
Security News
GitHub to Block pull_request_target Workflows by Default Starting December 2
GitHub is tightening GitHub Actions security with new restrictions on privileged pull request workflows. Here's what changes and how maintainers are affected.
Deterministic UI policy and quality gates for coding agents.
Quick start · Output · Skills & MCP · Ecosystems · Docs
OrchestrUI inspects a structured project profile, preserves compatible owners, and returns the smallest admissible UI composition with evidence for every decision.
Requires Node.js 20+. Add the published read-only server to an MCP host:
{
"mcpServers": {
"orchestrui": {
"command": "npx",
"args": ["-y", "orchestrui@latest"]
}
}
}
git clone --depth 1 https://github.com/ECD5A/OrchestrUI.git
cd OrchestrUI
bash scripts/install-codex.sh
git clone --depth 1 https://github.com/ECD5A/OrchestrUI.git
Set-Location OrchestrUI
powershell -ExecutionPolicy Bypass -File scripts\install-codex.ps1
git clone https://github.com/ECD5A/OrchestrUI.git
cd OrchestrUI
npm ci && npm run check
npm run benchmark
Use them from a frontend project:
$ui-library-router plan the smallest compatible UI stack.
$ui-orchestrator implement the approved plan.
$ui-quality-audit audit the rendered result.
{
"input_mode": "structured-profiles",
"selected": ["bklit-ui"],
"owners": {
"base-system": "host:shadcn-ui",
"data-visualization": "bklit-ui"
},
"rejected": [{ "id": "daisyui", "rule": "base-system-conflict" }]
}
The committed suite passes 50/50 structured scenarios, 8/8 independently specified adversarial goldens, and three project fixtures in CI.
ui-library-router — inspects the host and assigns role ownership.ui-orchestrator — integrates approved pieces into one visual contract.ui-quality-audit — checks coherence, accessibility, responsiveness, motion, performance, and licensing.list_libraries, recommend_stack, get_library_guidance, search_components, get_install_instructions, and audit_plan.Published through npm, the official MCP Registry, and versioned GitHub Releases. Local plugin configuration is in .mcp.json; setup, architecture, security, licensing, and contribution details live in docs/, SECURITY.md, THIRD_PARTY.md, and CONTRIBUTING.md.
The MCP surface is read-only and uses public upstream metadata; implementation code and third-party assets remain in the host project.
| Ecosystem | Role |
|---|---|
| Kokonut UI | selective React/shadcn product polish |
| React Bits | one signature creative effect |
| daisyUI | intentional Tailwind semantic base |
| Bklit UI | charts and data visualization |
| Anime.js | bespoke timeline, SVG, or scroll motion |
| Rive | licensed interactive vector/state-machine graphics |
| Magic UI | animated marketing enhancement |
OrchestrUI is independent and is not affiliated with or endorsed by these upstream projects.
If OrchestrUI helps your work, you can support its ongoing maintenance:
pointoncurve.ton1ECDSA1b4d5TcZHtqNpcxmY8pBH1GgHntNTUF4vPdB6QkjCvZq18rBL4Qj4dK5ihCN75For questions about OrchestrUI, integration, consulting, or collaboration:
FAQs
Deterministic UI policy, discovery and quality gates for coding agents
The npm package orchestrui receives a total of 0 weekly downloads. As such, orchestrui popularity was classified as not popular.
We found that orchestrui demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
GitHub is tightening GitHub Actions security with new restrictions on privileged pull request workflows. Here's what changes and how maintainers are affected.

Security News
/Application Security
A practical guide to securing GitHub Actions against supply chain attacks, covering malicious pull requests, credential theft, dependency risks, and release pipelines.

Security News
Composer 2.11 adds dependency cooldowns, joining package managers that delay new releases to reduce supply chain risks while allowing urgent security updates.