UISandbox as an MCP server: open the real sandbox in your browser with your built web app loaded, turn its own knobs, verify 1:1, export CSS/patch/tokens/Swift/Android. Play with your app's design, right in the browser: nothing is sent to a server, and cl
Inferred from the transports this listing declares (stdio). A client not listed here hasn’t been ruled out — it just isn’t something Forge can confirm.
Verification confirms publisher identity (repo ownership), not code safety. The security scan covers known CVEs and suspicious install scripts.
Read out of the source npm actually ships, at scan time. The package was never executed. Tools registered dynamically at runtime, or hidden inside bundled or minified code, can be missed — so this is a floor on the tool surface, not a complete census of it.
loadLoad a BUILT web app (a zip of its dist/build/out folder, or a repo zip carrying the build) by URL or local path. Returns the project id, screens, tokenised values and the baseline the knobs stand on. Refuses what cannot render (iOS/Android/source-only) with the reason.Load a BUILT web app (a zip of its dist/build/out folder, or a repo zip carrying the build) by URL or local path. Returns the project id, screens, tokenised values and the baseline the knobs stand on. Refuses what cannot render (iOS/Android/source-only) with the reason.
No input schema was published for this tool.
screensThe screens (HTML entries) of a loaded project.The screens (HTML entries) of a loaded project.
No input schema was published for this tool.
setApply knobs to a loaded project. Every dial has ×1 (or 0) = as in their code; colours are #rrggbb. Returns what moved (count and a sample of value → value).Apply knobs to a loaded project. Every dial has ×1 (or 0) = as in their code; colours are #rrggbb. Returns what moved (count and a sample of value → value).
No input schema was published for this tool.
exportExport the current state: sheet-css (your values as CSS custom properties), sheet-json, patch (literal → value list), tokens-css / tokens-json / tailwind / shadcn (the --k-* design tokens), swift, android-xml, android-kotlin.Export the current state: sheet-css (your values as CSS custom properties), sheet-json, patch (literal → value list), tokens-css / tokens-json / tailwind / shadcn (the --k-* design tokens), swift, android-xml, android-kotlin.
No input schema was published for this tool.
openOpen UISandbox in the user's browser with this project loaded — the real, interactive sandbox: the whole app rendered 1:1, every knob there to turn by hand. Use this whenever the user wants to SEE or PLAY with the design themselves ("can I look at this in a sandbox", "let me try some changes"), not…Open UISandbox in the user's browser with this project loaded — the real, interactive sandbox: the whole app rendered 1:1, every knob there to turn by hand. Use this whenever the user wants to SEE or PLAY with the design themselves ("can I look at this in a sandbox", "let me try some changes"), not…
No input schema was published for this tool.
stateThe knobs as they stand now — including what the user turned by hand in an opened sandbox (and when).The knobs as they stand now — including what the user turned by hand in an opened sandbox (and when).
No input schema was published for this tool.
verifyRun the 1:1 check in a real browser: the untouched build vs. the tokenised build with the identity sheet, computed styles of every element diffed. Also returns the reach meter. This is the same check a visitor runs on uisandbox.org.Run the 1:1 check in a real browser: the untouched build vs. the tokenised build with the identity sheet, computed styles of every element diffed. Also returns the reach meter. This is the same check a visitor runs on uisandbox.org.
No input schema was published for this tool.
screenshotA PNG of the screen as it renders with the current knobs (the sandbox frame only).A PNG of the screen as it renders with the current knobs (the sandbox frame only).
No input schema was published for this tool.
8 of 8 tools published a description.
Tool names and descriptions are written by the publisher and shown verbatim as inert text. They are the strings an MCP client passes to a model, so Forge scans them for prompt-injection patterns — any finding appears with the security scan above. “Privileged” is a keyword match on the tool name, not an audit of what the tool does: a benign-sounding name can still do anything.
UISandbox as an MCP server: open the real sandbox in your browser with your built web app loaded, turn its own knobs, verify 1:1, export CSS/patch/tokens/Swift/Android. Play with your app's design, right in the browser: nothing is sent to a server, and cl
Linked names open Forge’s index of every entry observed exposing that tool. Browse all indexed tools.
The crawl stopped at the depth-4 limit. Anything below that level was never resolved.
The crawl stopped at the 60-package limit. The rest of the tree was never resolved.
36 more resolved packages are not drawn here (display cap: 24). Every dependency carrying an advisory is drawn regardless of the cap. Full inventory (CycloneDX SBOM)
55 declared dependencies never landed in the tree. They are missing from Forge's resolution, not from the package.
+43 more not listed. The counts by reason above cover all of them.
Not followed: optionalDependencies, peerDependencies. This tree covers runtime dependencies only, so anything those pull in was never resolved.