onsystem
Keeps coding agents on your design system: catches palette colors, native elements and APIs your system lacks, at every edit and pull request, with the fix. Set it up once in your design-system package; every app in your monorepo gets it.
No outside reports on file
Onsystem is relatively low-risk if your team controls the design-system package and reviews configuration changes, but it does read all your code and should only be used by trusted team members.
Based on public adoption and transparency signals as of Oct 29, 2026. Our opinion, not a code audit or security guarantee.
What it can access
- Local filesNo local folder access notedLOW
- Command executionNo shell command runner notedLOW
- Network reachLocal or standard API callsLOW
- CredentialsNo API token requiredLOW
- Package sourcenpm (onsystem)PUBLIC
Inferred from this listing’s public package details and description. Check the project’s source before installing.
Install
npx -y onsystemAbout Onsystem
Onsystem is a tool that watches your code as you edit it and during pull requests to make sure you're using colors, UI elements, and APIs that match your design system. When it finds something that doesn't match, it suggests a fix automatically.
Who it’s for
Software teams that use a shared design system across multiple apps in a monorepo (a single repository with many projects). It helps keep all apps consistent without manual checking.
Alternatives
- Storybook: Visual UI component library with built-in design-system enforcement.
- Chromatic: Automated visual testing that compares components against a reference design.
- Priceline Design System tools: Monorepo utilities for maintaining design consistency.
- Custom ESLint plugin: Write your own linting rules specific to your design system's rules.
Setup
Check these steps against the project’s own instructions before running anything.
Install from npm in your design-system package:
npm install onsystem
Follow the project's README for configuration steps specific to your design system structure.
Why this grade
Signal-based grade (3/7 points): listed in several sources, public source code. This reflects adoption and transparency, not a code review.
Popularity and upkeep
- GitHub stars
- 73
- Weekly npm downloads
- 678
- Listing last refreshed
- 2026-10-29
These are public popularity signals, not a maintenance check. Look at the repository’s commit history and open issues.
Security reports
No reports found for this package in our research (last checked 2026-10-29).
Risks to watch for
- Code access: The tool reads your source code files to check colors and components, so it has access to your codebase structure and implementation details.
- Hidden configuration tricks: The setup file could contain instructions that run unexpected code if someone modifies it in a pull request without review.
- Pull request data: It processes pull requests, which may contain sensitive code, comments, or branch names that could be logged or sent elsewhere depending on configuration.
- Design system as a package: Since it lives in your design-system package, any compromise there affects all apps in the monorepo.
- False positives in AI scanning: The tool may flag valid code as incorrect if the rules in your design system are vague or poorly documented, requiring manual review.
How to lower the risk
Least-privilege permissions
- Limit who can edit the design-system package and onsystem configuration.
- Require code review for any changes to rules or setup files.
Network isolation
- Check the documentation for any network calls it makes (to npm, external services, or analytics).
- Use npm audit regularly to find security updates for the package and its dependencies.
Monitoring
- Watch for unexpected file access or unusual behavior when running pull request checks.
- Log which team members modified the configuration and when.
Red flags to watch for
- New dependencies added to onsystem without explanation.
- Configuration changes that send data to external URLs.
- Sudden changes in CPU or memory usage during code review.
Questions
How do I install Onsystem?
Run npx -y onsystem in your terminal, or add the server entry to your claude_desktop_config.json or .cursor/mcp.json as shown in the Setup section on this page. Full setup docs and environment variables are in github.com/dgesteves/onsystem.
Are there security reports about Onsystem?
No reports found for this package in our research (last checked 2026-10-29). Onsystem currently holds Grade C (Moderate risk signals) based on public adoption and transparency signals. Key risk areas to watch include code access, hidden configuration tricks, pull request data.
Is Onsystem actively maintained?
Onsystem has 73 GitHub stars and 678 weekly npm downloads, with its latest repository commit pushed on 2026-10-23. Our directory data was last refreshed on 2026-10-29. Check recent commit activity, release tags, and open issues at github.com/dgesteves/onsystem before pinning it in production.
What are alternatives to Onsystem?
Notable alternatives to Onsystem include Storybook (Visual UI component library with built-in design-system enforcement), Chromatic (Automated visual testing that compares components against a reference design), Priceline Design System tools (Monorepo utilities for maintaining design consistency), Custom ESLint plugin (Write your own linting rules specific to your design system's rules). You can also compare Onsystem side by side with other MCP servers in the Related tools section on this page.
README badge and team notes
Maintain or use Onsystem? Show its live grade in your GitHub README, docs site, or run a check from the terminal before you install.
GitHub README Markdown:
[](https://agentarmorhq.com/skills/dgesteves-onsystem)HTML embed:
<a href="https://agentarmorhq.com/skills/dgesteves-onsystem"><img src="https://agentarmorhq.com/api/badge/dgesteves-onsystem" alt="AgentArmorHQ Risk Grade for Onsystem" height="20" /></a>Terminal check:
curl -fsSL https://agentarmorhq.com/api/cli | node --input-type=module - check "dgesteves-onsystem"Share with your security lead
Need sign-off to use onsystem? Copy this note for Slack, a ticket or a pull request.
### AgentArmorHQ Security Review Memo: onsystem
- **Listing URL:** https://agentarmorhq.com/skills/dgesteves-onsystem
- **Type:** App connector
- **Risk Grade:** Grade C (Moderate risk signals)
- **Outside Security Advisories on File:** 0
- **Public Adoption:** 73 GitHub stars, 678 weekly npm downloads
#### Permission & Blast-Radius Signals
- **Local files:** No local folder access noted
- **Command execution:** No shell command runner noted
- **Network reach:** Local or standard API calls
- **Credentials:** No API token required
- **Package source:** npm (onsystem)
#### Recommended Hardened Setup
- **Command:** `npx -y --ignore-scripts onsystem`
- **Controls:** Pin an exact version in `.mcp.json`, scope access to a single workspace folder, and use a least-privilege read-only token where supported.
_Based on public adoption and transparency signals as of Oct 29, 2026. Our opinion, not a code audit or security guarantee._Key facts
- Type
- App connector
- Publisher
- dgesteves
- Source code
- github.com/dgesteves/onsystem
- Install command
- npm install onsystem
- Est. context load
- ~550 tokens / turn (~3 tool schemas, 0.27% of 200k context)
- Popularity
- 73 GitHub stars, 678 weekly npm downloads
- Last updated
- 2026-10-29
- Last graded
- 2026-10-29
Community
Discussions for Onsystem
Ask questions or share configuration tips. Governed by our Community Rules & Terms.
No posts match this filter yet.
Be the first to ask a question or share a working tip.
Check before you install, in Claude
Your assistant answers Block, Review or No known issues for any package before it installs it.
Get this check inside Claude