
Security News
GitHub to Block pull_request_target Workflows by Default Starting December 2
GitHub is tightening GitHub Actions security with new restrictions on privileged pull request workflows. Here's what changes and how maintainers are affected.
OrchestrUI accepts a structured HostProfile and TaskProfile, preserves existing design/chart/motion owners, and computes the smallest admissible UI composition with evidence for every selection and rejection.
HostProfile + TaskProfile → policy matrix → role ownership → conflicts → recommendation + evidence
{
"input_mode": "structured-profiles",
"selected": [{ "id": "bklit-ui", "role": "data-visualization" }],
"role_ownership": {
"base-system": "host:shadcn-ui",
"data-visualization": "bklit-ui"
},
"rejected": [{
"id": "daisyui",
"rule_id": "base-system-conflict",
"conflicting_owner": "host:shadcn-ui"
}]
}
The committed routing benchmark currently passes 50/50 structured scenarios and three project fixtures in CI.
| Ecosystem | Role |
|---|---|
| Kokonut UI | selective React/shadcn product polish |
| React Bits | one signature creative effect |
| daisyUI | intentional Tailwind semantic base |
| Bklit UI | charts and data visualization |
| Anime.js | bespoke timeline, SVG, or scroll motion |
| Rive | licensed interactive vector/state-machine graphics |
| Magic UI | animated marketing enhancement |
OrchestrUI is independent and is not affiliated with or endorsed by these upstream projects.
Requires Git and Node.js 20+.
git clone https://github.com/ECD5A/OrchestrUI.git
cd OrchestrUI
npm ci && npm run check
npm run benchmark
Install the skills:
# macOS / Linux
bash scripts/install-codex.sh
# Windows PowerShell
powershell -ExecutionPolicy Bypass -File scripts\install-codex.ps1
Use them from a frontend project:
$ui-library-router plan the smallest compatible UI stack.
$ui-orchestrator implement the approved plan.
$ui-quality-audit audit the rendered result.
ui-library-router — inspects the host and assigns role ownership.ui-orchestrator — integrates approved pieces into one visual contract.ui-quality-audit — checks coherence, accessibility, responsiveness, motion, performance, and licensing.list_libraries, recommend_stack, get_library_guidance, search_components, get_install_instructions, and audit_plan.npm run build
npm run start:mcp
MCP configuration is in .mcp.json. Setup, architecture, security, licensing, and contribution details live in docs/, SECURITY.md, THIRD_PARTY.md, and CONTRIBUTING.md.
The MCP server does not execute install commands or write project files. OrchestrUI never mirrors the React Bits collection, paid/Pro content, authenticated material, credentials, license keys, or third-party .riv artwork.
If OrchestrUI helps your work, you can support its ongoing maintenance:
pointoncurve.ton1ECDSA1b4d5TcZHtqNpcxmY8pBH1GgHntNTUF4vPdB6QkjCvZq18rBL4Qj4dK5ihCN75For questions about OrchestrUI, integration, consulting, or collaboration:
FAQs
Deterministic UI policy, discovery and quality gates for coding agents
The npm package orchestrui receives a total of 0 weekly downloads. As such, orchestrui popularity was classified as not popular.
We found that orchestrui demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
GitHub is tightening GitHub Actions security with new restrictions on privileged pull request workflows. Here's what changes and how maintainers are affected.

Security News
/Application Security
A practical guide to securing GitHub Actions against supply chain attacks, covering malicious pull requests, credential theft, dependency risks, and release pipelines.

Security News
Composer 2.11 adds dependency cooldowns, joining package managers that delay new releases to reduce supply chain risks while allowing urgent security updates.