
Research
/Security News
Popular npm Packages in the keyv and Cacheable Namespaces Compromised in Active Supply Chain Attack
Popular npm packages keyv and cacheable compromised.
miromiro-mcp
Advanced tools
MCP server for the MiroMiro design-extraction API — give your coding agent the real code, design tokens, assets, SVGs, fonts, and Lottie of any website.
MCP server for the MiroMiro design-extraction API. Give your AI agent the real design of any live website - brand colors, fonts, design tokens, SVGs, images, Lottie animations, and paste-ready component code - so it builds from actual values instead of guessing from a screenshot.
Works with Claude (web, desktop, Claude Code), ChatGPT, Cursor, Windsurf, Codex, and any MCP client.
Install as a plugin to get the tools plus three skills that teach Claude when to reach for
each one (clone-section, match-brand, extract-assets):
claude plugin marketplace add anthropics/claude-plugins-community
claude plugin install miromiro@claude-community
The plugin uses the remote server, so there is nothing to install and no key to paste - on first use it opens a one-click MiroMiro sign-in that links a free account (300 credits/month, no card).
A hosted server lives at:
https://miromiro.app/mcp
Paste that URL into any client that accepts a remote MCP server. On first use it opens a one-click MiroMiro sign-in that links a free account (300 credits/month, no card).
{ "mcpServers": { "miromiro": { "url": "https://miromiro.app/mcp" } } } to ~/.cursor/mcp.json.?access_key=mm_live_... to the URL, or send it as an Authorization: Bearer header.Prefer a local stdio process with the key in an env var? Get a free key at miromiro.app/api/dashboard, then:
Cursor (~/.cursor/mcp.json) / Windsurf (Settings → MCP):
{
"mcpServers": {
"miromiro": {
"command": "npx",
"args": ["-y", "miromiro-mcp"],
"env": { "MIROMIRO_API_KEY": "mm_live_your_key" }
}
}
}
Claude Code (run in your terminal, not inside a claude session):
claude mcp add miromiro -s user \
--env MIROMIRO_API_KEY=mm_live_your_key \
-- npx -y miromiro-mcp
| Tool | What it returns | Credits |
|---|---|---|
extract_code | A section of a live page as a paste-ready component (Tailwind, HTML+CSS, JSX or Vue) plus the tokens it uses - start here to rebuild real UI | 25 |
extract_brand | Named color roles (primary/accent/background/text), palette, fonts split by role, logo, social profiles, and a 0-1 confidence score | 15 |
extract_design_tokens | Full token system with usage counts; format: css or tailwind for paste-ready output, dtcg for a W3C Design Tokens file (Style Dictionary / Figma variables) | 10 |
extract_fonts | Every font file and family the site loads, with weights, formats, and file URLs | 5 |
extract_videos | Video files, og:video, and player embeds (YouTube, Vimeo, Wistia, Loom), tagged by source | 1 |
extract_audio | Audio files, og:audio, and podcast enclosures, tagged by source | 1 |
extract_lottie | Lottie animation JSON files declared in the page | 3 |
extract_svgs | Inline SVG code (sanitized, paste-ready) plus external SVG file URLs | 1 |
extract_assets | Every image URL on a page, tagged by source, with alt text | 1 |
All tools are read-only and retry-safe. Identical calls within 24 hours are served from cache for free, and failed calls are never billed.
Remote results are trimmed by default so a big page cannot flood the chat context, and every trimmed response says exactly what was dropped. Two optional arguments loosen it per call:
limit (up to 200) - raise the item cap: "give me 80 SVGs, not 20"full_output: true - complete long strings, like entire inline SVG markupThe REST API and this local npm server always return everything untrimmed, so limit and
full_output apply to the remote server only. Every tool on both servers accepts
render: true, plus two more shared arguments:
fresh: true - skip the 24-hour cache and re-extract the live page (charged normally); use when the site just changedscreenshot: true (requires render: true) - the result gains a screenshot field: a public URL of a 1440x900 capture of the page, live for 7 days, at no extra credits - show it to the user to verify an extraction. Pass 'full' instead of true for the entire page height."Rebuild stripe.com's pricing section in React"
The agent calls extract_code with the URL, gets the section's real markup, colors, fonts, and spacing, and adapts actual values instead of guessing.
"Build a dashboard in the style of linear.app"
The agent calls extract_brand and extract_design_tokens, gets Linear's real colors, fonts, and spacing scale, and builds to match.
"What fonts does apple.com use?"
The agent calls extract_fonts and returns every family with its font file URLs and weights.
render: true on any remote-server tool to run the page in a real browser first so its JavaScript executes (+5 credits).API docs · Playground (no account) · Pricing · Changelog · Connect page
MIT © MiroMiro
FAQs
MCP server for the MiroMiro design-extraction API — give your coding agent the real code, design tokens, assets, SVGs, fonts, and Lottie of any website.
The npm package miromiro-mcp receives a total of 451 weekly downloads. As such, miromiro-mcp popularity was classified as not popular.
We found that miromiro-mcp demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
Popular npm packages keyv and cacheable compromised.

Security News
A misconfiguration gave three Anthropic models internet access, and one, believing it was in a simulation, shipped a credential-stealing package to PyPI.

Security News
/Company News
Socket has joined the new Composer and Packagist sponsorship program as a launch sponsor, supporting the team that keeps PHP's package ecosystem secure.