Pugi

io.pugiPublished by pugi.ioOfficial publisherv1.0.0Updated Nov 7, 2026

AI product team: builds and publishes websites from a brief, logos, security checks.

VerifiedStreamable HTTPWeb executableDeveloper Tools Security & Monitoring Media & Design

Server details

Identifier: io.pugi/pugi
Transport: Streamable HTTP
Runtime: Web executable
Trust: Verified
Published: Oct 24, 2026

Security note

MCP servers receive tool arguments from a conversation and may perform external actions. Review what a server can do before you enable it, and give it only the access it needs.

The registry verified that this server's namespace belongs to pugi.io, which also runs its endpoint. That identifies the publisher; it does not make the server's tools safe.

SourceWeft's checks cover whether the listing is complete and the endpoint answered; they do not review the server's code or what its tools do.

Add a badge to your README

Show readers this MCP server is listed on SourceWeft. The badge links to this page.

[![Listed on SourceWeft](https://sourceweft.com/badge/mcp/io.pugi%2Fpugi.svg)](https://sourceweft.com/mcp/io.pugi%2Fpugi?utm_source=readme&utm_medium=badge)

Overview

AI-generated overview

Pugi is a remote AI product-team service that lets an assistant build, security-check, preview and publish websites and apps from a brief, plus make logos.

What you can do: Build and edit websites or apps from a brief, track job progress and publish them live
Generate four logo concepts from a business name and style words, then select one
Run passive security checks on a public website or a public GitHub repository
Search the public catalogue of sites and apps to start from
Check account plan, balance and daily allowance, and get a card checkout link to add credit
Check publish status of apps
When to use it: Useful when you want an agent to take a plain-language brief through to a live site or app, or to get a quick security audit of a site or repo without leaving the chat. Also handy for producing logo options and starting from an existing template.
Requirements: Remote Streamable HTTP endpoint; the README states a bearer agent key is required (created through the Pugi API) and a Pugi account. Paid tools draw on prepaid credit or a plan; EU and UK buyers need a valid VAT number.

Before you install

Paid tools spend prepaid credit, and agent payments are business purchases; the wallet decides and pays, and a payment challenge can be triggered when credit runs low. Builds, edits and publishing change or make public content, so review the view-only preview before publishing. Security scans send the target URL or repository to Pugi. Keep the agent key secret.

Installation

In SourceWeft

Open Pugi in the dashboard and add it to a workspace.
Enable the server for the chats that should use its tools.

Web executable via Streamable HTTP. Remote servers run from the web runtime once configured in a workspace.

Use with an agent

Paste this prompt into Claude Code, Codex, Cursor or another agent — or into SourceWeft chat. The agent reads this server's install guide, shows you its publisher, endpoint and sign-in, and adds it to your client once you agree. Keys never go into a command.

Read https://sourceweft.com/mcp/io.pugi%2Fpugi/install.md and connect the MCP server it describes to my client. Before changing any config, show me its publisher, endpoint and sign-in method and wait for my OK. Never put an API key in a command or in a file I would commit; ask me where it should come from.

Read the install guide the agent follows

Other MCP clients

Add this to your client's mcpServers config.

{
  "mcpServers": {
    "pugi": {
      "type": "http",
      "url": "https://api.pugi.io/api/agent/v1/mcp"
    }
  }
}

README

[Pugi skills for your coding agent]

Let your coding agent brief Pugi to build, design, secure and publish your app.

[Release] [License: MIT] [11 skills] [Works with Claude Code] [Works with Codex] [Works with Cursor]

pugi.io | Docs | Support | Pricing

Pugi is the AI product team that turns a plain brief into a live, tested app. These are Agent Skills for it. Install them in Claude Code, Codex, Cursor or any agent that reads the Agent Skills format, and your agent can brief Pugi to build and deliver an app, design it, start from a template, make a brand and a site in it, check and fix security, and publish.

Install

Claude Code

Inside a session the same commands are /plugin marketplace add pugi-io/skills and /plugin install pugi@pugi. The skills then run as /pugi:<skill> (for example /pugi:pugi-publish), and Claude Code also picks them up on its own when a task matches.

Without the plugin, copy the skill folders into your skills directory:

bash

git clone https://github.com/pugi-io/skills pugi-skillsmkdir -p ~/.claude/skillscp -r pugi-skills/skills/* ~/.claude/skills/        # or .claude/skills/ in a project

git clone https://github.com/pugi-io/skills pugi-skillsmkdir -p ~/.claude/skillscp -r pugi-skills/skills/* ~/.claude/skills/        # or .claude/skills/ in a project

Codex

bash

git clone https://github.com/pugi-io/skills pugi-skillsmkdir -p ~/.agents/skills && cp -r pugi-skills/skills/* ~/.agents/skills/

git clone https://github.com/pugi-io/skills pugi-skillsmkdir -p ~/.agents/skills && cp -r pugi-skills/skills/* ~/.agents/skills/

Codex reads skills from .agents/skills/ in the repository (from the working directory up to the repository root) and from ~/.agents/skills/ for your user. To install one skill with the built-in installer:

The repository is also a plugin in the open Agent Plugins format (plugin.json at the root, with Codex settings under extensions.com.openai), with .codex-plugin/plugin.json kept as a fallback and a marketplace file at .agents/plugins/marketplace.json:

Restart Codex so it picks up new skills. Each skill has an agents/openai.yaml with its display name and default prompt.

Cursor

bash

git clone https://github.com/pugi-io/skills pugi-skillsmkdir -p ~/.cursor/skills && cp -r pugi-skills/skills/* ~/.cursor/skills/

git clone https://github.com/pugi-io/skills pugi-skillsmkdir -p ~/.cursor/skills && cp -r pugi-skills/skills/* ~/.cursor/skills/

Cursor loads Agent Skills from .cursor/skills/ and .agents/skills/ in a project, and from ~/.cursor/skills/ and ~/.agents/skills/ for your user. It also reads .claude/skills/ and .codex/skills/.

The repository is also laid out as a single Cursor plugin, following https://github.com/cursor/plugin-template: .cursor-plugin/plugin.json at the root with name, description, version and author, and the skills in skills/. It is not in the Cursor Marketplace yet.

Any other agent

Each skill is a folder with a SKILL.md (YAML front matter plus Markdown) and optional scripts/. Copy skills/<name>/ to wherever your agent loads skills from.

The skills

Skill	What it does	Paid plan needed?
`pugi-build`	Writes a good brief and starts a Pugi build: the quick path from an idea to a project. Uses `pugi build` (CLI) or app.pugi.io	Uses your plan's allowance and credits
`pugi-sdlc`	Steers the full delivery run: plan, plan approval, build, tests, security scan, preview approval, going live, with JSON status. Uses `pugi sdlc` (CLI) or app.pugi.io	Uses your plan's allowance and credits
`pugi-artifacts`	Gets the project documents (brief, BRD, PRD, user flow, mockups, spec, test plan), then reads, previews and revises them. Uses `pugi artifacts` (CLI) or the Delivery bundle view	Uses your plan's allowance
`pugi-design`	Draws or changes the app's design in Design mode and applies it to the code. It can save a Pugi design file for a later Figma import (no public import plugin yet)	Yes, Founder plan or higher to edit. Viewing is on every plan
`pugi-start-from-template`	Starts a project from one of 31 starters at app.pugi.io/templates, or lays a starter down locally with `pugi scaffold`	No, every plan, within the plan's project limit
`pugi-logo`	Gets logo concepts and a brand kit for a business on logo.pugi.io, then wires the kit into the site	No, downloading needs a free sign-in
`pugi-brand-to-site`	Turns a logo.pugi.io brand into a new website in the same brand	No, every plan. Building uses the plan's allowance
`pugi-security-check`	Checks a live site or a repo for leaked keys, missing security headers, insecure cookies, public source maps and committed `.env` files, with a bundled script and pugi.io/security/audit	No, the script and the web check are free
`pugi-fix-security`	Has Pugi fix the findings ("Let Pugi fix all") and checks again, at app.pugi.io or from pugi.io/security/audit	No, every plan. Free has a daily number of checks
`pugi-deploy-repo`	Imports an existing GitHub repo (from Lovable, Bolt, v0 or anywhere) and publishes it, through Import from GitHub at app.pugi.io or `git clone` + `pugi publish`	No, import and publishing on a pugi.app address are on every plan
`pugi-publish`	Publishes a folder to a live `*.pugi.app` address with HTTPS, then connects your own domain. Uses `pugi publish` (CLI) or the Publish panel	No for a pugi.app address. Your own domain depends on the plan

Which one to use: pugi-build starts a run; pugi-sdlc takes a run through its gates to going live; pugi-publish and pugi-deploy-repo put code you already have online. Plans and limits: pugi.io/pricing.

Each skill has a status table that marks every step as Available, Not available today or Coming soon. The skills use only what is live: the pugi CLI (@pugi/cli 1.0.0-alpha.246 or later, the version the commands were tested against) and pugi.io pages. More agent tools are coming; the skills tell the agent to use them only once they appear in its tool list or in https://pugi.io/llms.txt.

MCP server

Pugi also runs a remote MCP server for agents. It is listed in the official MCP Registry as io.pugi/pugi; its entry is server.json.

Address: https://api.pugi.io/api/agent/v1/mcp (Streamable HTTP)
Auth: Authorization: Bearer pugi_agent_.... Create a key with POST https://api.pugi.io/api/agent/v1/keys.
Tools: scan_url (passive, read-only security check of a public website, graded A+ to F), get_balance, buy_credits_link (a card checkout link a person opens; it never charges by itself), publish_status.

Details, prices and limits: pugi.io/agents.md.

How it keeps you in control

Asks before spending. Every step that builds or spends allowance waits for your yes. The plan Pugi writes is yours to approve, and the build starts only after you approve it.
Asks before publishing. Nothing goes live until you approve the preview or say yes to pugi publish.
Asks before overwriting. pugi scaffold writes only missing files and lists the ones it skipped. The skill uses --force, which overwrites, only when you ask for it.
Asks before DNS changes. Changing DNS moves a domain's traffic, so the skill shows you the current and the new record and waits for your yes. scripts/check-domain.sh only reads what DNS and HTTPS say.
Runs only when called, where it matters. In Codex, skills whose main action can spend credits, publish or change a project set allow_implicit_invocation: false, so they run only when you call them, for example $pugi-publish. Only pugi-security-check and pugi-logo may start on their own.
Never prints secrets. pugi publish prints only the names of env keys, and pugi-security-check reports the file and the type of a key, never its value.

Requirements

For the CLI skills (pugi-build, pugi-sdlc, pugi-artifacts, pugi-publish, pugi-deploy-repo): Node.js 18+, git, and a Pugi account. Install the CLI with npm i -g @pugi/cli and sign in with pugi login. The sign-in is a device flow: you approve it in your browser.
For pugi-security-check: Python 3.8+ and git. The script uploads nothing; the optional MCP tool scan_url sends the URL to Pugi.
For the console skills (pugi-design, pugi-start-from-template, pugi-brand-to-site, pugi-fix-security, pugi-logo): a browser. pugi-design needs the Founder plan or higher.

Repository layout

text

.├── .claude-plugin/│   ├── plugin.json          Claude Code plugin manifest│   └── marketplace.json     Claude Code marketplace (one plugin: this repo)├── plugin.json              Agent Plugins manifest (Codex reads extensions.com.openai)├── .codex-plugin/plugin.json  Codex fallback manifest├── .agents/plugins/marketplace.json├── .cursor-plugin/plugin.json├── server.json              MCP Registry entry for the Pugi MCP server (io.pugi/pugi)├── smithery/                Smithery listing text and config schema├── assets/                  icon, banner, social preview, NOTICE├── skills/                  one folder per skill: SKILL.md, agents/openai.yaml, optional scripts/│   ├── pugi-build/  pugi-sdlc/  pugi-artifacts/  pugi-design/│   ├── pugi-start-from-template/  pugi-logo/  pugi-brand-to-site/│   ├── pugi-security-check/     scripts/precheck.py│   ├── pugi-fix-security/  pugi-deploy-repo/│   └── pugi-publish/            scripts/check-domain.sh└── scripts/check.sh         Validates front matter and scans this repo for secrets

.├── .claude-plugin/│   ├── plugin.json          Claude Code plugin manifest│   └── marketplace.json     Claude Code marketplace (one plugin: this repo)├── plugin.json              Agent Plugins manifest (Codex reads extensions.com.openai)├── .codex-plugin/plugin.json  Codex fallback manifest├── .agents/plugins/marketplace.json├── .cursor-plugin/plugin.json├── server.json              MCP Registry entry for the Pugi MCP server (io.pugi/pugi)├── smithery/                Smithery listing text and config schema├── assets/                  icon, banner, social preview, NOTICE├── skills/                  one folder per skill: SKILL.md, agents/openai.yaml, optional scripts/│   ├── pugi-build/  pugi-sdlc/  pugi-artifacts/  pugi-design/│   ├── pugi-start-from-template/  pugi-logo/  pugi-brand-to-site/│   ├── pugi-security-check/     scripts/precheck.py│   ├── pugi-fix-security/  pugi-deploy-repo/│   └── pugi-publish/            scripts/check-domain.sh└── scripts/check.sh         Validates front matter and scans this repo for secrets

The skills format is the same for every agent: one SKILL.md per folder. Only the plugin manifests differ, so each agent gets its own manifest next to the shared skills/ folder.

Formats this repository follows

Agent Skills specification: https://agentskills.io/specification
Claude Code plugins, manifest reference: https://code.claude.com/docs/en/plugins/manifest-reference
Claude Code plugin marketplaces: https://code.claude.com/docs/en/plugin-marketplaces and https://code.claude.com/docs/en/plugins/marketplace-reference
Codex skills: https://learn.chatgpt.com/docs/build-skills
Codex plugins and marketplaces, and the portable root plugin.json: https://developers.openai.com/plugins/build/plugins
Cursor skills: https://cursor.com/docs/skills
Cursor plugins: https://cursor.com/docs/plugins and the single-plugin layout in https://github.com/cursor/plugin-template

Contributing

Bug reports and skill requests are welcome in Issues. Before a pull request, run bash scripts/check.sh. See CONTRIBUTING.md.

Security

Report a vulnerability to [email protected], not in a public issue. See SECURITY.md.

Support

Questions about your account, plan or a build: pugi.io/support or [email protected]. Developer docs: docs.pugi.dev.

License

The skills, scripts and documentation are under the MIT License. See LICENSE. Each skill folder carries its own copy as LICENSE.txt, so a skill copied on its own keeps the notice.

The images in assets/ (icon.png, banner.png and social-preview.png) show the Pugi logo and are not under the MIT License. They are included only so that plugin directories and this page can show Pugi's mark, and you may redistribute them unchanged as part of this repository for that purpose. "Pugi" and the Pugi logo are trademarks of Pugi Inc.; the license gives no right to use them otherwise. See assets/NOTICE.

Source: README.md at commit d65569f

Tools

get_balance

Get credit balance

Shows account plan, masked email, balance and daily allowance.

Takes no parameters.

buy_credits_link

Get a link to add credit

Get a link to add credit.

Parametersamount_usd

scan_url

Check a website for security issues

Checks a public website for HTTPS, security headers and exposed secrets.

Parametersurlrequired

make_logo

Make four logos

Creates four logos from the business name, description and style words. Pass the user's description and style words verbatim. Pugi first asks a few brief questions, one per call (needs_input, free), in the language you pass as language: ask the user exactly that question, then call again with trade or answers so far; draw_now true draws from what is known. Generates logo design assets only.

Parametersnamenichestyletradestylesanswerscolourspaletterefinestaglinedraw_nowindustry+5 more

publish_status

Get publish status

Get publish status.

Parametersproject_id

catalog_search

Search the Pugi catalogue

Search the Pugi catalogue.

Parameterstagslimitquerycategory

scan_repo

Check a GitHub repository for security issues

Checks a public GitHub repository for leaked secrets, vulnerable dependencies and risky code.

Parametersrefrepo_urlrequiredidempotency_keyrequired

build_app

Build a web app

Builds a web app from a brief, like build_site builds a website. Pass the brief in the customer's own words. Progress shows in the build card. Pugi checks the built app for security issues; publish waits for that check.

Parameterspickbriefrequiredthemelocalelogo_idmax_usdsite_languagebrandHandoffIdidempotency_keyrequired

build_site

Build a website from a brief

Builds a website from a brief and returns a job_id. Pass the customer's brief in the customer's own words; do not add features the customer did not ask for (no invented sign-up, accounts, subscriptions or payments). A build takes several minutes; the call may return while it is still running. In hosts that render the build card (MCP Apps or ChatGPT widget), the card tracks progress automatically: do not poll job_status. In hosts without a build card (Claude Code or API), call job_status with the job_id until the job is finished, stopped or failed. Review the view-only preview_url before publishing. One build at a time per account.

Parameterspickbriefrequiredthemelocalelogo_idmax_usdsite_languagebrandHandoffIdidempotency_keyrequired

edit

Change a site Pugi built

Changes a website in its existing project. Progress shows in the build card.

Parameterspickthemejob_idlocalelogo_idmax_usdproject_idinstructionrequiredsite_languagebrandHandoffIdidempotency_keyrequired

job_status

Get the status of a build

Returns the state of a build or edit job (running, finished, stopped or failed), a short progress line and, when available, a view-only preview_url. In hosts that render the build card (MCP Apps or ChatGPT widget), the card tracks progress automatically: do not poll job_status. In hosts without a build card (Claude Code or API), call job_status with the job_id until the job is finished, stopped or failed. Preview links expire after 15 minutes; call again for a fresh link.

Parametersjob_idrequired

publish

Publish a built site

Publishes a built website at its public address.

Parametersjob_idproject_ididempotency_key

select_logo

Select a logo

Returns the chosen account-owned logo ID. Does not buy or generate anything.

Parameterslogo_idrequired

Version history

v1.0.0LatestOct 29, 2026
v0.1.0Oct 24, 2026

Score

100% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

Reached in the last 30 daysRequired25 pts
Auth declaredRequired10 pts
Tools listedRequired15 pts
DescriptionRequired15 pts
Logo10 pts
Documentation15 pts
LicenseNot applicable
A hosted service is used under its provider's terms, so no license is expected here. This check is left out of the percentage.

Pugi

Overview

Installation

In SourceWeft

Use with an agent

Other MCP clients

README

Install

Claude Code

Codex

Cursor

Any other agent

The skills

MCP server

How it keeps you in control

Requirements

Repository layout

Contributing

Security

Support

License

Tools

get_balance

buy_credits_link

scan_url

make_logo

publish_status

catalog_search

scan_repo

build_app

build_site

edit

job_status

publish

select_logo

Version history

Score

More servers like Pugi

Campaign Pack