Design systems / AI design toolkit

TypeUI

Give an agent structured design guidance and prompts.

Documentation reviewed

Source review
Oct 18, 2026

Understand the resource

What it is.

TypeUI’s current offering spans design skills, UI prompts, brand kits and shared design systems, with MCP integrations. A separate analytics product makes the choice about both design workflow and, when enabled, measurement.

When it is useful

You want repeatable design guidance for an existing codebase and can review each proposed change.

A proposed application

Put it to work.

This example illustrates a possible use. The proposed workflow and expected result are separate from the bounded checks recorded below.

Try this

Use one settings-page prompt with your established tokens, then inspect labels, errors and keyboard navigation before accepting the screen.

Result to aim for

A reviewable UI proposal that follows an existing system.

Before you start

What you need.

Compatible coding tools and the relevant service access; analytics requires a separate setup decision.

The practical boundaries

What to watch for.

MCP access and analytics collection add different permission and data-handling questions; evaluate them separately.
Publisher claims of better conversion or privacy were not validated, and no account or integration was connected.

Review record

What we could establish.

Public primary documentation reviewed. See the account-free evaluation for executed checks and remaining workflow limits.

Source coverage and runtime coverage are separate

The source-review notes describe documentation and identity. The account-free evaluation below records exactly which public interaction or local fixture was checked, what happened, and what remains untested.

Check current access, terms, licensing and data handling before using a resource with your own material.

Runtime and security evaluation

What the evaluation covers.

Limited evaluationAccount-free · Oct 19, 2026

The Atlas design-skill preview opened with details and overview content. The browser worked despite a 429 response to the separate HTTP client.

Methods: Public HTTP response · Public browser sample. A completed check covers the stated sample; it is not a safety certification.

Target: https://www.typeui.sh/
Version or capture: Unversioned public page observed on 2026-10-19
Integrity scope: sha256:426684f52364914a4954dacdf33acbdd8e2704b8b07b8057d9e2f8cefd2442a9 — initial HTTP 429 response body only; not whole-application integrity.

Test conditions

Chromium 155.0.8059.82, 1365×900 desktop viewport.
Separate fresh, ephemeral browser contexts for entry and interaction; no owner profile, credentials or stored session.
Only GET/HEAD network requests allowed; forms, downloads, WebSockets and service workers blocked. Some analytics endpoints also blocked.
Short bounded waits; no mobile, assistive-technology, cross-browser or performance certification.

Individual checks and observations

Public HTTP response
blocked
Public HTTP response: Anonymous GET with redirects followed, response-body SHA-256 and selected security-header summaries; no cookies retained.
Observed: The standalone client received 429 at https://www.typeui.sh/. The fresh browser check is reported separately; this is not evidence that the site is offline.
Fresh browser entry
pass
Public browser sample: Open the catalog URL in a new anonymous Chromium context with read-only network guards and no inherited profile.
Observed: The document returned 200 and identified itself as “Build better UI with AI using Codex, Claude & Cursor | TypeUI”. 83 image elements were present; no account was used.
Observed public sample or navigation
pass
Public browser sample: Follow the observed View Preview link to https://www.typeui.sh/design-skills/atlas.
Observed: The destination returned 200; title: “Atlas Design Skill File | TypeUI”. 4 page image elements had decoded during the bounded wait. This count is not a catalog size or performance benchmark.

Security findings and boundaries

Passive inspection of the initial public document’s response headers and anonymous browser request hostnames, with read-only guards. No source exploitation, account access, dependency audit or private data.

Observed · info

Public response protections

The initial browser page used HTTPS. Its response included HSTS. No enforcing Content-Security-Policy response header was observed. This records the sampled response only; meta policies, backend authorization and exploit resistance were not assessed.

Observed · info

Request surface in the anonymous visit

TypeUI attempted requests to 1 additional host, including assets.typeui.sh. Host counts include requests stopped by the test guard; they do not establish what data a service retained.

Practical advice · caution

Before using this reference

Inspect the preview as design guidance first. Creative skills, analytics and MCP access have different data and permission boundaries.

Practical caveats

Inspect the preview as design guidance first. Creative skills, analytics and MCP access have different data and permission boundaries.
MCP access and analytics collection add different permission and data-handling questions; evaluate them separately.

What remains untested

No skill was installed, agent connected, analytics script deployed or paid plan purchased; generated UI quality and account permissions remain untested.
Results describe the observed public pages and a bounded action, not the entire product or the referenced designs.

Security limits

No authentication, authorization, tenant separation, data retention or backend handling was tested.
Header presence or absence is a sampled configuration observation, not a security certification or an exploit finding.
0 blocked-request records were retained across entry and interaction checks. Guards may alter normal page behavior; the logs do not represent unrestricted traffic.

Evaluation sources

Download this evaluation record (JSON)

Follow the evidence

Sources and further reading.

Primary product page

Keep exploring