
Company News
Socket Joins New OpenJS Program to Fund Node.js Security Work
Socket is joining the OpenJS Security Stewardship Program to fund Node.js vulnerability research, maintainer remediation, and security releases.
Deterministic UI policy and quality gates for coding agents.
Quick start · Output · Skills & MCP · Ecosystems · Docs
OrchestrUI inspects a structured project profile, preserves compatible owners, and returns the smallest admissible UI composition with evidence for every decision.
Requires Node.js 20+. Add the published read-only server to an MCP host:
{
"mcpServers": {
"orchestrui": {
"command": "npx",
"args": ["-y", "orchestrui@latest"]
}
}
}
git clone --depth 1 https://github.com/ECD5A/OrchestrUI.git
cd OrchestrUI
bash scripts/install-codex.sh
git clone --depth 1 https://github.com/ECD5A/OrchestrUI.git
Set-Location OrchestrUI
powershell -ExecutionPolicy Bypass -File scripts\install-codex.ps1
git clone https://github.com/ECD5A/OrchestrUI.git
cd OrchestrUI
npm ci && npm run check
npm run benchmark
Contributions are welcome — see CONTRIBUTING.md for the short path from fork to PR.
Use them from a frontend project:
$ui-library-router plan the smallest compatible UI stack.
$ui-orchestrator implement the approved plan.
$ui-quality-audit audit the rendered result.
{
"input_mode": "structured-profiles",
"selected": ["bklit-ui"],
"owners": {
"base-system": "host:shadcn-ui",
"data-visualization": "bklit-ui"
},
"rejected": [{ "id": "daisyui", "rule": "base-system-conflict" }]
}
The committed suite passes 50/50 structured scenarios, 8/8 independently specified adversarial goldens, and three project fixtures in CI.
ui-library-router — inspects the host and assigns role ownership.ui-orchestrator — integrates approved pieces into one visual contract.ui-quality-audit — checks coherence, accessibility, responsiveness, motion, performance, and licensing.inspect_project, list_libraries, recommend_stack, get_library_guidance, search_components, get_install_instructions, and audit_plan.Published through npm, the official MCP Registry, and versioned GitHub Releases. Local plugin configuration is in .mcp.json; setup, architecture, security, licensing, and contribution details live in docs/, SECURITY.md, THIRD_PARTY.md, and CONTRIBUTING.md.
The MCP surface is read-only and uses public upstream metadata; implementation code and third-party assets remain in the host project.
| Ecosystem | Role |
|---|---|
| Kokonut UI | selective React/shadcn product polish |
| React Bits | one signature creative effect |
| daisyUI | intentional Tailwind semantic base |
| Bklit UI | charts and data visualization |
| Anime.js | bespoke timeline, SVG, or scroll motion |
| Rive | licensed interactive vector/state-machine graphics |
| Magic UI | animated marketing enhancement |
OrchestrUI is independent and is not affiliated with or endorsed by these upstream projects.
If OrchestrUI helps your work, you can support its ongoing maintenance:
pointoncurve.ton1ECDSA1b4d5TcZHtqNpcxmY8pBH1GgHntNTUF4vPdB6QkjCvZq18rBL4Qj4dK5ihCN75For questions about OrchestrUI, integration, consulting, or collaboration:
FAQs
Deterministic UI policy, discovery and quality gates for coding agents
The npm package orchestrui receives a total of 35 weekly downloads. As such, orchestrui popularity was classified as not popular.
We found that orchestrui demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Company News
Socket is joining the OpenJS Security Stewardship Program to fund Node.js vulnerability research, maintainer remediation, and security releases.

Security News
Two compromised GitHub Actions were re-enabled with malicious tags intact, exposing thousands of downstream repositories to Mini Shai-Hulud.

Research
/Security News
A malicious Firefox extension fetches its payload after installation to evade detection, steal Google session cookies, and automate account takeover.