
Security News
/Research
Fake Corepack Site Distributes Infostealer and Proxyware to Developers
A fake corepack.org site is impersonating the Node.js tool and delivers an infostealer and proxyware to developers who download it.
@forgespace/ui-mcp
Advanced tools
AI-driven UI generation via Model Context Protocol. Generate React, Next.js, Vue, Angular applications from natural language.
AI-driven UI and backend code generation via Model Context Protocol. 22 tools, 5 frameworks, brand-aware, npm-published, and MCP Registry-ready.
Part of the Forge Space ecosystem.

@forgespace/ui-mcp is a thin protocol adapter. All AI/generation logic lives
in @forgespace/siza-gen:
@forgespace/ui-mcp (~355 KB) @forgespace/siza-gen (~1.8 MB)
├── src/index.ts (MCP server) ├── ml/ (embeddings, quality, training)
├── tools/ (22 tool defs) ├── generators/ (react, vue, angular, svelte, html)
├── services/ (figma, analysis) ├── registry/ (502 snippets, compositions, packs)
├── resources/ (MCP resources) ├── feedback/ (self-learning, pattern promotion)
└── lib/ (browser, image) └── quality/ (anti-generic rules, diversity)
# NPX (instant)
npx -y @forgespace/ui-mcp@latest
# Global install
npm install -g @forgespace/ui-mcp && forgespace-ui-mcp
# Docker
docker build -t forgespace-ui-mcp . && docker run --rm -i forgespace-ui-mcp
Add to your MCP configuration (Claude Code, Windsurf, Cursor, VS Code):
{
"mcpServers": {
"forgespace-ui-mcp": {
"command": "npx",
"args": ["-y", "@forgespace/ui-mcp@latest"],
"env": {
"FIGMA_ACCESS_TOKEN": "your_token_here"
}
}
}
}
| Tool | Category | Description |
|---|---|---|
scaffold_full_application | Code | Full project boilerplate (React/Next.js/Vue/Angular/HTML + Tailwind) |
generate_ui_component | Code | UI components with style audit, supports shadcn/ui, Radix, Headless UI, Material, PrimeVue |
generate_form | Code | Production forms with Zod/Yup validation, multi-step flows, accessible markup |
generate_page_template | Code | Pre-built pages (landing, dashboard, auth, pricing, CRUD) |
generate_prototype | Design | Interactive HTML prototypes with navigation |
generate_design_image | Design | SVG/PNG mockups of UI screens |
image_to_component | Code | Screenshot/wireframe to framework-specific component |
refine_component | Code | Improve components via natural language feedback |
generate_api_route | Backend | API routes with validation, auth, and error handling |
generate_backend_module | Backend | Full feature modules with routes, services, middleware |
scaffold_backend | Backend | Complete backend projects with auth, DB, monitoring |
generate_from_template_pack | Code | Multi-page apps from curated packs (SaaS, Landing, AI Chat) |
figma_context_parser | Context | Read Figma files, extract tokens, map to Tailwind |
figma_push_variables | Design | Write design tokens back to Figma |
fetch_design_inspiration | Context | Extract visual metadata from URLs |
analyze_design_references | Context | Analyze design references, detect patterns |
analyze_design_image | ML | Analyze design images for training data |
analyze_component_library | Context | Analyze component library patterns |
audit_accessibility | Quality | WCAG 2.1 audit with fix suggestions |
submit_feedback | Quality | Submit feedback to improve future output |
payments_refund | Backend | Request payment refund with Zod-validated params (payment_id, amount, reason, currency) |
manage_training | ML | Training data ingestion and fine-tuning |
| Library | React | Vue | Angular | Svelte | HTML |
|---|---|---|---|---|---|
| shadcn/ui | shadcn/ui | shadcn-vue | Tailwind | bits-ui | Tailwind |
| Radix | @radix-ui/react | @radix-ui/vue | Tailwind | @radix-ui/svelte | Tailwind |
| Headless UI | @headlessui/react | @headlessui/vue | Tailwind | @headlessui/svelte | Tailwind |
| Material | @mui/material | Vuetify | @angular/material | @smui/material | Tailwind |
| PrimeVue | Headless UI | primevue | primeng | Tailwind | Tailwind |
| none | Tailwind CSS | Tailwind CSS | Tailwind CSS | Tailwind CSS | Tailwind CSS |
All generation tools accept an optional brand_identity parameter — a JSON
string from branding-mcp's
generate_brand_identity tool. When provided, brand colors, typography, and
spacing are injected into the design context.
| Variable | Required | Description |
|---|---|---|
FIGMA_ACCESS_TOKEN | Only for Figma tools | Token from Figma Settings |
SENTRY_DSN | Optional | Sentry DSN for error reporting (uncaught exceptions and unhandled rejections) |
@forgespace/ui-mcpserver.json
and mcpName metadata for registry submissionv* runs npm publish with provenance,
then publishes the same version to the MCP Registry via GitHub OIDC.github/workflows/mcp-registry-status.yml
refreshes one issue with npm and MCP Registry drift, visibility, and next
actionsnpm install && npm run build
npm test # 437 tests, 35 suites
npm run validate # lint + format + typecheck + test
This repository follows the shared Forge Space GitHub work-management baseline:
See
Forge-Space/.github GOVERNANCE.md
for the org-wide contract.
Scheduled monitoring runs that execute CodeQL require job-scoped
security-events: write permission for SARIF upload.
The scheduled Security Monitoring workflow intentionally skips Codecov upload
and relies on local coverage summary generation to reduce false alerting from
third-party action download instability.
MIT
FAQs
AI-driven UI generation via Model Context Protocol. Generate React, Next.js, Vue, Angular applications from natural language.
We found that @forgespace/ui-mcp demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
/Research
A fake corepack.org site is impersonating the Node.js tool and delivers an infostealer and proxyware to developers who download it.

Research
/Security News
A large-scale campaign abused GitHub Actions in compromised repositories to exploit CVE-2026-41940 in cPanel and WHM and steal server credentials.

Security News
Five frontier LLMs generated the same nonexistent package names, leaving 53 available for potential slopsquatting across PyPI and npm.