Pugi

السجل الرسمي الأمن

Passive website security checks, credit balance, card top-up links and published app status.

التثبيت

أضف هذا إلى إعدادات MCP في عميلك (Claude Desktop: claude_desktop_config.json، وCursor: ‏.cursor/mcp.json، ويستخدم VS Code وغيره الصيغة نفسها «mcpServers»).

Remote (streamable-http)

Claude Code

claude mcp add --transport http pugi 'https://api.pugi.io/api/agent/v1/mcp' --header 'Authorization: <Your Pugi agent key. Create one with POST https://api.pugi.io/api/agent/v1/keys (see https://pugi.io/agents.md).>'

إعداد JSON (Claude Desktop وCursor وVS Code)

{
    "mcpServers": {
        "pugi": {
            "type": "http",
            "url": "https://api.pugi.io/api/agent/v1/mcp",
            "headers": {
                "Authorization": "<Your Pugi agent key. Create one with POST https://api.pugi.io/api/agent/v1/keys (see https://pugi.io/agents.md).>"
            }
        }
    }
}

التوثيق

مأخوذ من ملف README للمشروع على GitHub ويُحدَّث أسبوعيًا. تفتح الروابط على GitHub.

المحتويات

Install
The skills
MCP server
How it keeps you in control
Requirements
Repository layout
Contributing
Security
Support
License

Let your coding agent brief Pugi to build, design, secure and publish your app.

pugi.io |
Docs |
Support |
Pricing

Pugi is the AI product team that turns a plain brief into a live, tested app. These are Agent Skills for it. Install them in Claude Code, Codex, Cursor or any agent that reads the Agent Skills format, and your agent can brief Pugi to build and deliver an app, design it, start from a template, make a brand and a site in it, check and fix security, and publish.

Install

Claude Code

claude plugin marketplace add pugi-io/skills
claude plugin install pugi@pugi

Inside a session the same commands are /plugin marketplace add pugi-io/skills and /plugin install pugi@pugi. The skills then run as /pugi:<skill> (for example /pugi:pugi-publish), and Claude Code also picks them up on its own when a task matches.

Without the plugin, copy the skill folders into your skills directory:

git clone https://github.com/pugi-io/skills pugi-skills
mkdir -p ~/.claude/skills
cp -r pugi-skills/skills/* ~/.claude/skills/        # or .claude/skills/ in a project

Codex

git clone https://github.com/pugi-io/skills pugi-skills
mkdir -p ~/.agents/skills && cp -r pugi-skills/skills/* ~/.agents/skills/

Codex reads skills from .agents/skills/ in the repository (from the working directory up to the repository root) and from ~/.agents/skills/ for your user. To install one skill with the built-in installer:

$skill-installer install https://github.com/pugi-io/skills/tree/main/skills/pugi-publish

The repository is also a plugin in the open Agent Plugins format (plugin.json at the root, with Codex settings under extensions.com.openai), with .codex-plugin/plugin.json kept as a fallback and a marketplace file at .agents/plugins/marketplace.json:

codex plugin marketplace add pugi-io/skills

Restart Codex so it picks up new skills. Each skill has an agents/openai.yaml with its display name and default prompt.

Cursor

git clone https://github.com/pugi-io/skills pugi-skills
mkdir -p ~/.cursor/skills && cp -r pugi-skills/skills/* ~/.cursor/skills/

Cursor loads Agent Skills from .cursor/skills/ and .agents/skills/ in a project, and from ~/.cursor/skills/ and ~/.agents/skills/ for your user. It also reads .claude/skills/ and .codex/skills/.

The repository is also laid out as a single Cursor plugin, following https://github.com/cursor/plugin-template: .cursor-plugin/plugin.json at the root with name, description, version and author, and the skills in skills/. It is not in the Cursor Marketplace yet.

Any other agent

Each skill is a folder with a SKILL.md (YAML front matter plus Markdown) and optional scripts/. Copy skills/<name>/ to wherever your agent loads skills from.

The skills

Skill	What it does	Paid plan needed?
`pugi-build`	Writes a good brief and starts a Pugi build: the quick path from an idea to a project. Uses `pugi build` (CLI) or app.pugi.io	Uses your plan's allowance and credits
`pugi-sdlc`	Steers the full delivery run: plan, plan approval, build, tests, security scan, preview approval, going live, with JSON status. Uses `pugi sdlc` (CLI) or app.pugi.io	Uses your plan's allowance and credits
`pugi-artifacts`	Gets the project documents (brief, BRD, PRD, user flow, mockups, spec, test plan), then reads, previews and revises them. Uses `pugi artifacts` (CLI) or the Delivery bundle view	Uses your plan's allowance
`pugi-design`	Draws or changes the app's design in Design mode and applies it to the code. It can save a Pugi design file for a later Figma import (no public import plugin yet)	Yes, Founder plan or higher to edit. Viewing is on every plan
`pugi-start-from-template`	Starts a project from one of 31 starters at app.pugi.io/templates, or lays a starter down locally with `pugi scaffold`	No, every plan, within the plan's project limit
`pugi-logo`	Gets logo concepts and a brand kit for a business on logo.pugi.io, then wires the kit into the site	No, downloading needs a free sign-in
`pugi-brand-to-site`	Turns a logo.pugi.io brand into a new website in the same brand	No, every plan. Building uses the plan's allowance
`pugi-security-check`	Checks a live site or a repo for leaked keys, missing security headers, insecure cookies, public source maps and committed `.env` files, with a bundled script and pugi.io/security/audit	No, the script and the web check are free
`pugi-fix-security`	Has Pugi fix the findings ("Let Pugi fix all") and checks again, at app.pugi.io or from pugi.io/security/audit	No, every plan. Free has a daily number of checks
`pugi-deploy-repo`	Imports an existing GitHub repo (from Lovable, Bolt, v0 or anywhere) and publishes it, through Import from GitHub at app.pugi.io or `git clone` + `pugi publish`	No, import and publishing on a pugi.app address are on every plan
`pugi-publish`	Publishes a folder to a live `*.pugi.app` address with HTTPS, then connects your own domain. Uses `pugi publish` (CLI) or the Publish panel	No for a pugi.app address. Your own domain depends on the plan

Which one to use: pugi-build starts a run; pugi-sdlc takes a run through its gates to going live; pugi-publish and pugi-deploy-repo put code you already have online. Plans and limits: pugi.io/pricing.

Each skill has a status table that marks every step as Available, Not available today or Coming soon. The skills use only what is live: the pugi CLI (@pugi/cli 1.0.0-alpha.246 or later, the version the commands were tested against) and pugi.io pages. More agent tools are coming; the skills tell the agent to use them only once they appear in its tool list or in https://pugi.io/llms.txt.

MCP server

Pugi also runs a remote MCP server for agents. It is listed in the official MCP Registry as io.pugi/pugi; its entry is server.json.

Address: https://api.pugi.io/api/agent/v1/mcp (Streamable HTTP)
Auth: Authorization: Bearer pugi_agent_.... Create a key with POST https://api.pugi.io/api/agent/v1/keys.
Tools: scan_url (passive, read-only security check of a public website, graded A+ to F), get_balance, buy_credits_link (a card checkout link a person opens; it never charges by itself), publish_status.

Details, prices and limits: pugi.io/agents.md.

How it keeps you in control

Asks before spending. Every step that builds or spends allowance waits for your yes. The plan Pugi writes is yours to approve, and the build starts only after you approve it.
Asks before publishing. Nothing goes live until you approve the preview or say yes to pugi publish.
Asks before overwriting. pugi scaffold writes only missing files and lists the ones it skipped. The skill uses --force, which overwrites, only when you ask for it.
Asks before DNS changes. Changing DNS moves a domain's traffic, so the skill shows you the current and the new record and waits for your yes. scripts/check-domain.sh only reads what DNS and HTTPS say.
Runs only when called, where it matters. In Codex, skills whose main action can spend credits, publish or change a project set allow_implicit_invocation: false, so they run only when you call them, for example $pugi-publish. Only pugi-security-check and pugi-logo may start on their own.
Never prints secrets. pugi publish prints only the names of env keys, and pugi-security-check reports the file and the type of a key, never its value.

Requirements

For the CLI skills (pugi-build, pugi-sdlc, pugi-artifacts, pugi-publish, pugi-deploy-repo): Node.js 18+, git, and a Pugi account. Install the CLI with npm i -g @pugi/cli and sign in with pugi login. The sign-in is a device flow: you approve it in your browser.
For pugi-security-check: Python 3.8+ and git. The script uploads nothing; the optional MCP tool scan_url sends the URL to Pugi.
For the console skills (pugi-design, pugi-start-from-template, pugi-brand-to-site, pugi-fix-security, pugi-logo): a browser. pugi-design needs the Founder plan or higher.

Repository layout

.
├── .claude-plugin/
│   ├── plugin.json          Claude Code plugin manifest
│   └── marketplace.json     Claude Code marketplace (one plugin: this repo)
├── plugin.json              Agent Plugins manifest (Codex reads extensions.com.openai)
├── .codex-plugin/plugin.json  Codex fallback manifest
├── .agents/plugins/marketplace.json
├── .cursor-plugin/plugin.json
├── server.json              MCP Registry entry for the Pugi MCP server (io.pugi/pugi)
├── smithery/                Smithery listing text and config schema
├── assets/                  icon, banner, social preview, NOTICE
├── skills/                  one folder per skill: SKILL.md, agents/openai.yaml, optional scripts/
│   ├── pugi-build/  pugi-sdlc/  pugi-artifacts/  pugi-design/
│   ├── pugi-start-from-template/  pugi-logo/  pugi-brand-to-site/
│   ├── pugi-security-check/     scripts/precheck.py
│   ├── pugi-fix-security/  pugi-deploy-repo/
│   └── pugi-publish/            scripts/check-domain.sh
└── scripts/check.sh         Validates front matter and scans this repo for secrets

The skills format is the same for every agent: one SKILL.md per folder. Only the plugin manifests differ, so each agent gets its own manifest next to the shared skills/ folder.

Formats this repository follows

Agent Skills specification: https://agentskills.io/specification
Claude Code plugins, manifest reference: https://code.claude.com/docs/en/plugins/manifest-reference
Claude Code plugin marketplaces: https://code.claude.com/docs/en/plugin-marketplaces and https://code.claude.com/docs/en/plugins/marketplace-reference
Codex skills: https://learn.chatgpt.com/docs/build-skills
Codex plugins and marketplaces, and the portable root plugin.json: https://developers.openai.com/plugins/build/plugins
Cursor skills: https://cursor.com/docs/skills
Cursor plugins: https://cursor.com/docs/plugins and the single-plugin layout in https://github.com/cursor/plugin-template

Contributing

Bug reports and skill requests are welcome in Issues. Before a pull request, run bash scripts/check.sh. See CONTRIBUTING.md.

Security

Report a vulnerability to security@pugi.io, not in a public issue. See SECURITY.md.

Support

Questions about your account, plan or a build: pugi.io/support or support@pugi.io. Developer docs: docs.pugi.dev.

License

The skills, scripts and documentation are under the MIT License. See LICENSE. Each skill folder carries its own copy as LICENSE.txt, so a skill copied on its own keeps the notice.

The images in assets/ (icon.png, banner.png and social-preview.png) show the Pugi logo and are not under the MIT License. They are included only so that plugin directories and this page can show Pugi's mark, and you may redistribute them unchanged as part of this repository for that purpose. "Pugi" and the Pugi logo are trademarks of Pugi Inc.; the license gives no right to use them otherwise. See assets/NOTICE.

الأسئلة الشائعة

ما هو Pugi؟

Passive website security checks, credit balance, card top-up links and published app status.

كيف أثبّت Pugi؟

يعمل كخادم بعيد. في Claude Code: claude mcp add --transport http pugi 'https://api.pugi.io/api/agent/v1/mcp' --header 'Authorization: <Your Pugi agent key. Create one with POST https://api.pugi.io/api/agent/v1/keys (see https://pugi.io/agents.md).>'. وفي العملاء الآخرين، الصق إعداد JSON من هذه الصفحة في إعدادات MCP الخاصة بهم.

هل يحتاج Pugi إلى مفتاح API؟

نعم. يتطلب Authorization، وتضبطها في إعداداته.

هل Pugi مفتوح المصدر؟

نعم. شيفرته متاحة على GitHub بترخيص MIT.

من يصون Pugi؟

ينشره pugi-io. يدرجه AI.tn لكنه لا يصونه ولا يوصي به.

من سجل MCP الرسمي. الإدراج ليس توصية: راجع شيفرة الخادم وصلاحياته قبل منحه الوصول إلى بياناتك.

تفاصيل الخادم

مُدرج في: سجل MCP الرسمي
الناشر: pugi-io
الفئة: الأمن
طريقة التشغيل: بعيد
نجوم GitHub: ★ 0
الترخيص: MIT
لغة البرمجة: Python
آخر تحديث للشيفرة: ٢٤‏/١٠‏/٢٠٢٦
المشكلات المفتوحة: 0
الإصدار: 0.1.0
نُشر في: ٢٤‏/١٠‏/٢٠٢٦

io.pugi/pugi

خوادم مشابهة

Bitwarden Public API and Secrets Manager (unofficial) Unofficial MCP server for the Bitwarden Public API and Secrets Manager, self-hosted or ...
ThreatLocker MCP Every ThreatLocker Portal API feature, plus the write operations the read-only tools la...
NovaSolver Studio Free desktop CAE: import CAD/STL, solve FEM structural/thermal and CFD, verify the answer.
SkillTotal Deterministic security scan of MCP servers, agent skills and npm/PyPI packages. Runs lo...
TOPY.AI · AI CSO Founders' AI CSO: vulnerabilities, dependencies, secrets, verified-site checks, threat ...
Testez votre tracking Free website tracking audit, no account needed: GTM, GA4, Meta Pixel, Consent Mode v2, ...
S1000D Reader (S1000D Stack) Read S1000D data and publication modules as structure, with applicability and verificat...
S1000D Verify (S1000D Stack) Validate S1000D data modules: XSD, BREX chain and reference resolution as one verificat...

الأمن