Pugi

io.pugi由 pugi.io 发布官方发布者v1.0.0更新于 Nov 7, 2026

AI product team: builds and publishes websites from a brief, logos, security checks.

已验证Streamable HTTP可网页运行开发者工具安全与监控媒体与设计

概览

AI 生成的概览

Pugi 是一个远程 AI 产品团队服务，让助手根据需求说明构建、安全检查、预览并发布网站和应用，还能生成标志。

可以做什么
  • 根据需求说明构建和修改网站或应用，跟踪任务进度并发布上线
  • 根据企业名称和风格词生成四个标志方案，并选定其中一个
  • 对公开网站或公开 GitHub 仓库执行被动安全检查
  • 搜索公开的网站和应用目录作为起点
  • 查看账户套餐、余额和每日额度，并获取充值结账链接
  • 查询已发布应用的发布状态
适用场景
适合希望让智能体把一段自然语言需求一路做到上线网站或应用，或在对话中快速对网站、仓库做安全审计的场景。也适合生成标志方案或从现有模板起步。
运行要求
远程 Streamable HTTP 端点；README 说明需要 Bearer 代理密钥（通过 Pugi API 创建）和 Pugi 账户。付费工具消耗预付额度或套餐；欧盟和英国买家需要有效增值税号。
安装前请注意
付费工具会消耗预付额度，代理支付属于商业采购；由钱包决定并付款，额度不足时会触发支付挑战。构建、修改和发布会更改或公开内容，发布前应先查看只读预览。安全检查会把目标网址或仓库发送给 Pugi。请妥善保管代理密钥。

安装

在 SourceWeft 中

  1. 打开 控制台中的 Pugi，将其添加到工作区。
  2. 为需要使用其工具的对话启用该服务。

Web executable，通过 Streamable HTTP。 远程服务在工作区中配置后即可从网页运行时运行。

交给智能体安装

把这段提示词粘贴到 Claude Code、Codex、Cursor 等智能体，或 SourceWeft 对话中。智能体会读取该服务器的安装指南，先向你展示发布者、端点和登录方式，经你同意后再把它添加到你的客户端。密钥不会写进任何命令。

阅读 https://sourceweft.com/mcp/io.pugi%2Fpugi/install.md，并按其中说明把这个 MCP 服务器接入我的客户端。修改任何配置之前，先告诉我它的发布者、端点和登录方式，等我确认。不要把 API 密钥写进命令或我会提交的文件；问我密钥应从哪里获取。

查看智能体所依据的安装指南

其他 MCP 客户端

把它添加到你客户端的 mcpServers 配置中。

{
  "mcpServers": {
    "pugi": {
      "type": "http",
      "url": "https://api.pugi.io/api/agent/v1/mcp"
    }
  }
}

README

[Pugi skills for your coding agent]

Let your coding agent brief Pugi to build, design, secure and publish your app.

[Release] [License: MIT] [11 skills] [Works with Claude Code] [Works with Codex] [Works with Cursor]

pugi.io  |   Docs  |   Support  |   Pricing

Pugi is the AI product team that turns a plain brief into a live, tested app. These are Agent Skills for it. Install them in Claude Code, Codex, Cursor or any agent that reads the Agent Skills format, and your agent can brief Pugi to build and deliver an app, design it, start from a template, make a brand and a site in it, check and fix security, and publish.

Install

Claude Code

bash
claude plugin marketplace add pugi-io/skillsclaude plugin install pugi@pugi

Inside a session the same commands are /plugin marketplace add pugi-io/skills and /plugin install pugi@pugi. The skills then run as /pugi:<skill> (for example /pugi:pugi-publish), and Claude Code also picks them up on its own when a task matches.

Without the plugin, copy the skill folders into your skills directory:

bash
git clone https://github.com/pugi-io/skills pugi-skillsmkdir -p ~/.claude/skillscp -r pugi-skills/skills/* ~/.claude/skills/        # or .claude/skills/ in a project

Codex

bash
git clone https://github.com/pugi-io/skills pugi-skillsmkdir -p ~/.agents/skills && cp -r pugi-skills/skills/* ~/.agents/skills/

Codex reads skills from .agents/skills/ in the repository (from the working directory up to the repository root) and from ~/.agents/skills/ for your user. To install one skill with the built-in installer:

text
$skill-installer install https://github.com/pugi-io/skills/tree/main/skills/pugi-publish

The repository is also a plugin in the open Agent Plugins format (plugin.json at the root, with Codex settings under extensions.com.openai), with .codex-plugin/plugin.json kept as a fallback and a marketplace file at .agents/plugins/marketplace.json:

bash
codex plugin marketplace add pugi-io/skills

Restart Codex so it picks up new skills. Each skill has an agents/openai.yaml with its display name and default prompt.

Cursor

bash
git clone https://github.com/pugi-io/skills pugi-skillsmkdir -p ~/.cursor/skills && cp -r pugi-skills/skills/* ~/.cursor/skills/

Cursor loads Agent Skills from .cursor/skills/ and .agents/skills/ in a project, and from ~/.cursor/skills/ and ~/.agents/skills/ for your user. It also reads .claude/skills/ and .codex/skills/.

The repository is also laid out as a single Cursor plugin, following https://github.com/cursor/plugin-template: .cursor-plugin/plugin.json at the root with name, description, version and author, and the skills in skills/. It is not in the Cursor Marketplace yet.

Any other agent

Each skill is a folder with a SKILL.md (YAML front matter plus Markdown) and optional scripts/. Copy skills/<name>/ to wherever your agent loads skills from.

The skills

SkillWhat it doesPaid plan needed?
pugi-buildWrites a good brief and starts a Pugi build: the quick path from an idea to a project. Uses pugi build (CLI) or app.pugi.ioUses your plan's allowance and credits
pugi-sdlcSteers the full delivery run: plan, plan approval, build, tests, security scan, preview approval, going live, with JSON status. Uses pugi sdlc (CLI) or app.pugi.ioUses your plan's allowance and credits
pugi-artifactsGets the project documents (brief, BRD, PRD, user flow, mockups, spec, test plan), then reads, previews and revises them. Uses pugi artifacts (CLI) or the Delivery bundle viewUses your plan's allowance
pugi-designDraws or changes the app's design in Design mode and applies it to the code. It can save a Pugi design file for a later Figma import (no public import plugin yet)Yes, Founder plan or higher to edit. Viewing is on every plan
pugi-start-from-templateStarts a project from one of 31 starters at app.pugi.io/templates, or lays a starter down locally with pugi scaffoldNo, every plan, within the plan's project limit
pugi-logoGets logo concepts and a brand kit for a business on logo.pugi.io, then wires the kit into the siteNo, downloading needs a free sign-in
pugi-brand-to-siteTurns a logo.pugi.io brand into a new website in the same brandNo, every plan. Building uses the plan's allowance
pugi-security-checkChecks a live site or a repo for leaked keys, missing security headers, insecure cookies, public source maps and committed .env files, with a bundled script and pugi.io/security/auditNo, the script and the web check are free
pugi-fix-securityHas Pugi fix the findings ("Let Pugi fix all") and checks again, at app.pugi.io or from pugi.io/security/auditNo, every plan. Free has a daily number of checks
pugi-deploy-repoImports an existing GitHub repo (from Lovable, Bolt, v0 or anywhere) and publishes it, through Import from GitHub at app.pugi.io or git clone + pugi publishNo, import and publishing on a pugi.app address are on every plan
pugi-publishPublishes a folder to a live *.pugi.app address with HTTPS, then connects your own domain. Uses pugi publish (CLI) or the Publish panelNo for a pugi.app address. Your own domain depends on the plan

Which one to use: pugi-build starts a run; pugi-sdlc takes a run through its gates to going live; pugi-publish and pugi-deploy-repo put code you already have online. Plans and limits: pugi.io/pricing.

Each skill has a status table that marks every step as Available, Not available today or Coming soon. The skills use only what is live: the pugi CLI (@pugi/cli 1.0.0-alpha.246 or later, the version the commands were tested against) and pugi.io pages. More agent tools are coming; the skills tell the agent to use them only once they appear in its tool list or in https://pugi.io/llms.txt.

MCP server

Pugi also runs a remote MCP server for agents. It is listed in the official MCP Registry as io.pugi/pugi; its entry is server.json.

  • Address: https://api.pugi.io/api/agent/v1/mcp (Streamable HTTP)
  • Auth: Authorization: Bearer pugi_agent_.... Create a key with POST https://api.pugi.io/api/agent/v1/keys.
  • Tools: scan_url (passive, read-only security check of a public website, graded A+ to F), get_balance, buy_credits_link (a card checkout link a person opens; it never charges by itself), publish_status.

Details, prices and limits: pugi.io/agents.md.

How it keeps you in control

  • Asks before spending. Every step that builds or spends allowance waits for your yes. The plan Pugi writes is yours to approve, and the build starts only after you approve it.
  • Asks before publishing. Nothing goes live until you approve the preview or say yes to pugi publish.
  • Asks before overwriting. pugi scaffold writes only missing files and lists the ones it skipped. The skill uses --force, which overwrites, only when you ask for it.
  • Asks before DNS changes. Changing DNS moves a domain's traffic, so the skill shows you the current and the new record and waits for your yes. scripts/check-domain.sh only reads what DNS and HTTPS say.
  • Runs only when called, where it matters. In Codex, skills whose main action can spend credits, publish or change a project set allow_implicit_invocation: false, so they run only when you call them, for example $pugi-publish. Only pugi-security-check and pugi-logo may start on their own.
  • Never prints secrets. pugi publish prints only the names of env keys, and pugi-security-check reports the file and the type of a key, never its value.

Requirements

  • For the CLI skills (pugi-build, pugi-sdlc, pugi-artifacts, pugi-publish, pugi-deploy-repo): Node.js 18+, git, and a Pugi account. Install the CLI with npm i -g @pugi/cli and sign in with pugi login. The sign-in is a device flow: you approve it in your browser.
  • For pugi-security-check: Python 3.8+ and git. The script uploads nothing; the optional MCP tool scan_url sends the URL to Pugi.
  • For the console skills (pugi-design, pugi-start-from-template, pugi-brand-to-site, pugi-fix-security, pugi-logo): a browser. pugi-design needs the Founder plan or higher.

Repository layout

text
.├── .claude-plugin/│   ├── plugin.json          Claude Code plugin manifest│   └── marketplace.json     Claude Code marketplace (one plugin: this repo)├── plugin.json              Agent Plugins manifest (Codex reads extensions.com.openai)├── .codex-plugin/plugin.json  Codex fallback manifest├── .agents/plugins/marketplace.json├── .cursor-plugin/plugin.json├── server.json              MCP Registry entry for the Pugi MCP server (io.pugi/pugi)├── smithery/                Smithery listing text and config schema├── assets/                  icon, banner, social preview, NOTICE├── skills/                  one folder per skill: SKILL.md, agents/openai.yaml, optional scripts/│   ├── pugi-build/  pugi-sdlc/  pugi-artifacts/  pugi-design/│   ├── pugi-start-from-template/  pugi-logo/  pugi-brand-to-site/│   ├── pugi-security-check/     scripts/precheck.py│   ├── pugi-fix-security/  pugi-deploy-repo/│   └── pugi-publish/            scripts/check-domain.sh└── scripts/check.sh         Validates front matter and scans this repo for secrets

The skills format is the same for every agent: one SKILL.md per folder. Only the plugin manifests differ, so each agent gets its own manifest next to the shared skills/ folder.

Formats this repository follows

Contributing

Bug reports and skill requests are welcome in Issues. Before a pull request, run bash scripts/check.sh. See CONTRIBUTING.md.

Security

Report a vulnerability to [email protected], not in a public issue. See SECURITY.md.

Support

Questions about your account, plan or a build: pugi.io/support or [email protected]. Developer docs: docs.pugi.dev.

License

The skills, scripts and documentation are under the MIT License. See LICENSE. Each skill folder carries its own copy as LICENSE.txt, so a skill copied on its own keeps the notice.

The images in assets/ (icon.png, banner.png and social-preview.png) show the Pugi logo and are not under the MIT License. They are included only so that plugin directories and this page can show Pugi's mark, and you may redistribute them unchanged as part of this repository for that purpose. "Pugi" and the Pugi logo are trademarks of Pugi Inc.; the license gives no right to use them otherwise. See assets/NOTICE.

来源：README.md，提交 d65569f

工具

13

get_balance

Get credit balance

Shows account plan, masked email, balance and daily allowance.

无需输入参数。

scan_url

Check a website for security issues

Checks a public website for HTTPS, security headers and exposed secrets.

输入参数url必填

publish_status

Get publish status

Get publish status.

输入参数project_id

scan_repo

Check a GitHub repository for security issues

Checks a public GitHub repository for leaked secrets, vulnerable dependencies and risky code.

输入参数refrepo_url必填idempotency_key必填

build_app

Build a web app

Builds a web app from a brief, like build_site builds a website. Pass the brief in the customer's own words. Progress shows in the build card. Pugi checks the built app for security issues; publish waits for that check.

输入参数pickbrief必填themelocalelogo_idmax_usdsite_languagebrandHandoffIdidempotency_key必填

build_site

Build a website from a brief

Builds a website from a brief and returns a job_id. Pass the customer's brief in the customer's own words; do not add features the customer did not ask for (no invented sign-up, accounts, subscriptions or payments). A build takes several minutes; the call may return while it is still running. In hosts that render the build card (MCP Apps or ChatGPT widget), the card tracks progress automatically: do not poll job_status. In hosts without a build card (Claude Code or API), call job_status with the job_id until the job is finished, stopped or failed. Review the view-only preview_url before publishing. One build at a time per account.

输入参数pickbrief必填themelocalelogo_idmax_usdsite_languagebrandHandoffIdidempotency_key必填

edit

Change a site Pugi built

Changes a website in its existing project. Progress shows in the build card.

输入参数pickthemejob_idlocalelogo_idmax_usdproject_idinstruction必填site_languagebrandHandoffIdidempotency_key必填

job_status

Get the status of a build

Returns the state of a build or edit job (running, finished, stopped or failed), a short progress line and, when available, a view-only preview_url. In hosts that render the build card (MCP Apps or ChatGPT widget), the card tracks progress automatically: do not poll job_status. In hosts without a build card (Claude Code or API), call job_status with the job_id until the job is finished, stopped or failed. Preview links expire after 15 minutes; call again for a fresh link.

输入参数job_id必填

publish

Publish a built site

Publishes a built website at its public address.

输入参数job_idproject_ididempotency_key

版本历史

2
  1. v1.0.0最新Oct 29, 2026
  2. v0.1.0Oct 24, 2026

评分

已满足适用检查项的 100%

该评分衡量此收录条目的完整程度，依据注册中心条目、端点与公开来源计算得出。它不是对服务器本身的评价，也不表示服务器安全或当前可用：可连通性是带日期的检查结果，评分也不包含安装量或用户评价。

  • 近 30 天内可连通必需25 分
  • 已声明认证方式必需10 分
  • 已列出工具必需15 分
  • 描述必需15 分
  • 图标10 分
  • 文档15 分
  • 许可证不适用

    托管服务按其提供方的条款使用，因此这里不要求许可证。此检查项不计入百分比。