LLMs generate text well, but structured UI poorly. Getting a model to emit a working dashboard, form, or chart usually means JSON schemas, fragile parsing, and no way to render output until the full response arrives. Token costs on verbose JSON payloads compound the problem.
What This Does
OpenUI is a full-stack, renderer-agnostic framework for generative UI built around OpenUI Lang, a compact streaming-first language that uses up to 67% fewer tokens than JSON. The repo is a monorepo with packages/ (1101 files) holding the core libraries, examples/ (520 files) with working integrations for LangGraph, Google ADK, and other agent frameworks, docs/ (1040 files) powering the public site, and benchmarks/ with sample prompts and comparison outputs (.oui vs .vercel.jsonl vs .c1.json).
The flow is: define a component library → generate a system prompt from it → stream OpenUI Lang from the model → parse and render progressively in React. Official React support ships with built-in component libraries (charts, forms, tables) and chat surfaces. Community integrations cover Vue, Svelte, and others.
How It Is Wired
The internal call graph has not been mapped for this repository yet. What the structure shows: CI/CD runs through .github/workflows/ with separate pipelines for builds (build-js.yml), releases (release.yml, publish-npm-package.yml), CLI E2E tests, and template package-manager validation. Changesets (.changeset/) manage versioning and npm publishing. The benchmarks/ directory contains run-benchmark.ts and generate-samples.ts scripts plus sample outputs in multiple formats for token-efficiency comparisons.
The docs site is a Next.js app (docs/next.config.mjs), and examples/agent-frameworks/ contains standalone Next.js projects for LangGraph Platform and Google ADK, each with its own package.json and lockfile.
How To Use It
The README documents a scaffold-and-run path:
npx @openuidev/cli@latest create --name genui-chat-app
cd genui-chat-app
echo "OPENAI_API_KEY=sk-your-key-here" > .env
npm run dev
The CLI scaffolds an end-to-end app with streaming, built-in UI, and OpenUI Lang support. Configuration is minimal — the only required variable is OPENAI_API_KEY in .env. The examples/agent-frameworks/google-adk/.env.example file confirms this pattern for the example apps.
Real-World Use
A copilot or assistant that needs to render structured UI on the fly — a support agent generating a troubleshooting dashboard, a data assistant producing charts from a query, or an internal tool that builds forms from natural language. The component library constrains what the model can emit, so output stays within your design system rather than arbitrary HTML/CSS.
Code Health & Issues
Deep static analysis has not run for this repository yet. Structure-level observations: 98 test files exist, CI workflows are present, MIT license is in place, and lockfiles are committed. The repo is a fork of thesysdev/openui (8793 stars) with 0 stars on this fork, so upstream maintenance and divergence are the main practical concerns.
The Bottom Line
OpenUI solves a real problem — token-efficient, streamable UI generation — with a clean architecture and serious ecosystem coverage across React, Vue, Svelte, and multiple agent frameworks. The fork status is a risk: this copy may lag upstream or diverge. Teams building LLM-powered interfaces that need structured, streaming UI output should evaluate it; those needing only chat-style text output will find it heavier than necessary.
What the analyser found
Deployment readiness
6/7
✗Container image
✓CI pipeline
✓Lockfile committed
✓Test suite
✓README
✓License
✓No committed secrets
Composition
2,836 files
TypeScript880
TSX803
CSS167
JSON151
SCSS105
Markdown66
ReactNext.jsVueSvelteFastAPIExpressLangChain
Module dependencies
The 10 most depended-upon modules of 1,470, from static import analysis. Red outline marks a module in an import cycle.
Ranked by severity × confidence × production reach. Reach is the honest discriminator across a collection that is mostly other people's code: the same finding matters more in something that ships.
high3
medium5
low1
Pin third-party GitHub Actions to a commit SHAhigh
.github/workflows
pnpm/action-setup@v6
A tag can be moved, so the action running with your token and secrets is whatever its owner last pushed; this is how tj-actions/changed-files leaked secrets from thousands of repos.
Fix: Replace each @vN with the 40-character commit SHA, keep # vN as a comment, and let Dependabot bump the SHAs.
Upgrade the pinned dependency carrying a published advisoryhigh9 occurrences
next@16.2.6 CVE-2026-64642 (high) +8 more
The pinned version is the one that installs, so a published advisory against it describes this deployment rather than a hypothetical one, and the advisory is also a public description of how to exploit it.
Fix: Upgrade to the fixed version named in the advisory, then commit the lockfile.
Make CI invoke the test suite it hashigh83 occurrences
.github/workflows
83 test files, no test command in the 4 workflows read
A green check that never executed an assertion is worse than no check, because reviewers trust it.
Fix: Add a test step to the existing workflow rather than a new workflow.
Declare least-privilege permissions for GITHUB_TOKENmedium
.github/workflows/build-js.yml
1 workflow(s) declare no permissions
With no declaration the token inherits the repository default, so any injected step can push commits or mint releases from inside your own CI.
Fix: Add permissions: contents: read at the top of the workflow and widen per job only where needed.
Enable Dependabot or Renovatemedium
20 manifest(s), no update bot configured
Without a bot a published advisory sits unpatched until someone audits by hand, which across 1,322 repositories means never.
Fix: Commit .github/dependabot.yml covering the repo ecosystems plus github-actions.
Gate pull requests on a dependency vulnerability scanmedium
.github/workflows
no dependency scan in CI
This is the one gate that would catch a known-vulnerable package before it reaches a build, and no repository in the sample had it.
Fix: Add dependency-review-action on pull_request, or osv-scanner on push and a schedule.
Move large binaries to Git LFS or out of the repositorymedium10 occurrences
docs/public/videos/react-email.mp4
10 blobs over 5MB: react-email.mp4 40.2MB, pi-agent-harness.mp4 13.4MB, demo.gif 11.7MB
One repository here carries twenty blobs over 5MB including a 10.9MB spreadsheet, so every clone and every CI checkout pays for data nobody diffs.
Fix: Track those extensions with LFS, or move datasets to object storage and fetch them in a setup step.
Set persist-credentials: false on checkoutmedium
.github/workflows/build-js.yml
checkout keeps the token, then dependencies are installed
The token stays in .git/config for every later step, so a malicious postinstall script reads a pushable credential without one ever being passed to it.
Fix: Add with: persist-credentials: false, and pass an explicit token only to the step that pushes.
Set timeout-minutes on the workflow jobslow4 occurrences
.github/workflows/build-js.yml
4 workflow(s) declare no job timeout
A wedged step runs to the six-hour platform default, which on a two-hourly schedule means three runs overlap behind it.
Fix: Add timeout-minutes with a realistic bound to each job.
Checked deterministically against the repository tree and a bounded set of its files: committed credentials, unpinned actions and base images, missing lockfiles and update bots, workflows that discard failures, published advisories against the declared dependencies, runtime configuration, licensing and notebook reproducibility. No language model is involved in this section.