Find a file
Kayshen Xu 12f8141c2e V0.1.2 (#19)
* Security hardening: fix critical and high-severity vulnerabilities (#18)

* feat(mcp): add sanitizeObject utility to strip prototype pollution keys

Recursively removes __proto__, constructor, and prototype keys from
parsed JSON objects to prevent prototype pollution attacks via
malicious .op files or batch_design DSL input.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* fix(electron): validate file path in saveToPath IPC handler

Prevent path traversal attacks by checking for null bytes and restricting
file extensions to .op and .pen only.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* fix(mcp): guard against prototype pollution in document parsing and batch design

Sanitize JSON.parse output in openDocument() and parseJsonArg() to strip
__proto__, constructor, and prototype keys before processing.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* fix(ai): sanitize debug logs and harden temp file handling

Filter credential patterns from debug tail before sending to client.
Set restrictive 0o700 permissions on temp directory. Validate attachment
media types against allowlist to prevent extension spoofing.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* fix(ai): restrict environment variables passed to codex subprocess

Replace full process.env with explicit allowlist of PATH, HOME, TERM,
LANG, SHELL, TMPDIR, and OPENAI_*/CODEX_* prefixed vars only.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* fix(figma): add decompression size limits to prevent zip bombs

Enforce 100MB total unzipped size and 50MB per-image limits during
.fig file extraction to guard against malicious archives.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* fix(canvas): add dangerous SVG tags to skip list and fix ReDoS in getAttr

Strip script, foreignObject, animate, animateMotion, and set elements
during SVG import. Escape regex-special characters in style attribute
name lookup to prevent ReDoS.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* test(security): add unit tests for security hardening fixes

27 tests covering: sanitizeObject prototype pollution stripping,
document-manager sanitization, batch-design DSL sanitization,
codex env allowlist, debug tail credential filtering, media type
validation, SVG skip tags, and ReDoS safety.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>

* feat(mcp): add live canvas sync and HTTP transport support

Introduce real-time MCP ↔ renderer sync via SSE (server/api/mcp endpoints,
use-mcp-sync hook, mcp-sync-state). Add StreamableHTTPServerTransport for
HTTP and dual stdio+http modes. Electron writes ~/.openpencil/.port for MCP
discovery. New design_prompt tool. Agent settings dialog gains transport
mode selector. Security: restrict Electron file writes to home/temp dirs.
Bump version to 0.1.2.

---------

Co-authored-by: RolandSherwin <RolandSherwin@protonmail.com>
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
2026-03-03 21:08:52 +08:00
.github/workflows V0.1.1 (#17) 2026-03-02 22:26:09 +08:00
.vscode Initialize OpenPencil project with essential files and configurations 2026-02-17 21:14:16 +08:00
build V0.0.3 (#11) 2026-02-26 21:33:48 +08:00
electron V0.1.2 (#19) 2026-03-03 21:08:52 +08:00
public V0.0.3 (#11) 2026-02-26 21:33:48 +08:00
screenshot V0.0.3 (#11) 2026-02-26 21:33:48 +08:00
scripts feat(electron): integrate Electron framework for desktop application support 2026-02-20 20:19:06 +08:00
server V0.1.2 (#19) 2026-03-03 21:08:52 +08:00
src V0.1.2 (#19) 2026-03-03 21:08:52 +08:00
.cta.json Initialize OpenPencil project with essential files and configurations 2026-02-17 21:14:16 +08:00
.gitignore V0.1.0 (#13) 2026-03-01 09:33:52 +08:00
bun.lock V0.1.0 (#13) 2026-03-01 09:33:52 +08:00
CLAUDE.md V0.1.2 (#19) 2026-03-03 21:08:52 +08:00
components.json feat(editor): scaffold core canvas engine and editor layout 2026-02-18 21:49:16 +08:00
electron-builder.yml V0.1.1 (#17) 2026-03-02 22:26:09 +08:00
LICENSE chore: update documentation and add MIT License 2026-02-18 22:35:15 +08:00
package.json V0.1.2 (#19) 2026-03-03 21:08:52 +08:00
README.md V0.1.2 (#19) 2026-03-03 21:08:52 +08:00
tsconfig.json Initialize OpenPencil project with essential files and configurations 2026-02-17 21:14:16 +08:00
vite.config.ts V0.0.3 (#11) 2026-02-26 21:33:48 +08:00

OpenPencil

OpenPencil

AI-native open-source design tool. Design-as-Code.
Prompt to UI on canvas. Multi-agent orchestration. Built-in MCP server. Code generation.

Stars License CI Discord

Quick Start · AI · Features · Discord · Contributing


OpenPencil — click to watch demo

Click the image to watch the demo video


Quick Start

# Install dependencies
bun install

# Start dev server at http://localhost:3000
bun --bun run dev

Or run as a desktop app:

bun run electron:dev

Prerequisites: Bun >= 1.0 and Node.js >= 18

AI-Native Design

OpenPencil is built around AI from the ground up — not as a plugin, but as a core workflow.

Prompt to UI

  • Text-to-design — describe a page, get it generated on canvas in real-time with streaming animation
  • Orchestrator — decomposes complex pages into spatial sub-tasks for parallel generation
  • Design modification — select elements, then describe changes in natural language
  • Vision input — attach screenshots or mockups for reference-based design

Multi-Agent Support

Agent Setup
Claude Code No config — uses Claude Agent SDK with local OAuth
Codex CLI Connect in Agent Settings (Cmd+,)
OpenCode Connect in Agent Settings (Cmd+,)

MCP Server

  • Built-in MCP server — one-click install into Claude Code / Codex / Gemini / OpenCode / Kiro CLIs
  • Design automation from terminal: read, create, and modify .op files via any MCP-compatible agent

Code Generation

  • React + Tailwind CSS
  • HTML + CSS
  • CSS Variables from design tokens

Features

Canvas & Drawing

  • Infinite canvas with pan, zoom, smart alignment guides, and snapping
  • Rectangle, Ellipse, Line, Polygon, Pen (Bezier), Frame, Text
  • Icon picker (Iconify) and image import (PNG/JPEG/SVG/WebP/GIF)
  • Auto-layout — vertical/horizontal with gap, padding, justify, align
  • Multi-page documents with tab navigation

Design System

  • Design variables — color, number, string tokens with $variable references
  • Multi-theme support — multiple axes, each with variants (Light/Dark, Compact/Comfortable)
  • Component system — reusable components with instances and overrides
  • CSS sync — auto-generated custom properties, var(--name) in code output

Figma Import

  • Import .fig files with layout, fills, strokes, effects, text, images, and vectors preserved

Desktop App

  • Native macOS, Windows, and Linux via Electron
  • Auto-update from GitHub Releases
  • Native application menu and file dialogs

Tech Stack

Frontend React 19 · TanStack Start · Tailwind CSS v4 · shadcn/ui
Canvas Fabric.js v7
State Zustand v5
Server Nitro
Desktop Electron 35
AI Anthropic SDK · Claude Agent SDK · OpenCode SDK
Runtime Bun · Vite 7
File format .op — JSON-based, human-readable, Git-friendly

Project Structure

src/
  canvas/          Fabric.js engine — drawing, sync, layout, guides, pen tool
  components/      React UI — editor, panels, shared dialogs, icons
  services/ai/     AI chat, orchestrator, design generation, streaming
  services/figma/  Figma .fig binary import pipeline
  services/codegen React+Tailwind and HTML+CSS code generators
  stores/          Zustand — canvas, document, pages, history, AI, settings
  variables/       Design token resolution and reference management
  mcp/             MCP server tools for external CLI integration
  uikit/           Reusable component kit system
server/
  api/ai/          Nitro API — streaming chat, generation, validation
  utils/           Claude CLI, OpenCode, Codex client wrappers
electron/
  main.ts          Window, Nitro fork, native menu, auto-updater
  preload.ts       IPC bridge

Keyboard Shortcuts

Key Action Key Action
V Select Cmd+S Save
R Rectangle Cmd+Z Undo
O Ellipse Cmd+Shift+Z Redo
L Line Cmd+C/X/V/D Copy/Cut/Paste/Duplicate
T Text Cmd+G Group
F Frame Cmd+Shift+G Ungroup
P Pen tool Cmd+Shift+E Export
H Hand (pan) Cmd+Shift+C Code panel
Del Delete Cmd+Shift+V Variables panel
[ / ] Reorder Cmd+J AI chat
Arrows Nudge 1px Cmd+, Agent settings

Scripts

bun --bun run dev          # Dev server (port 3000)
bun --bun run build        # Production build
bun --bun run test         # Run tests (Vitest)
npx tsc --noEmit           # Type check
bun run electron:dev       # Electron dev
bun run electron:build     # Electron package

Contributing

Contributions are welcome! See CLAUDE.md for architecture details and code style.

  1. Fork and clone
  2. Create a branch: git checkout -b feat/my-feature
  3. Run checks: npx tsc --noEmit && bun --bun run test
  4. Commit with Conventional Commits: feat(canvas): add rotation snapping
  5. Open a PR against main

Roadmap

  • Design variables & tokens with CSS sync
  • Component system (instances & overrides)
  • AI design generation with orchestrator
  • MCP server integration
  • Multi-page support
  • Figma .fig import
  • Boolean operations (union, subtract, intersect)
  • Collaborative editing
  • Plugin system

Contributors

Contributors

Community

Discord Join our Discord — Ask questions, share designs, suggest features.

License

MIT — Copyright (c) 2026 ZSeven-W