Editor and agent setup
One public contract for humans and agents.
VS Code, Cursor, Claude Code, and other HTTP-capable tools can read the same source-grounded Markdown and catalogue endpoints. No private source is discoverable through them.
Discovery sequence
- Start with
/llms.txt. - Read the Markdown catalogue and a component behavior contract.
- Install only the exact registry URL in that contract.
- Run the consumer's type, lint, behavior, and accessibility checks.
TypeScript setup
Use the workspace TypeScript version, strict mode, and the same import aliases declared in components.json. The delivered source remains editable and participates in your application's own compiler and test gates.
Choose the authoritative surface
Use /llms.txt to discover public entry points, the Markdown contract to understand behavior, the catalogue JSON to resolve identifiers, and the registry response to install files. A generated answer, search excerpt or source-viewer preview is not a substitute for the exact registry URL recorded by those surfaces.
Ask an agent to cite the component slug and registry URL it used, list the files it changed, and leave the project's dependency versions under the project's control. It should not invent a Pro URL, a paid release name, an entitlement, or private source that is absent from the public contract.
Keep edits reviewable
Install one dependency group at a time, inspect the diff, and run focused checks before broad composition. Treat generated source as ordinary application code: preserve accessible names, keyboard handling, refs and direction-aware behavior when editing it. Keep the shared theme import in one known global entry so an editor does not mask missing styles with preview-only CSS.
When updating an already edited component, compare the incoming registry files with the committed local version. Reapply only intentional customisations, record the source version in the change, and rerun type, behavior, accessibility and production-build checks.
Limit tool access
An editor needs read access to the public documentation and permission to change only the consumer repository. It does not need production credentials, billing data, account recovery material or access to private release storage to install a free component. Review terminal commands and file changes before allowing a tool to publish, deploy or overwrite a locally modified file.
MCP status
The public HTTP discovery surfaces are implemented. A hosted MCP transport is not advertised as live until authentication, rate limits, monitoring, and production deployment are approved and verified.