
Security News
Axios Maintainer Confirms Social Engineering Attack Behind npm Compromise
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.
Add simple widgets to you LLM chat for common situations like timers, conversions and more.

MCP-UI opens the door to breaking the text wall from chat UIs we've been using the last few years. The full extent of what's possible is
This project shows the floor of what's possible by providing a few simple widgets for common situations.
If you've ever google "convert X to Y" or "2 minute timer" and see the custom UI results, this should feel very familiar.
Timer - Editable timer with a chime.Stopwatch - Timer that just counts up.Conversion - Convert between set of units for which the LLM can write a formula.Display Fact - When the answer is simple, just show it in an easy to read card.MCP-UI is new and as of August 2025 is only supported by a few clients.
Try widget-mcp in the Smithery playground.
Extensions and Add custom extensionWidgets and command npx widget-mcpChat and prompting 2 minute timer
Here's a few examples of widgets that could be fun to add.
I'm sure you have some cool ideas!
To add new widgets, add an template file to the html directory and a new tool to index.ts
# Install dependencies
npm install
# Iterate on the html with hot-reloads
npm run dev:html
# Launch the MCP server with Smithery's web inspector
npm run dev:mcp
FAQs
UI widget for your LLM
We found that widget-mcp demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.

Security News
The Axios compromise shows how time-dependent dependency resolution makes exposure harder to detect and contain.