← Back to search

pitolet

GitHub Actions Scanned 5d ago

Run the Pitolet editor, API, MCP server, and code exporter locally.

npm
C
65 / 100

Versions

1.2.0latest
Jul 17, 2026
1.1.0
Jul 12, 2026
1.0.3
Jul 12, 2026
1.0.2
Jul 11, 2026
1.0.1
Jul 11, 2026
+ show 3 moreshow less
1.0.0
Jul 11, 2026
0.1.1
Jul 4, 2026
0.1.0
Jul 4, 2026
PermissionsTool SafetyAuthAnnotationsCode QualityStabilitySpecVuln HistoryAuthorTransparencyCommunity

Tools 22

list_documents
annotations: none low

List open Pitolet documents with ids and frame counts.

list_frames
annotations: none low

List the top-level frames in a document with their ids, names, sizes, and child counts.

get_node
annotations: none low

Return a compact node summary. Use get_design_as_code for complete generated code.

depth number nodeId string
get_selection
annotations: none low

The user's current selection in the open editor (summaries, depth 1).

get_tokens
annotations: none low

Design tokens (colors, spacing, radius, shadows, typography) as compact path: value lines.

category enum
get_design_as_code
annotations: none low

Return a node subtree as React with Tailwind or HTML with CSS.

nodeId string target enum
create_document
annotations: none low

Create a new, empty Pitolet document (with the default token set). Returns its id; use create_frame next.

name string
set_selection
annotations: none low

Select nodes in the open editor.

nodeIds array
get_screenshot
annotations: none low

Render a frame as a JPEG for visual review. Set viewportWidth to inspect a responsive breakpoint and state to force hover, focus, or active styling.

frameId string maxSize number
create_frame
annotations: none low

Create a new top-level frame (artboard). Auto-placed right of existing frames unless x/y given.

x number y number name string width number
insert_nodes
annotations: none low

Insert a subtree into a container. Each node may include type, tag, name, text, styles, and children. Returns the ids of the new root nodes.

index number parentId string
rename_document
annotations: none low

Rename a Pitolet document. Returns the updated name and revision.

name string
delete_document
annotations: none low

Delete a document created by mistake or a failed attempt. Requires its exact current name and refuses while an editor has it open.

docId string confirmName string
update_node
annotations: none low

Update a node: name, tag, visible, text content, and/or styles (deep-merged into base/breakpoints/states layers). Only pass what changes.

tag string name string nodeId string visible boolean
delete_nodes
annotations: none low

Delete ordinary nodes and their subtrees. Component masters and component content roots are protected.

nodeIds array
export_project
annotations: none low

Export the document as a code project with a manifest for drift checks. Set annotate=true to add source node ids to JSX.

annotate boolean
check_drift
annotations: none low

Compare the current document and project files with the last export. Returns in-sync, design-updated, file-edited, both, or missing for each file.

import_design_system
annotations: none low

Import design tokens from CSS. Pass Tailwind v4 @theme or :root variables with --color-*, --spacing-*, --radius-*, --shadow-*, --font-*, or --text-* prefixes. Existing token names are overwritten.

css string
add_comment
annotations: none low

Add a comment to a node in the editor.

text string nodeId string
get_comments
annotations: none low

List comments, optionally filtered by node.

nodeId string includeResolved boolean
resolve_comment
annotations: none low

Mark a comment as resolved (e.g. after addressing its request).

commentId string
set_tokens
annotations: none low

Merge design-token changes. Set a token to null to delete it. Updates appear on every bound layer.

Permissions 3

network medium
Server uses network capabilities via: fetch()
shell high
Server uses shell capabilities via: child_process, spawn(), spawnSync()
env_vars low
Server uses env_vars capabilities via: process.env

Scan Findings 71

low
Tool 'list_documents' has no annotations annotation_checker · 100%
low
Tool 'list_frames' has no annotations annotation_checker · 100%
low
Tool 'get_node' has no annotations annotation_checker · 100%
low
Tool 'get_selection' has no annotations annotation_checker · 100%
low
Tool 'get_tokens' has no annotations annotation_checker · 100%
low
Tool 'get_design_as_code' has no annotations annotation_checker · 100%
low
Tool 'get_screenshot' has no annotations annotation_checker · 100%
low
Tool 'create_document' has no annotations annotation_checker · 100%
low
Tool 'set_selection' has no annotations annotation_checker · 100%
low
Tool 'create_frame' has no annotations annotation_checker · 100%
low
Tool 'insert_nodes' has no annotations annotation_checker · 100%
low
Tool 'rename_document' has no annotations annotation_checker · 100%
low
Tool 'delete_document' has no annotations annotation_checker · 100%
low
Tool 'update_node' has no annotations annotation_checker · 100%
low
Tool 'delete_nodes' has no annotations annotation_checker · 100%
low
Tool 'export_project' has no annotations annotation_checker · 100%
low
Tool 'check_drift' has no annotations annotation_checker · 100%
low
Tool 'import_design_system' has no annotations annotation_checker · 100%
low
Tool 'add_comment' has no annotations annotation_checker · 100%
low
Tool 'get_comments' has no annotations annotation_checker · 100%
low
Tool 'resolve_comment' has no annotations annotation_checker · 100%
low
Tool 'set_tokens' has no annotations annotation_checker · 100%
medium
OAuth implementation without PKCE auth_checker · 75%
info
Sandbox failed to start for behavioral verification behavioral_verifier · 100%
medium
Suspicious package name: react-dom dependency_analyzer · 60%
medium
Vulnerable dependency: vitest@3.2.0 (GHSA-5xrq-8626-4rwp) dependency_analyzer · 95%
medium
Vulnerable dependency: vite@7.0.0 (GHSA-4w7w-66w2-5vf9) dependency_analyzer · 95%
medium
Vulnerable dependency: vite@7.0.0 (GHSA-93m4-6634-74q7) dependency_analyzer · 95%
medium
Vulnerable dependency: vite@7.0.0 (GHSA-fx2h-pf6j-xcff) dependency_analyzer · 95%
medium
Vulnerable dependency: vite@7.0.0 (GHSA-g4jq-h2w9-997c) dependency_analyzer · 95%
medium
Vulnerable dependency: vite@7.0.0 (GHSA-jqfw-vq24-v9c3) dependency_analyzer · 95%
medium
Vulnerable dependency: vite@7.0.0 (GHSA-p9ff-h696-f583) dependency_analyzer · 95%
medium
Vulnerable dependency: vite@7.0.0 (GHSA-v6wh-96g9-6wx3) dependency_analyzer · 95%
medium
Vulnerable dependency: nanoid@5.1.0 (GHSA-28wg-ghj8-5hjv) dependency_analyzer · 95%
medium
Vulnerable dependency: nanoid@5.1.0 (GHSA-2v37-7h3g-55p8) dependency_analyzer · 95%
medium
Vulnerable dependency: ws@8.18.0 (GHSA-58qx-3vcg-4xpx) dependency_analyzer · 95%
medium
Vulnerable dependency: ws@8.18.0 (GHSA-96hv-2xvq-fx4p) dependency_analyzer · 95%
medium
Buffer.from base64 in pitolet-pitolet-e218cdc/apps/cloud/src/admin/feedback.ts:107 entropy_analyzer · 75%
medium
Buffer.from base64 in pitolet-pitolet-e218cdc/packages/server/src/importer/capture.ts:1249 entropy_analyzer · 75%
info
package.json metadata manifest_parser · 100%
info
Tool: list_documents manifest_parser · 85%
info
Tool: list_frames manifest_parser · 85%
info
Tool: get_node manifest_parser · 85%
info
Tool: get_selection manifest_parser · 85%
info
Tool: get_tokens manifest_parser · 85%
info
Tool: get_design_as_code manifest_parser · 85%
info
Tool: get_screenshot manifest_parser · 85%
info
Tool: create_document manifest_parser · 85%
info
Tool: set_selection manifest_parser · 85%
info
Tool: create_frame manifest_parser · 85%
info
Tool: insert_nodes manifest_parser · 85%
info
Tool: rename_document manifest_parser · 85%
info
Tool: delete_document manifest_parser · 85%
info
Tool: update_node manifest_parser · 85%
info
Tool: delete_nodes manifest_parser · 85%
info
Tool: export_project manifest_parser · 85%
info
Tool: check_drift manifest_parser · 85%
info
Tool: import_design_system manifest_parser · 85%
info
Tool: add_comment manifest_parser · 85%
info
Tool: get_comments manifest_parser · 85%
info
Tool: resolve_comment manifest_parser · 85%
info
Tool: set_tokens manifest_parser · 85%
info
Transport: streamable-http manifest_parser · 80%
info
Required env vars (33) manifest_parser · 80%
info
Sandbox failed to start for output poisoning scan output_poisoning · 100%
medium
Permission: network access detected permission_analyzer · 70%
high
Permission: shell access detected permission_analyzer · 95%
low
Permission: env_vars access detected permission_analyzer · 90%
info
SBOM generated: 49 components sbom_generator · 100%
high
Hardcoded Password found in pitolet-pitolet-e218cdc/apps/cloud/qa-boot.mts secret_scanner · 65%
medium
No build provenance detected (SLSA L0) slsa_assessor · 90%