Pugi

io.pugi由 pugi.io 發布官方發布者v1.0.0更新於 Nov 7, 2026

AI product team: builds and publishes websites from a brief, logos, security checks.

已驗證Streamable HTTP可網頁執行開發者工具安全與監控媒體與設計

概覽

AI 產生的概覽

Pugi 是遠端 AI 產品團隊服務，讓助理依需求說明建置、做安全檢查、預覽並發布網站與應用程式，還能產生標誌。

可以做什麼
  • 依需求說明建置與修改網站或應用程式，追蹤工作進度並發布上線
  • 依企業名稱與風格詞產生四個標誌方案，並選定其中一個
  • 對公開網站或公開 GitHub 儲存庫執行被動安全檢查
  • 搜尋公開的網站與應用程式目錄作為起點
  • 查看帳戶方案、餘額與每日額度，並取得儲值結帳連結
  • 查詢已發布應用程式的發布狀態
適用情境
適合想讓代理把一段自然語言需求一路做到上線網站或應用程式，或在對話中快速對網站、儲存庫做安全稽核的情境。也適合產生標誌方案或從現有範本起步。
執行需求
遠端 Streamable HTTP 端點；README 說明需要 Bearer 代理金鑰（透過 Pugi API 建立）與 Pugi 帳戶。付費工具會消耗預付額度或方案；歐盟與英國買家需要有效統一編號（VAT）。
安裝前請注意
付費工具會消耗預付額度，代理付款屬於商業採購；由錢包決定並付款，額度不足時會觸發付款挑戰。建置、修改與發布會變更或公開內容，發布前應先檢視唯讀預覽。安全檢查會把目標網址或儲存庫傳送給 Pugi。請妥善保管代理金鑰。

安裝

在 SourceWeft 中

  1. 開啟 儀表板中的 Pugi，將其新增到工作區。
  2. 為需要使用其工具的對話啟用該服務。

Web executable，透過 Streamable HTTP。 遠端服務在工作區中設定後即可從網頁執行環境執行。

交給代理程式安裝

把這段提示詞貼上到 Claude Code、Codex、Cursor 等代理程式，或 SourceWeft 對話中。代理程式會讀取該伺服器的安裝指南，先向你展示發布者、端點和登入方式，經你同意後再把它新增到你的客戶端。金鑰不會寫進任何命令。

閱讀 https://sourceweft.com/mcp/io.pugi%2Fpugi/install.md，並按其中說明把這個 MCP 伺服器接入我的客戶端。修改任何設定之前，先告訴我它的發布者、端點和登入方式，等我確認。不要把 API 金鑰寫進命令或我會提交的檔案；問我金鑰應從哪裡取得。

檢視代理程式所依據的安裝指南

其他 MCP 客戶端

把它新增到你客戶端的 mcpServers 設定中。

{
  "mcpServers": {
    "pugi": {
      "type": "http",
      "url": "https://api.pugi.io/api/agent/v1/mcp"
    }
  }
}

README

[Pugi skills for your coding agent]

Let your coding agent brief Pugi to build, design, secure and publish your app.

[Release] [License: MIT] [11 skills] [Works with Claude Code] [Works with Codex] [Works with Cursor]

pugi.io  |   Docs  |   Support  |   Pricing

Pugi is the AI product team that turns a plain brief into a live, tested app. These are Agent Skills for it. Install them in Claude Code, Codex, Cursor or any agent that reads the Agent Skills format, and your agent can brief Pugi to build and deliver an app, design it, start from a template, make a brand and a site in it, check and fix security, and publish.

Install

Claude Code

bash
claude plugin marketplace add pugi-io/skillsclaude plugin install pugi@pugi

Inside a session the same commands are /plugin marketplace add pugi-io/skills and /plugin install pugi@pugi. The skills then run as /pugi:<skill> (for example /pugi:pugi-publish), and Claude Code also picks them up on its own when a task matches.

Without the plugin, copy the skill folders into your skills directory:

bash
git clone https://github.com/pugi-io/skills pugi-skillsmkdir -p ~/.claude/skillscp -r pugi-skills/skills/* ~/.claude/skills/        # or .claude/skills/ in a project

Codex

bash
git clone https://github.com/pugi-io/skills pugi-skillsmkdir -p ~/.agents/skills && cp -r pugi-skills/skills/* ~/.agents/skills/

Codex reads skills from .agents/skills/ in the repository (from the working directory up to the repository root) and from ~/.agents/skills/ for your user. To install one skill with the built-in installer:

text
$skill-installer install https://github.com/pugi-io/skills/tree/main/skills/pugi-publish

The repository is also a plugin in the open Agent Plugins format (plugin.json at the root, with Codex settings under extensions.com.openai), with .codex-plugin/plugin.json kept as a fallback and a marketplace file at .agents/plugins/marketplace.json:

bash
codex plugin marketplace add pugi-io/skills

Restart Codex so it picks up new skills. Each skill has an agents/openai.yaml with its display name and default prompt.

Cursor

bash
git clone https://github.com/pugi-io/skills pugi-skillsmkdir -p ~/.cursor/skills && cp -r pugi-skills/skills/* ~/.cursor/skills/

Cursor loads Agent Skills from .cursor/skills/ and .agents/skills/ in a project, and from ~/.cursor/skills/ and ~/.agents/skills/ for your user. It also reads .claude/skills/ and .codex/skills/.

The repository is also laid out as a single Cursor plugin, following https://github.com/cursor/plugin-template: .cursor-plugin/plugin.json at the root with name, description, version and author, and the skills in skills/. It is not in the Cursor Marketplace yet.

Any other agent

Each skill is a folder with a SKILL.md (YAML front matter plus Markdown) and optional scripts/. Copy skills/<name>/ to wherever your agent loads skills from.

The skills

SkillWhat it doesPaid plan needed?
pugi-buildWrites a good brief and starts a Pugi build: the quick path from an idea to a project. Uses pugi build (CLI) or app.pugi.ioUses your plan's allowance and credits
pugi-sdlcSteers the full delivery run: plan, plan approval, build, tests, security scan, preview approval, going live, with JSON status. Uses pugi sdlc (CLI) or app.pugi.ioUses your plan's allowance and credits
pugi-artifactsGets the project documents (brief, BRD, PRD, user flow, mockups, spec, test plan), then reads, previews and revises them. Uses pugi artifacts (CLI) or the Delivery bundle viewUses your plan's allowance
pugi-designDraws or changes the app's design in Design mode and applies it to the code. It can save a Pugi design file for a later Figma import (no public import plugin yet)Yes, Founder plan or higher to edit. Viewing is on every plan
pugi-start-from-templateStarts a project from one of 31 starters at app.pugi.io/templates, or lays a starter down locally with pugi scaffoldNo, every plan, within the plan's project limit
pugi-logoGets logo concepts and a brand kit for a business on logo.pugi.io, then wires the kit into the siteNo, downloading needs a free sign-in
pugi-brand-to-siteTurns a logo.pugi.io brand into a new website in the same brandNo, every plan. Building uses the plan's allowance
pugi-security-checkChecks a live site or a repo for leaked keys, missing security headers, insecure cookies, public source maps and committed .env files, with a bundled script and pugi.io/security/auditNo, the script and the web check are free
pugi-fix-securityHas Pugi fix the findings ("Let Pugi fix all") and checks again, at app.pugi.io or from pugi.io/security/auditNo, every plan. Free has a daily number of checks
pugi-deploy-repoImports an existing GitHub repo (from Lovable, Bolt, v0 or anywhere) and publishes it, through Import from GitHub at app.pugi.io or git clone + pugi publishNo, import and publishing on a pugi.app address are on every plan
pugi-publishPublishes a folder to a live *.pugi.app address with HTTPS, then connects your own domain. Uses pugi publish (CLI) or the Publish panelNo for a pugi.app address. Your own domain depends on the plan

Which one to use: pugi-build starts a run; pugi-sdlc takes a run through its gates to going live; pugi-publish and pugi-deploy-repo put code you already have online. Plans and limits: pugi.io/pricing.

Each skill has a status table that marks every step as Available, Not available today or Coming soon. The skills use only what is live: the pugi CLI (@pugi/cli 1.0.0-alpha.246 or later, the version the commands were tested against) and pugi.io pages. More agent tools are coming; the skills tell the agent to use them only once they appear in its tool list or in https://pugi.io/llms.txt.

MCP server

Pugi also runs a remote MCP server for agents. It is listed in the official MCP Registry as io.pugi/pugi; its entry is server.json.

  • Address: https://api.pugi.io/api/agent/v1/mcp (Streamable HTTP)
  • Auth: Authorization: Bearer pugi_agent_.... Create a key with POST https://api.pugi.io/api/agent/v1/keys.
  • Tools: scan_url (passive, read-only security check of a public website, graded A+ to F), get_balance, buy_credits_link (a card checkout link a person opens; it never charges by itself), publish_status.

Details, prices and limits: pugi.io/agents.md.

How it keeps you in control

  • Asks before spending. Every step that builds or spends allowance waits for your yes. The plan Pugi writes is yours to approve, and the build starts only after you approve it.
  • Asks before publishing. Nothing goes live until you approve the preview or say yes to pugi publish.
  • Asks before overwriting. pugi scaffold writes only missing files and lists the ones it skipped. The skill uses --force, which overwrites, only when you ask for it.
  • Asks before DNS changes. Changing DNS moves a domain's traffic, so the skill shows you the current and the new record and waits for your yes. scripts/check-domain.sh only reads what DNS and HTTPS say.
  • Runs only when called, where it matters. In Codex, skills whose main action can spend credits, publish or change a project set allow_implicit_invocation: false, so they run only when you call them, for example $pugi-publish. Only pugi-security-check and pugi-logo may start on their own.
  • Never prints secrets. pugi publish prints only the names of env keys, and pugi-security-check reports the file and the type of a key, never its value.

Requirements

  • For the CLI skills (pugi-build, pugi-sdlc, pugi-artifacts, pugi-publish, pugi-deploy-repo): Node.js 18+, git, and a Pugi account. Install the CLI with npm i -g @pugi/cli and sign in with pugi login. The sign-in is a device flow: you approve it in your browser.
  • For pugi-security-check: Python 3.8+ and git. The script uploads nothing; the optional MCP tool scan_url sends the URL to Pugi.
  • For the console skills (pugi-design, pugi-start-from-template, pugi-brand-to-site, pugi-fix-security, pugi-logo): a browser. pugi-design needs the Founder plan or higher.

Repository layout

text
.├── .claude-plugin/│   ├── plugin.json          Claude Code plugin manifest│   └── marketplace.json     Claude Code marketplace (one plugin: this repo)├── plugin.json              Agent Plugins manifest (Codex reads extensions.com.openai)├── .codex-plugin/plugin.json  Codex fallback manifest├── .agents/plugins/marketplace.json├── .cursor-plugin/plugin.json├── server.json              MCP Registry entry for the Pugi MCP server (io.pugi/pugi)├── smithery/                Smithery listing text and config schema├── assets/                  icon, banner, social preview, NOTICE├── skills/                  one folder per skill: SKILL.md, agents/openai.yaml, optional scripts/│   ├── pugi-build/  pugi-sdlc/  pugi-artifacts/  pugi-design/│   ├── pugi-start-from-template/  pugi-logo/  pugi-brand-to-site/│   ├── pugi-security-check/     scripts/precheck.py│   ├── pugi-fix-security/  pugi-deploy-repo/│   └── pugi-publish/            scripts/check-domain.sh└── scripts/check.sh         Validates front matter and scans this repo for secrets

The skills format is the same for every agent: one SKILL.md per folder. Only the plugin manifests differ, so each agent gets its own manifest next to the shared skills/ folder.

Formats this repository follows

Contributing

Bug reports and skill requests are welcome in Issues. Before a pull request, run bash scripts/check.sh. See CONTRIBUTING.md.

Security

Report a vulnerability to [email protected], not in a public issue. See SECURITY.md.

Support

Questions about your account, plan or a build: pugi.io/support or [email protected]. Developer docs: docs.pugi.dev.

License

The skills, scripts and documentation are under the MIT License. See LICENSE. Each skill folder carries its own copy as LICENSE.txt, so a skill copied on its own keeps the notice.

The images in assets/ (icon.png, banner.png and social-preview.png) show the Pugi logo and are not under the MIT License. They are included only so that plugin directories and this page can show Pugi's mark, and you may redistribute them unchanged as part of this repository for that purpose. "Pugi" and the Pugi logo are trademarks of Pugi Inc.; the license gives no right to use them otherwise. See assets/NOTICE.

來源：README.md，提交 d65569f

工具

13

get_balance

Get credit balance

Shows account plan, masked email, balance and daily allowance.

無需輸入參數。

scan_url

Check a website for security issues

Checks a public website for HTTPS, security headers and exposed secrets.

輸入參數url必填

publish_status

Get publish status

Get publish status.

輸入參數project_id

scan_repo

Check a GitHub repository for security issues

Checks a public GitHub repository for leaked secrets, vulnerable dependencies and risky code.

輸入參數refrepo_url必填idempotency_key必填

build_app

Build a web app

Builds a web app from a brief, like build_site builds a website. Pass the brief in the customer's own words. Progress shows in the build card. Pugi checks the built app for security issues; publish waits for that check.

輸入參數pickbrief必填themelocalelogo_idmax_usdsite_languagebrandHandoffIdidempotency_key必填

build_site

Build a website from a brief

Builds a website from a brief and returns a job_id. Pass the customer's brief in the customer's own words; do not add features the customer did not ask for (no invented sign-up, accounts, subscriptions or payments). A build takes several minutes; the call may return while it is still running. In hosts that render the build card (MCP Apps or ChatGPT widget), the card tracks progress automatically: do not poll job_status. In hosts without a build card (Claude Code or API), call job_status with the job_id until the job is finished, stopped or failed. Review the view-only preview_url before publishing. One build at a time per account.

輸入參數pickbrief必填themelocalelogo_idmax_usdsite_languagebrandHandoffIdidempotency_key必填

edit

Change a site Pugi built

Changes a website in its existing project. Progress shows in the build card.

輸入參數pickthemejob_idlocalelogo_idmax_usdproject_idinstruction必填site_languagebrandHandoffIdidempotency_key必填

job_status

Get the status of a build

Returns the state of a build or edit job (running, finished, stopped or failed), a short progress line and, when available, a view-only preview_url. In hosts that render the build card (MCP Apps or ChatGPT widget), the card tracks progress automatically: do not poll job_status. In hosts without a build card (Claude Code or API), call job_status with the job_id until the job is finished, stopped or failed. Preview links expire after 15 minutes; call again for a fresh link.

輸入參數job_id必填

publish

Publish a built site

Publishes a built website at its public address.

輸入參數job_idproject_ididempotency_key

版本歷史

2
  1. v1.0.0最新Oct 29, 2026
  2. v0.1.0Oct 24, 2026

評分

已滿足適用檢查項的 100%

該評分衡量此收錄條目的完整程度，依據註冊中心條目、端點與公開來源計算得出。它不是對伺服器本身的評價，也不表示伺服器安全或目前可用：可連通性是帶日期的檢查結果，評分也不包含安裝量或使用者評價。

  • 近 30 天內可連通必需25 分
  • 已宣告認證方式必需10 分
  • 已列出工具必需15 分
  • 描述必需15 分
  • 圖示10 分
  • 文件15 分
  • 授權條款不適用

    託管服務按其提供方的條款使用，因此這裡不要求授權條款。此檢查項不計入百分比。