4/bench/smoke.mjs :973 health = await fetch(`http://127.0.0.1:${spec.split(':')[1]}/health`, { signal: AbortSignal.timeout(4000) }).then(r => r.ok).catch(() => false);
  • net southleft-story-ui-f8b2ba4/cli/check.ts :376 const res = await fetch(`${server}/health`, { signal: AbortSignal.timeout(1500) });
  • net southleft-story-ui-f8b2ba4/cli/index.ts :11 import net from 'net';
show 22 more
  • net southleft-story-ui-f8b2ba4/cli/setup.ts :12 import net from 'net';
  • net southleft-story-ui-f8b2ba4/mcp-server/mcp-stdio-server.ts :9 import fetch from 'node-fetch';
  • net southleft-story-ui-f8b2ba4/mcp-server/routes/canvasGenerate.ts :421 { pattern: /\bfetch\s*\(/g, label: 'fetch()', replacement: '/* [sanitized: fetch] */void(' },
  • net southleft-story-ui-f8b2ba4/mcp-server/routes/mcpRemote.ts :27 import fetch from 'node-fetch';
  • net southleft-story-ui-f8b2ba4/story-generator/imageProcessor.ts :296 const response = await fetch(url);
  • net southleft-story-ui-f8b2ba4/story-generator/knowledge/storybookCatalog.ts :75 const res = await fetch(`${base}/index.json`, { signal: controller.signal });
  • net southleft-story-ui-f8b2ba4/story-generator/llm-providers/claude-provider.ts :481 const response = await fetch(ANTHROPIC_API_URL, {
  • net southleft-story-ui-f8b2ba4/story-generator/llm-providers/gemini-provider.ts :353 const response = await fetch(url, {
  • net southleft-story-ui-f8b2ba4/story-generator/llm-providers/http-utils.ts :51 * fetch() with exponential backoff on 429/5xx and transient network errors.
  • net southleft-story-ui-f8b2ba4/story-generator/llm-providers/openai-provider.ts :343 const response = await fetch(OPENAI_API_URL, {
  • net southleft-story-ui-f8b2ba4/story-generator/runtimeValidator.ts :199 const response = await fetch(url, { signal: controller.signal });
  • net southleft-story-ui-f8b2ba4/story-generator/storybook-redirect-addon-auto.js :29 const response = await fetch(`http://localhost:${port}/story-ui/redirects.js`, {
  • net southleft-story-ui-f8b2ba4/story-generator/storybookMcpClient.ts :575 const response = await fetch(url, {
  • net southleft-story-ui-f8b2ba4/story-generator/storybookOrigin.ts :49 const res = await fetch(`${trim(url)}/index.json`, { signal: controller.signal, cache: 'no-store' } as RequestInit);
  • net southleft-story-ui-f8b2ba4/story-generator/verify/renderHarness.ts :407 const res = await fetch(`${storybookUrl.replace(/\/+$/, '')}/index.json?t=${Date.now()}`, {
  • net southleft-story-ui-f8b2ba4/templates/StoryUI/DesignContextPanel.tsx :73 const res = await fetch(api());
  • net southleft-story-ui-f8b2ba4/templates/StoryUI/HandoffDialog.tsx :68 const res = await fetch(`${apiBase}/story-ui/handoff`, {
  • net southleft-story-ui-f8b2ba4/templates/StoryUI/StoryUIPanel.tsx :38 if (!token) return fetch(input, init);
  • net southleft-story-ui-f8b2ba4/templates/StoryUI/manager.tsx :169 const res = await fetch('index.json');
  • net southleft-story-ui-f8b2ba4/templates/StoryUI/voice/VoiceCanvas.tsx :175 const response = await fetch(`${apiBase}/mcp/canvas-generate`, {
  • net southleft-story-ui-f8b2ba4/templates/StoryUIV2/api.ts :26 if (!token) return fetch(input, init);
  • net southleft-story-ui-f8b2ba4/templates/StoryUIV2/useGeneration.ts :834 const res = await fetch(`/index.json?t=${Date.now()}`, { cache: 'no-store' });

secrets 2

  • secrets (weak) southleft-story-ui-f8b2ba4/__tests__/claude-stream-finish-reason.test.ts :199 process.env.ANTHROPIC_API_KEY = process.env.ANTHROPIC_API_KEY || 'test-key';
  • secrets southleft-story-ui-f8b2ba4/story-generator/llm-providers/index.ts :212 const claudeKey = process.env.CLAUDE_API_KEY || process.env.ANTHROPIC_API_KEY;

tool registrations 16

  • test-connection southleft-story-ui-f8b2ba4/mcp-server/mcp-stdio-server.ts :90
  • generate-story southleft-story-ui-f8b2ba4/mcp-server/mcp-stdio-server.ts :98
  • list-components southleft-story-ui-f8b2ba4/mcp-server/mcp-stdio-server.ts :116
  • list-stories southleft-story-ui-f8b2ba4/mcp-server/mcp-stdio-server.ts :129
  • get-story southleft-story-ui-f8b2ba4/mcp-server/mcp-stdio-server.ts :137
  • delete-story southleft-story-ui-f8b2ba4/mcp-server/mcp-stdio-server.ts :151
  • get-component-props southleft-story-ui-f8b2ba4/mcp-server/mcp-stdio-server.ts :165
  • update-story southleft-story-ui-f8b2ba4/mcp-server/mcp-stdio-server.ts :179
  • test-connection southleft-story-ui-f8b2ba4/mcp-server/routes/mcpRemote.ts :120
  • generate-story southleft-story-ui-f8b2ba4/mcp-server/routes/mcpRemote.ts :128
  • list-components southleft-story-ui-f8b2ba4/mcp-server/routes/mcpRemote.ts :146
  • list-stories southleft-story-ui-f8b2ba4/mcp-server/routes/mcpRemote.ts :159
show 4 more
  • get-story southleft-story-ui-f8b2ba4/mcp-server/routes/mcpRemote.ts :167
  • delete-story southleft-story-ui-f8b2ba4/mcp-server/routes/mcpRemote.ts :181
  • get-component-props southleft-story-ui-f8b2ba4/mcp-server/routes/mcpRemote.ts :195
  • update-story southleft-story-ui-f8b2ba4/mcp-server/routes/mcpRemote.ts :209

install hooks 2

  • prepublishOnly southleft-story-ui-f8b2ba4/package.json :52 npm run build
  • prepare southleft-story-ui-f8b2ba4/package.json :58 test -d .git && husky || true; npm run build

declared dependencies 39

  • @modelcontextprotocol/sdk@^1.23.0
  • @radix-ui/themes@^3.3.0
  • chalk@^5.3.0
  • commander@^11.0.0
  • cors@^2.8.5
  • dotenv@^16.3.1
  • express@^4.18.2
  • glob@^11.0.3
  • http-proxy-middleware@^3.0.0
  • inquirer@^9.2.0
  • node-fetch@^2.6.7
  • react-live@^4.1.8
show 27 more
  • typescript@^5.8.3
  • @commitlint/cli@^19.6.1
  • @commitlint/config-conventional@^19.6.0
  • @semantic-release/changelog@^6.0.3
  • @semantic-release/commit-analyzer@^13.0.0
  • @semantic-release/git@^10.0.1
  • @semantic-release/github@^10.3.5
  • @semantic-release/npm@^12.0.1
  • @semantic-release/release-notes-generator@^14.0.1
  • @types/cors@^2.8.17
  • @types/express@^4.17.21
  • @types/glob@^8.1.0
  • @types/inquirer@^9.0.0
  • @types/node@^20.4.2
  • @types/node-fetch@^2.6.12
  • @types/react@^19.2.7
  • @types/react-dom@^19.2.3
  • commitizen@^4.3.1
  • concurrently@^8.2.0
  • cz-conventional-changelog@^3.3.0
  • esbuild@^0.25.5
  • husky@^9.1.7
  • semantic-release@^24.2.0
  • ts-node@^10.9.2
  • vitest@^4.1.0
  • @storybook/react@>=8.0.0
  • react@>=16.8.0

obfuscation 2

  • dynamic require()/import() southleft-story-ui-f8b2ba4/bench/resolution.mjs :373 const { loadUserConfig } = await import(pathToFileURL(`${DIST}/story-generator/configLoader.js`).href);
  • dynamic require()/import() southleft-story-ui-f8b2ba4/cli/setup.ts :2233 const mod = await import('${registryImport}');