Designesy
REMOTE · WWW.DESIGNESY.ORG · 2 COMPONENTS
Design quality gate for AI-generated UI: score any URL on 45 deterministic checks, A–F grade.
Available components
Last scanned (8 hours ago)
Scores higher than 97% of remote servers
Reachable. Last reached 5 Nov 2026.
Category Design and Media
How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. How we score → Why this is hard to score →
Endpoint Security83
- The endpoint's TLS certificate is valid, in date, and uses a strong key. View diagnostics → Pass
- No authorisation is required to call this server. Every tool declares its destructiveHint and none is destructive, so open access doesn't expose one. See how to fix → View diagnostics → Partial
- HTTPS is enforced; there's no plaintext access path. View diagnostics → Pass
- The HSTS (Strict-Transport-Security) header is present. View diagnostics → Pass
- DNSSEC is configured correctly; the domain's records validate against the full chain to the root. View diagnostics → Pass
Transport & Reachability100
- Verified streamable-http transport via a live MCP handshake. View diagnostics → Pass
Schema Quality & AI Usability78
- 100% of prompts and resources have a non-trivial description (not blank, and not just the item's name).Pass
- AI-judged instruction clarity (excellent).Pass
- Context-footprint check failed: tool/resource definitions use about 5610 tokens (~311/item across 18 items; 17 tools + 1 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management100
- No destabilizing schema changes in the last 30 days.Pass
Tool Coverage100
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 100% of tool parameters carry a description.Pass
Tool Safety100
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- We read all 17 captured tool definition(s), and no name or description among them implies an irreversible operation.Pass
- An AI judge read all 18 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a current MCP spec version (2026-07-28).Pass
- Supports UI / widget rendering.Pass
Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 27 Oct 26 0
- “designesy_tokens_score” reworded the description of “url” cosmetic
- “designesy_motion_score” reworded the description of “url” cosmetic
2 cosmetic changes on this day. Switch on “Show cosmetic changes” to see them.
- 25 Oct 26 0
- Tool “designesy_catalog” rewrote its description, which is the text the model reads security
- Tool “designesy_monitor_score” rewrote its description, which is the text the model reads security
- “designesy_monitor_score” reworded the description of “email” cosmetic
- “designesy_monitor_score” reworded the description of “history” cosmetic
- Tool “designesy_monitor_score” changed its title: Monitor drift with email alerts → Monitor drift over time cosmetic
- 24 Oct 26 0
- Tool “designesy_monitor_score” rewrote its description, which is the text the model reads security
- “designesy_monitor_score” reworded the description of “email” cosmetic
- 22 Oct 26 0
- Tool “designesy_tokens_score” rewrote its description, which is the text the model reads security
- Server version: 1.13.9 → 1.13.10 functional
- 17 Oct 26 0
- Stability: 0.97 → pass security
- Tool “designesy_contract” rewrote its description, which is the text the model reads security
- “designesy_design_review” reworded the description of “rules” cosmetic
- 16 Oct 26 0
- Stability: pass → 0.97 functional
- 14 Oct 26 0
- Tool “designesy_score” rewrote its description, which is the text the model reads security
- Tool “designesy_contract” rewrote its description, which is the text the model reads security
- Tool “designesy_drift_score” rewrote its description, which is the text the model reads security
- Tool “designesy_report” rewrote its description, which is the text the model reads security
- Server version: 1.13.8 → 1.13.9 functional
- “designesy_design_review” reworded the description of “rules” cosmetic
- 13 Oct 26 0
- Tool “designesy_contract” rewrote its description, which is the text the model reads security
- “designesy_design_review” reworded the description of “rules” cosmetic
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 5 Nov 2026 · Probed https://www.designesy.org/api/mcp
TLS valid
Negotiated TLS 1.3 with TLS_AES_128_GCM_SHA256 .
| Subject | Issuer | Valid from | Valid until | Key | Signature | Serial |
|---|---|---|---|---|---|---|
| CN=www.designesy.org | CN=YR2,O=Let's Encrypt,C=US | 12 Sept 2026 | 11 Dec 2026 | RSA 2048 | SHA256-RSA | 51800ba062c040d1c659484293512034307 |
| SANs: www.designesy.org | ||||||
| CN=YR2,O=Let's Encrypt,C=US (CA) | CN=Root YR,O=ISRG,C=US | 3 Sept 2025 | 2 Sept 2028 | RSA 2048 | SHA256-RSA | 4ebd24947e24d394802d84a52fd5b319 |
| CN=Root YR,O=ISRG,C=US (CA) | CN=ISRG Root X1,O=Internet Security Research Group,C=US | 13 May 2026 | 2 Sept 2032 | RSA 4096 | SHA256-RSA | f24b6d17f9d9ad7cb1c9fea78782699f |
Background: What to check on a remote MCP endpoint →
DNSSEC secure
Validation of www.designesy.org. — Secure
| Zone | DS | Keys | Algorithms | Outcome |
|---|---|---|---|---|
| . | trust_anchor | 20326, 38696 | 8, 8 | Verified |
| org. | present | 26974 | 8 | Verified |
| designesy.org. | present | 61220 | 13 | Verified |
| www.designesy.org. | Verified address RRset verified with the apex keys |
Authentication No authorisation required
The endpoint answered without asking for a token. Anyone who knows the URL can reach it.
| Result | No authorisation required |
|---|---|
| HTTP status | 200 |
| Header | Value |
|---|---|
| strict-transport-security | max-age=63072000; includeSubDomains; preload |
| content-security-policy | default-src 'self'; script-src 'self' 'unsafe-inline' 'wasm-unsafe-eval' blob: https://va.vercel-scripts.com; style-src 'self' 'unsafe-inline'; img-src 'self' data: https:; font-src 'self'; connect-src 'self' https://va.vercel-scripts.com https://vitals.vercel-insights.com; worker-src 'self' blob:; frame-ancestors 'none'; base-uri 'self'; form-action 'self' |
| x-content-type-options | nosniff |
| x-frame-options | DENY |
| referrer-policy | strict-origin-when-cross-origin |
| permissions-policy | camera=(), microphone=(), geolocation=(), payment=() |
Background: How OAuth 2.1 works in the 2026 MCP spec →
Transports 2 probes
| Transport | URL | Outcome | Status | Location |
|---|---|---|---|---|
| streamable-http | https://www.designesy.org/api/mcp | Verified | 200 | |
| http (plaintext) | http://www.designesy.org/api/mcp | HTTPS enforced | 308 | https://www.designesy.org/api/mcp |
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
designesy_a11y_score Get WCAG audit kit ~297
Get the Designesy WCAG 2.2 AA accessibility verification framework: 11 conformance checks (a01-a11) plus a ready-to-run Playwright + axe-core 4.13.0 script template targeting your URL. Use this to audit a site for accessibility violations. When NOT to use: for a full design-contract score (not just a11y), use designesy_score. Does NOT run the scan: axe-core needs a real browser DOM. Returns the 11 checks + a Playwright script you execute locally (npm i -D @axe-core/playwright). The score comes from your local run, not from this tool. Returns JSON: { checks[{id (a01-a11), name, status: "PENDING_EXECUTION"}], playwright_script, install_command, run_command }. Pass config (JSON string) to customize axe.configure(), for example with branding overrides or rule disables. Omit for standard WCAG 2.2 AA.
| Name | Type | Req | Description |
|---|---|---|---|
| config | string | – | Brand customization JSON for axe.configure(): branding, checks, rules, disableOtherRules. |
| ruleset | string | – | Ruleset tag (default: wcag22aa). Options: wcag2a, wcag2aa, wcag21aa, wcag22aa, best-practice. |
| url | string | yes | URL to scan for accessibility. The returned script template will target this URL. |
No output schema declared.
No examples provided.
designesy_agent_json Get agent discovery document ~199
Get the Designesy agent discovery document (/.well-known/agent.json) as reference data: the org identity, authority, discovery endpoints, package index, machine exports, permission policy, contact, and citation templates. Use this when integrating with or enumerating Designesy and need the canonical discovery manifest rather than one specific contract. When NOT to use: for the package list, use designesy_catalog (lighter); for the contract, use designesy_contract. Read-only: no side effects. Returns JSON: { kind: "published_document", source_url, media_type: "application/json", note, omitted_fields[], document }, where document is the published object (schema, name, identity, authority, topics, discovery, ingest, packages, machine_exports, contact, permission, cite, and the rest) with any field written as steps for an AI agent (such as ingest.steps) removed and its path listed in omitted_fields. No parameters.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
designesy_catalog List Designesy packages ~108
List the 23 published Designesy packages with versions, URLs, and statuses. Use this to discover what Designesy publishes before fetching a specific contract. When NOT to use: if you already know which package you need, skip this and call designesy_contract directly. Read-only: no side effects. Returns JSON: { package_count, packages[{id, kind, title, version, status, human_url, machine_url}], standing_rules[], machine_exports[] }. No parameters: accepts empty input.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
designesy_compare Compare two design systems ~326
Diff two design systems from live URLs, using the only URL-scoped design-token diff engine. Fetches both URLs in parallel, extracts their :root custom properties, and produces a structured diff across 8 dimensions: tokens added (in A not B), removed (in B not A), renamed (heuristic Levenshtein ≤ 2), value-changed (same name, different value), scale-stop-changed (spacing/radius/color scale steps), contrast-drift-per-pair (WCAG contrast ratio change for shared color tokens), structure-delta (token count + category distribution), and score-delta (runs /score on both URLs and diffs). Use this to answer "what actually changed between two design systems" or "how does our design system differ from a reference". When NOT to use: for single-site drift detection, use designesy_drift_score; for continuous monitoring, use designesy_monitor_score. Executable: fetches both URLs, extracts CSS + tokens, computes diff. No browser needed. Returns JSON: { ok, urlA, urlB, score (0-100, diff completeness), grade, pass, warn, fail, total, tokensA, tokensB, added[], removed[], renamed[], valueChanged[], scaleDiff, structureDelta, contrastDrift[], scoreDelta, checks[] }. Results cached ~24h per URL pair.
| Name | Type | Req | Description |
|---|---|---|---|
| urlA | string | yes | First URL to compare (e.g. your design system). |
| urlB | string | yes | Second URL to compare (e.g. a reference or competitor). |
No output schema declared.
No examples provided.
designesy_contract Get design contract ~353
Get the Designesy design-system contract: the canonical tokens, motion, acoustic, takt, cadence, typography, components, and verification rules that define what the Designesy org considers legitimate design. Use this when you need the actual contract values (token names and values, motion timings, accessibility rules) to author, check, or bind a design. When NOT to use: for a pass/fail score of a live site, use designesy_score; for an agent-skill-format export, use designesy_skill_md. Read-only; this server caches the fetched contract for 5 minutes. With no arguments it returns the full contract JSON, about 125 KB (roughly 31k tokens). To return less, pass sections, a list of top-level keys such as ["motion", "colors"]: the result holds id, version, and only those keys. section (one name) is the older form and returns { section, data }. An unknown name returns an error that lists every valid key.
| Name | Type | Req | Description |
|---|---|---|---|
| section | string | – | Optional, older form: one top-level key; returns { section, data }. Prefer sections. |
| sections | array | – | Optional: top-level contract keys to return. The result holds id, version, and only these keys. Omit for the full contract. Valid keys: id, version, status, name, public_url, full_contract_url, machi… |
No output schema declared.
No examples provided.
designesy_design_review Get design review rubric ~326
Get the Designesy Design Review rubric for a qualitative design critique: eight dimensions (Purpose, Clarity, Context, Inclusion, System coherence, Durability, Delight, Responsibility), the output format, and the verification checklist, from the published Design Review kit. Use this when you want a structured rubric to critique a design holistically, rather than a numeric compliance score. When NOT to use: for a deterministic numeric score, use designesy_score; this tool gives you a rubric, not a number. Read-only: it returns reference data and does not evaluate the design. Returns JSON: { kind: "review_rubric", source_url, note, inputs (only when passed), kit { id, title, version, status, purpose, quality_bar, permission }, when_to_use[], required_inputs[], dimensions[8] { num, title, desc }, output_format[], verification_checklist[], anti_patterns[], rationalizations[], kit_prompt_url, kit_prompt_note, omitted_fields[] }. The kit's copy-ready agent prompt is not included; kit_prompt_url is the page where a person can read it. Pass artifact, purpose, context, or rules to have them recorded in inputs (rules defaults to the current contract version).
| Name | Type | Req | Description |
|---|---|---|---|
| artifact | string | – | URL or description of the artifact to review. |
| context | string | – | Audience, device, environment, and constraints. |
| purpose | string | – | What the design is trying to make possible. |
| rules | string | – | Governing rules or contract version (default: designesy design system v0.4.7). |
No output schema declared.
No examples provided.
designesy_drift_score Score UI drift ~301
Score a live URL for AI-generated UI drift. Its 12 checks detect the four documented 2026 drift failure modes: token fabrication (var() references with no fallback to custom properties declared nowhere: not in a stylesheet, a <style> block or a style attribute), within-session drift (spacing/color/radius value variance), between-session amnesia (inconsistent font stacks, shadows, transitions), and silent breaking changes (z-index chaos, alias chains that end in an undeclared property). Use this when you need to verify whether a site (especially an AI-generated one) is drifting off its own declared token system. When NOT to use: for a full 45-check design-contract score, use designesy_score; for token-file format validation, use designesy_tokens_score. Executable: fetches the URL server-side, extracts all CSS (inline + linked stylesheets), parses custom property declarations (stylesheets, <style> blocks and style attributes) and var() references, runs 12 drift checks. No browser needed. Returns JSON: { ok, url, scope, score (0-100), grade (A-F), pass, warn, fail, skip, total, tokensExtracted, checks[{id, item, category, status, detail}] }. Results cached ~24h per URL.
| Name | Type | Req | Description |
|---|---|---|---|
| url | string | – | URL to scan for drift. Defaults to https://www.designesy.org/ if not provided. |
No output schema declared.
No examples provided.
designesy_guardrails Generate build-contract bundle ~514
Generate a frozen build-contract bundle for AI coding agents from any design system URL (the product layer). Ingests a site, extracts its :root tokens, and emits 6 outputs: (1) DTCG-format token file, (2) Stylelint config generated from token values, (3) AGENTS.md-format rules with token allowlist, (4) component contract with allowed prop patterns, (5) anti-pattern documentation, (6) DESIGN.md file (Google open spec, google-labs-code/design.md), the de-facto AI-readable design-context standard: YAML front matter plus a markdown body. Use this when you need to turn a design system into the file AI agents read and the lint that enforces it. When NOT to use: for design-contract scoring, use designesy_score; for token-file validation, use designesy_tokens_score; for drift detection, use designesy_drift_score. Executable: fetches the URL, extracts CSS + :root custom properties, generates the bundle. No browser needed. The full bundle grows with the number of tokens a site declares: about 7 KB to about 530 KB of JSON on the 26 sites measured (about 110 KB for designesy.org). To trim it, pass parts, a list of bundle file names such as ["designMd"] or ["tokens", "lintConfig"]: the result keeps score, grade, counts and checks, and its bundle holds only those files, in the order asked. Valid parts: tokens, lintConfig, agentRules, componentContract, antiPatterns, designMd. A single part can still be large on a site with many tokens. An unknown name returns an error that lists the valid parts. Returns JSON: { ok, url, score (0-100, emission completeness), grade, pass, warn, fail, total, tokensExtracted, bundle: { tokens, lintConfig, agentRules, componentContract, antiPatterns, designMd }, checks[{id, item, category, status, detail}] }; with parts it adds parts, and bundle holds only the named files. Results cached ~24h per URL.
| Name | Type | Req | Description |
|---|---|---|---|
| parts | array | – | Optional: the bundle files to return, by name. Omit for the whole bundle. Valid parts: tokens, lintConfig, agentRules, componentContract, antiPatterns, designMd. |
| url | string | – | URL to generate guardrails for. Defaults to https://www.designesy.org/ if not provided. |
No output schema declared.
No examples provided.
designesy_llms_full_txt Get llms-full.txt brief ~193
Get the Designesy /llms-full.txt brief as reference data: authority, discovery endpoints, topics, every published package with its links, standing rules, and anti-patterns. Use this for a fuller picture of the Designesy ecosystem when the short brief from designesy_llms_txt is not enough. When NOT to use: for a quick orientation, use designesy_llms_txt (a few thousand characters; this one runs over ten thousand); for the contract itself, use designesy_contract. Read-only: no side effects. Returns JSON: { kind: "published_document", source_url, media_type: "text/plain", note, omitted_sections[], content }, where content is the published text with any section written as steps or a prompt for an AI agent (such as the ingest protocol and the paste-ready agent prompt) replaced by a one-line marker and named in omitted_sections. No parameters.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
designesy_llms_txt Get llms.txt brief ~176
Get the Designesy /llms.txt brief as reference data: what Designesy is, canonical links, topics, the published package list, machine exports, standing rules, and contact. Use this first when you don't know what Designesy is; at a few thousand characters it is the cheapest orientation path before pulling heavier artifacts. When NOT to use: for the longer brief, use designesy_llms_full_txt; for the contract itself, use designesy_contract. Read-only: no side effects. Returns JSON: { kind: "published_document", source_url, media_type: "text/plain", note, omitted_sections[], content }, where content is the published text with any section written as steps for an AI agent (such as the ingest steps) replaced by a one-line marker and named in omitted_sections. No parameters.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
designesy_monitor_score Monitor drift over time ~454
Score a URL for continuous design-drift governance, the temporal layer over the drift radar. Re-runs the 12 drift checks (d01-d12) on the URL and computes 10 monitor checks (m01-m10): history supplied, last run fresh, drift delta vs baseline, trend slope (3-run trajectory), new violations since last run, resolved since last run (the healing signal), score degradation threshold, token-set mutation, contract version drift, and alert delivered. Alerts come back in the result as alerts[]. No email is sent: email delivery was retired, so m10 is SKIP on every run and is not scored, and the email argument is deprecated and ignored. Pass a history array of prior snapshots (each call's currentSnapshot) to compute deltas; omit it for a first-run baseline. History is checked for shape and bounds (at most 1000 runs, a request of at most 512 KB). Use this to watch a design system over time: "weekly audits at cents per report" (Into Design Systems 2026). When NOT to use: for a single point-in-time drift check, use designesy_drift_score; for design-contract scoring, use designesy_score. Executable: fetches the URL, extracts CSS + :root tokens, runs checks, computes deltas. No browser needed. Returns JSON: { ok, url, score (0-100, governance health; SKIP is not scored), grade (A-F), pass, warn, fail, total, currentSnapshot, baseline, previous, driftChecks, monitorChecks, alerts }. Results are cached ~24h per URL and history: a repeat call with the same URL and history returns the cached run, with m02 measured again.
| Name | Type | Req | Description |
|---|---|---|---|
| string | – | Deprecated and ignored: email delivery was retired, so no email is sent and the address is not forwarded. Alerts come back in the result as alerts[]. | |
| history | array | – | Prior snapshots for delta computation (currentSnapshot from earlier calls). Omit for a first-run baseline. |
| url | string | – | URL to monitor for drift. Defaults to https://www.designesy.org/ if not provided. |
No output schema declared.
No examples provided.
designesy_motion_score Validate Lottie animation ~495
Validate one Lottie animation file against the Designesy motion contract: its ten checks (m01-m10), drawn from the Lottie spec v1.0.1 and the Designesy §16 Ten Non-Negotiable Motion Standards. Each check returns PASS, FAIL, WARN or SKIP under the contract's own name for its id: m01 the schema's top-level animation object (layer contents are not validated, so a clean file returns SKIP, not PASS), m02 the required fields (v, fr, ip, op, w, h, layers), m03 no deprecated 4.x Bodymovin version, m04 a markers array, m05 a meta object, m06 a reduced-motion path (a marker or slot named for it, or a meta note of an external prefers-reduced-motion wrapper), m07 keyframe easing (linear, ease and ease-in curves fail), m08 duration within 300 ms (longer returns WARN, since a justification cannot be read from a file), m09 layout-property animation and m10 keyboard-initiated motion (both SKIP: they concern the page that embeds the file). Use this to check that a motion asset is well formed and carries reduced-motion support. When NOT to use: for the motion CSS of a whole site, use designesy_score. Executable: fetches the URL or parses the inline JSON; no browser needed. Score: PASS=1, WARN=0.5, FAIL=0, SKIP is not scored; points / scored checks x 100. Returns JSON: { contract_id, contract_version, contract_status, url, lottie_version, layer_count, score (0-100), grade (A-F), pass_count, fail_count, warn_count, skip_count, scoring, checks[{id (m01-m10), name, status (PASS, FAIL, WARN or SKIP), detail}], ten_non_negotiable, provenance, validator_note }. Pass url to fetch a remote Lottie file, or lottie_file to validate an inline JSON string. Provide exactly one.
| Name | Type | Req | Description |
|---|---|---|---|
| lottie_file | string | – | Raw Lottie JSON string to validate (alternative to url). |
| url | string | – | URL to a Lottie JSON file of up to 16 MiB. The tool fetches and validates it; a longer file fails with an error that names the limit. |
No output schema declared.
No examples provided.
designesy_readiness_score Score AI readiness ~240
Score a URL for design-system AI readiness, the 6th maturity axis (zeroheight 2026). 10 checks probe the target origin for machine-readable artifacts: DTCG token files, llms.txt, agent.json, MCP endpoint (tools/list), DESIGN.md, token $description, component schemas, sitemap.xml, robots.txt, and Open Graph/Twitter meta. Use this to verify whether a design system is the default context AI tools build from, or whether AI is silently working around it. When NOT to use: for full design-contract scoring, use designesy_score; for AI-drift detection, use designesy_drift_score. Executable: fetches the URL and probes the origin via HEAD/GET for each artifact. No browser needed. Returns JSON: { ok, url, score (0-100), grade (A-F), pass, warn, fail, total, checks[{id, item, category, status, detail}] }. Results cached ~24h per URL.
| Name | Type | Req | Description |
|---|---|---|---|
| url | string | – | URL to score for AI readiness. Defaults to https://www.designesy.org/ if not provided. |
No output schema declared.
No examples provided.
designesy_report Build composite design report ~507
Generate a unified design-intelligence report for a single URL, the synthesis capstone. Fires /score (45-check audit), /drift (12-check drift radar), and /readiness (10-check AI readiness) in parallel, then computes a weighted composite: score × 0.5 + drift × 0.3 + readiness × 0.2. One input, one output, one composite grade. Use this when you need a single holistic assessment instead of three separate scans, or when sharing a design-intelligence verdict (the report is the most shareable surface). When NOT to use: for just the audit score, use designesy_score; for just drift, use designesy_drift_score; for just AI readiness, use designesy_readiness_score. Executable: fires 3 internal APIs in parallel, each fetches the target URL. No browser needed. The full result is large: about 75 to 100 KB of JSON on the ten sites measured, on the order of 20,000 tokens or more, because it carries each engine's whole result beside the merged check list. To trim it, pass detail "summary": the same keys with fewer rows, about 4 to 31 KB on the same sites. It keeps the composite, the totals, each engine's score, grade and counts, and only the checks and synthesis entries that did not PASS; omitted counts what was left out. detail "full" (the default) returns everything. Returns JSON: { ok, url, compositeScore (0-100), compositeGrade (A-F), score { sub-result }, drift { sub-result }, readiness { sub-result }, totalChecks, totalPass, totalWarn, totalFail, totalSkip, totalManual, checks[] (all checks across all engines, tagged with engine), synthesis[] (8 synthesis checks verifying the report ran correctly), appUrl (standalone interactive dashboard URL) }; with detail "summary" it adds detail and omitted. Results cached ~24h per URL. MCP Apps: hosts that support io.modelcontextprotocol/ui render an interactive dashboard inline; others get the JSON plus an appUrl link.
| Name | Type | Req | Description |
|---|---|---|---|
| detail | string | – | Optional: "full" (the default) returns everything; "summary" returns the composite, the totals, each engine's score, grade and counts, and only the checks that did not PASS. |
| url | string | yes | Public URL to generate a design-intelligence report for. |
No output schema declared.
No examples provided.
designesy_score Score URL against contract ~437
Score a live URL against the Designesy design contract: a deterministic 45-check verification engine that returns a numeric score, letter grade (A-F), and per-check breakdown. Use this to audit whether a website or AI-generated UI complies with a real design contract (tokens, motion, accessibility, cadence, takt, typography, copywriting). When NOT to use: for token-file validation only, use designesy_tokens_score; for a Lottie file, use designesy_motion_score; for a qualitative critique, use designesy_design_review. Executable: fetches the URL server-side, extracts CSS, runs 45 checks. Results cached ~24h per URL. Checks needing a live browser (Core Web Vitals, sound toggle, overflow) return MANUAL (not FAIL); run the full audit (/api/score/audit) to resolve them. Checks that are not applicable to the site (no tokens, no buttons, no DESIGN.md) return SKIP (N/A). The default format returns the engine's JSON: { score (0-100), grade (A-F), pass, warn, fail, skip, manual, total, checks[{id, item, category, status, detail, remediation, weight}], categoryScores, contractVersion, receipt }. Pass format="canonical" for review-findings.json schema, "review" for markdown, or "google" for design.md-compatible output. Pass scope="contract" or "universal" to set the scoring scope instead of auto-detecting it.
| Name | Type | Req | Description |
|---|---|---|---|
| format | string | – | Output format. designesy (default): the native JSON. canonical: the review-findings.json schema. review: a markdown report. google: the @google/design.md-compatible JSON. |
| scope | string | – | Scoring scope. contract: every check counts absence against the site. universal: optional features and Designesy-specific token checks return SKIP when absent. Omit to auto-detect: contract for desig… |
| url | string | – | URL to score. Defaults to https://www.designesy.org/ if not provided. |
No output schema declared.
No examples provided.
designesy_skill_md Get contract as SKILL.md ~180
Get the Designesy SKILL.md: the agent-skill-format export of the design-system contract, for a user to save into .agents/skills/ or a system prompt so a coding agent builds UI to the contract (tokens, anti-patterns, rules, verification). Use this when the user wants the contract in that form. When NOT to use: for the raw contract JSON, use designesy_contract; for scoring, use designesy_score. Read-only: no side effects. Returns JSON: { kind: "published_document", source_url, media_type: "text/markdown", note, omitted_sections[], content }, where content is the SKILL.md markdown (tens of thousands of characters) with any section written as steps or a prompt for an AI agent replaced by a one-line marker and named in omitted_sections. No parameters.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
designesy_tokens_score Validate DTCG tokens ~468
Validate a design token file against the W3C Design Tokens Community Group (DTCG) 2025.10 Final Community Group Report (the spec's first stable version, published Oct 28 2025 as a Candidate Recommendation and considered stable). Returns 10 conformance checks (t01-t10) with PASS, FAIL, WARN or SKIP. Use this to verify a tokens.json (or any DTCG token export) is structurally correct: $type (direct or inherited) present, one $value or $ref per token (a JSON Pointer $ref must resolve), structured colors (colorSpace + components rather than bare hex), dimensions in the 2025.10 { value, unit } form, and a $schema pointer to designtokens.org (a Designesy policy: DTCG does not require $schema). With 84% of teams now using design tokens (zeroheight Design Systems Report 2025, up from 56% in 2024) and the spec finally stable, every adopting team needs a validator. When NOT to use: for scoring a whole live site (not just its token file), use designesy_score. Executable: fetches the URL or parses the raw JSON you provide, runs 10 checks server-side. No browser needed. Score: PASS=1, WARN=0.5, FAIL=0, SKIP is not scored; points / scored checks x 100. Returns JSON: { contract_id, contract_version, contract_status, url, total_tokens, score (0-100), grade (A-F), pass_count, fail_count, warn_count, skip_count, scoring, checks[{id (t01-t10), name, status (PASS, FAIL, WARN or SKIP), detail}], provenance, validator_note }. Pass url to fetch a remote token file, or dtcg_file to validate an inline JSON string. Provide exactly one.
| Name | Type | Req | Description |
|---|---|---|---|
| dtcg_file | string | – | Raw DTCG token JSON string to validate (alternative to url). |
| url | string | – | URL to a DTCG token file (JSON) of up to 4 MiB. The tool fetches and validates it; a longer file fails with an error that names the limit. |
No output schema declared.
No examples provided.
How do I install the Designesy MCP server?
Designesy is a hosted endpoint at https://www.designesy.org/api/mcp, so there is nothing to install locally. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
remote · www.designesy.org
claude mcp add --transport http le-vai-designesy-org 'https://www.designesy.org/api/mcp'
What is the Designesy MCP server?
Designesy is an MCP server listed in the public MCP registry as io.github.LE-VAI/designesy-org. Design quality gate for AI-generated UI: score any URL on 45 deterministic checks, A–F grade. This page covers its hosted endpoint (https://www.designesy.org/api/mcp).
Is the Designesy MCP server safe to use?
Designesy scores 89 out of 100 on VerifyMCP. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the Designesy MCP server expose?
Designesy exposes 17 tools: designesy_catalog, designesy_contract, designesy_design_review, designesy_skill_md, designesy_agent_json, and 12 more. Their descriptions and schemas cost roughly 5,574 tokens of context every time the server is loaded.
Does the Designesy MCP server require authentication?
No. We connected to Designesy without credentials and it answered, so anything it exposes is reachable by anyone who knows the address.
Is the Designesy MCP server still maintained?
Designesy is still listed as active in the MCP registry. We last reached this channel on 5 November 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.