Curio Mcp Extension — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited Curio Mcp Extension (MCP Server) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Connect your AI to Curio — a design-style library built for AI agents. Thousands of design styles (real design movements, brands, cultural traditions), each with a machine-readable spec your agent can apply directly to slides, websites, and products.
you're making (slides, websites, apps, stores, articles, posters…) and the feel you want (minimal, luxury, playful, retro, futuristic…).
request, screenshots of real layouts — slide cover, content and data slides, a dashboard, a pricing page, an article.
uses its exact colors, type, spacing and components.
https://mcp.designbycurio.com/mcp (streamable HTTP)| Tool | What it does | Cost |
|---|---|---|
search_styles | Keyword search (English or Chinese), with filters: use (what you're making), mood, kind (where the style comes from), color, era, region, dark | free |
list_styles | Browse / paginate with the same filters | free |
get_style | Metadata + cover image for one style; pass scenes for screenshots of real layouts (slide-cover, slide-content, slide-data, dashboard, price, article, or all) | free |
get_style_spec | Full design spec (DESIGN.md) for a style you've unlocked; for a locked style it returns the cost, your balance and a link to buy credits | free |
unlock_style | Unlock a style for good and return its spec — your AI asks you first | 1 credit, once per style |
get_balance | Your credit balance, how many styles you've unlocked, and a link to buy more | free |
Your AI never spends a credit on its own: get_style_spec only reads, and unlock_style is meant to be called after you agree. Unlocking a style you already own costs nothing.
gemini extensions install https://github.com/designbycurio/curio-mcp-extensionclaude mcp add --transport http curio https://mcp.designbycurio.com/mcpSettings → Connectors → Add custom connector → https://mcp.designbycurio.com/mcp
The button opens Cursor and adds Curio for you. Or add it to ~/.cursor/mcp.json yourself — Cursor opens a browser to sign in on first use:
{
"mcpServers": {
"curio": { "url": "https://mcp.designbycurio.com/mcp" }
}
}The button opens VS Code and installs Curio in your user MCP config. Or add it to .vscode/mcp.json yourself — VS Code opens a browser to authorize on first connect:
{
"servers": {
"curio": { "type": "http", "url": "https://mcp.designbycurio.com/mcp" }
}
}codex mcp add curio --url https://mcp.designbycurio.com/mcpkimi mcp add --transport http --auth oauth curio https://mcp.designbycurio.com/mcpSettings → Apps & Connectors → Developer mode → add https://mcp.designbycurio.com/mcp.
Some clients can't open a browser to sign in — they only have a field for a token (ZCode, WorkBuddy, Qoder, Trae, Cherry Studio, Antigravity, Manus…). For those, create a personal API key and send it as a request header. Clients that can sign in with OAuth don't need one.
curio_sk_ and is shown only once.Authorization: Bearer curio_sk_…Most clients take a JSON block like this. Some name the address field serverUrl or httpUrl, or ask for a transport type — pick streamable HTTP.
{
"mcpServers": {
"curio": {
"url": "https://mcp.designbycurio.com/mcp",
"headers": { "Authorization": "Bearer curio_sk_…" }
}
}
}Claude Code takes the header on the command line:
claude mcp add --transport http curio https://mcp.designbycurio.com/mcp --header "Authorization: Bearer curio_sk_…"Codex reads the key from an environment variable, so it never sits in a config file:
export CURIO_API_KEY=curio_sk_…
codex mcp add curio --url https://mcp.designbycurio.com/mcp --bearer-token-env-var CURIO_API_KEYVS Code can prompt for the key and store it securely instead of writing it into mcp.json:
{
"inputs": [
{ "type": "promptString", "id": "curio-key", "description": "Curio API key", "password": true }
],
"servers": {
"curio": {
"type": "http",
"url": "https://mcp.designbycurio.com/mcp",
"headers": { "Authorization": "Bearer ${input:curio-key}" }
}
}
}Two kinds of key. A read-only key (the default) can search, browse and fetch styles you've already unlocked, and never spends credits. Tick Allow it to spend credits to unlock styles when you create a key and your AI may also call unlock_style — after asking you, same as over OAuth. Treat a key like a password: don't paste it into a chat or commit it to a repo. Revoke it any time on the same page; clients using it stop working within 30 seconds.
Website · Gallery · Pricing · Docs · Privacy · Terms · [email protected]
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.