← Back to search

codesign-mcp

GitHub Actions Scanned 23d ago

Local MCP server for Tencent CoDesign — read sharing artboards, specs, screenshots and slices.

npm
? Not scanned yet

Versions

0.3.0latest
Jul 29, 2026
0.2.0
Jul 2, 2026
0.1.10
Jun 9, 2026
0.1.9
May 26, 2026
0.1.8
May 22, 2026
+ show 8 moreshow less
0.1.7
May 21, 2026
0.1.6
May 19, 2026
0.1.5
May 19, 2026
0.1.4
May 19, 2026
0.1.3
May 19, 2026
0.1.2
May 19, 2026
0.1.1
May 19, 2026
0.1.0
May 19, 2026

Tools 8

get_artboard_image
annotations: none low

Returns the CoDesign preview or cover image for visual comparison only.

debug_collect_network
annotations: verified low

Open the sharing page in a headless browser, record all network responses for `timeoutMs`, and return a REDACTED summary.

readOnlyHint true openWorldHint true idempotentHint false destructiveHint false
download_slice
annotations: verified low

Downloads designer-exported CoDesign slice assets from the official slice manifest, matched by layer object_id.

readOnlyHint false openWorldHint true idempotentHint true destructiveHint false
get_artboard_spec
annotations: verified low

Canonical CoDesign source for design-to-code: fetches the official meta_url JSON with layer positions, text, fills, colors, CSS, groups, and slice manifest.

readOnlyHint true openWorldHint true idempotentHint true destructiveHint false
codesign_status
annotations: verified low

Return MCP server config (profile path, idle settings) and current browser/login status.

readOnlyHint true openWorldHint false idempotentHint true destructiveHint false
list_artboards
annotations: verified low

Use this first when a task contains a CoDesign sharing URL or asks to implement/recreate a CoDesign design.

readOnlyHint true openWorldHint true idempotentHint true destructiveHint false
codesign_login
annotations: verified low

Open a visible Chromium window pointed at codesign.qq.com so the user can scan-login.

readOnlyHint false openWorldHint true idempotentHint true destructiveHint false
codesign_logout
annotations: verified low

Close any running browser and wipe the persistent profile directory.

readOnlyHint false openWorldHint false idempotentHint true destructiveHint true

Permissions 3

network medium
Server uses network capabilities via: fetch()
shell high
Server uses shell capabilities via: child_process, spawn()
env_vars low
Server uses env_vars capabilities via: process.env

Scan Findings 29

low
Tool 'get_artboard_image' has no annotations annotation_checker · 100%
info
Tool 'debug_collect_network' annotations are consistent annotation_checker · 80%
info
Tool 'download_slice' annotations are consistent annotation_checker · 80%
info
Tool 'get_artboard_spec' annotations are consistent annotation_checker · 80%
info
Tool 'codesign_status' annotations are consistent annotation_checker · 80%
info
Tool 'list_artboards' annotations are consistent annotation_checker · 80%
info
Tool 'codesign_login' annotations are consistent annotation_checker · 80%
info
Tool 'codesign_logout' annotations are consistent annotation_checker · 80%
medium
OAuth implementation without PKCE auth_checker · 75%
info
Sandbox failed to start for behavioral verification behavioral_verifier · 100%
medium
Buffer.from base64 in ccpopy-codesign-mcp-81e09c2/scripts/extract-fixtures.mjs:137 entropy_analyzer · 75%
medium
Buffer.from base64 in ccpopy-codesign-mcp-81e09c2/scripts/inspect-state-keys.mjs:12 entropy_analyzer · 75%
info
package.json metadata manifest_parser · 100%
info
Tool: get_artboard_image manifest_parser · 85%
info
Tool: debug_collect_network manifest_parser · 85%
info
Tool: download_slice manifest_parser · 85%
info
Tool: get_artboard_spec manifest_parser · 85%
info
Tool: codesign_status manifest_parser · 85%
info
Tool: list_artboards manifest_parser · 85%
info
Tool: codesign_login manifest_parser · 85%
info
Tool: codesign_logout manifest_parser · 85%
info
Transport: stdio manifest_parser · 90%
info
Required env vars (6) manifest_parser · 80%
info
Sandbox failed to start for output poisoning scan output_poisoning · 100%
medium
Permission: network access detected permission_analyzer · 70%
high
Permission: shell access detected permission_analyzer · 95%
low
Permission: env_vars access detected permission_analyzer · 90%
info
SBOM generated: 35 components sbom_generator · 100%
medium
No build provenance detected (SLSA L0) slsa_assessor · 90%