Everything in UI5

Neither the package manifest nor the repository tree declares a licence.

It reads a UI5 project and the framework's own documentation, not a running system or a backend: a question about the service behind the app is answered somewhere else. Node.js v20.17 or v22.9 and above.

It answers from documentation and never opens your project, so it cannot tell you whether the component you are asking about is the one your application already uses. Node.js v20.17 or v22.9 and above; on Windows the command needs a `cmd /c` prefix.

Neither the package manifest nor the repository tree declares a licence.

It reads documentation, never a system: nothing in it opens a package.json, a CDS model or an ABAP client, so a question about what your own project does has to be answered elsewhere. The offline half is only as fresh as the submodules the last build pinned, and the index answers where something is written down rather than which of two packages fits a task.

Host-specific: outside Kiro the automatic context activation is the part that does not come with it, and what remains is prose you would have to wire in yourself. Breadth over depth by design — thirty-five skills across six product areas is an orientation layer, not a substitute for the focused sets in each.

Knowledge about theming, not a theme build: nothing here compiles a theme or deploys one, and it says nothing about a custom control's own parameters.

GPL-3.0, which is a licence to read before vendoring any of it into something you ship. Forty plugins is also a lot of always-available surface — the ledger is there because breadth and verification pull in opposite directions, and it does not resolve that so much as report it.

Two skills, narrowly scoped: nothing here scaffolds an application or answers what a component's API is — that is [@ui5/webcomponents-mcp-server](artifact:ui5-webcomponents-mcp-server), which reads the same library's documentation.

It is text processing, not an agent: there is no tool calling, no retrieval and no conversation. It needs SAP AI Core, and the backend half needs [@sap-ai-sdk/orchestration](artifact:sap-ai-sdk-orchestration) installed alongside it — an optional peer, so a frontend-only install stays lean.

Guidance, not access: these are instructions handed to an agent, and what the agent can then read of your project comes from [@ui5/mcp-server](artifact:ui5-mcp-server) or the editor. A modernisation workflow that runs autonomously across a codebase is also a thing to point at a branch rather than at main.

Neither the package manifest nor the repository tree declares a licence.

Neither the package manifest nor the repository tree declares a licence.

It audits through npm: a project that resolves its dependencies with another package manager, or has no `package.json`, has nothing for it to run. What it reports is what `npm audit` knows, so a vulnerability outside the npm advisory data is not in its table.

No license Neither the package manifest nor the repository tree declares a licence.

Functional boundary The repository publishes no licence, so reusing its code needs the author's permission.

There is nothing to run: it is published for a generator or a script to call, not for a developer to invoke in a project, and it declares Node.js 22 or later.

Not in a project whose dependencies must all carry an open-source licence: KAEV is proprietary software, its licence page states that downloading or viewing the npm package does not by itself grant permission to use, copy, modify, redistribute, sublicense, sell, host or create derivative works, and the LICENSE file shipped with the package carries the controlling terms. Not as the last word on whether a UI5 application is secure: its rule reference states that a heuristic finding is not proof of a vulnerability, and its documentation puts professional security review beside it rather than under it.

Lowercase HTML tags such as `<div>` typecheck but throw: the default renderer constructs UI5 controls, and the HTML-aware renderer plugin is described as planned. `withScope` restores the previous scope on a synchronous return only, so an `await` inside its callback leaks the scope on runtimes without `AsyncLocalStorage`. A view that has to stay adaptable through UI5 flexibility has no path here yet: the project's [Devtoberfest session](content:devtoberfest-2026-ui5-views-type-safe-tsx) states that flexibility support is not built in yet.

It shows the wiring and a converted view pair, not the runtime's API surface; the directives, the plugin SPI and the binding forms are demonstrated in [@ui5-community/jsx-runtime-showcase](artifact:ui5-community-jsx-runtime-showcase) instead.

Its views are not a template for application code: every showcase view overrides `getController()` to return itself so a sample stays readable in one file, and the gotchas page says not to ship that in production, where a view keeps a separate `*.controller.ts`. Routing from a sample, an `ODataModel` v2 or v4, `sap.ui.mdc.Table`, forms and custom control authoring in TSX are absent by decision and documented as deferred.

The class has to be moved by hand: an abapGit pull of the exported ZIP, or a paste into ADT or SE24. The palette is held to the 121 controls of UI5 1.71, and a control inserted by its class name instead comes from whatever UI5 the canvas has loaded, with nothing checking it against 1.71 - *Checks* reports that. An app class that builds no view, or more than one, is refused.

It targets the Application Frontend service only — not the HTML5 application repository — fixes authentication to IAS, and always creates new service instances, so reusing existing ones means editing the generated `mta.yaml` afterwards. Version 0.1.0 is the only release.

Not for a single-application project with no deployment configuration: for that the README points to [generator-ui5-app](artifact:ui5-community-generator-ui5-app) instead.

A team that does not keep one long-lived branch per environment has no environment branches for it to compare feature branches against. What it reports is the merge state of branches in Git, so it says nothing about whether a merged change has been built or deployed to the environment.

Not a system to run a business application on: there is no business application in it, and what it implements of the language, the dictionary and Gateway is a stated subset of each. It is a clean-room reimplementation of the `/IWBEP/` interfaces that bundles no SAP source and no standard DDIC, so a service that reads standard objects has nothing to read, and `ANORMALIES.md` records every place the runtime differs from SAP before any workaround is written.

Its README calls it early-stage — the core workflows run end-to-end against real systems and packaging, documentation and polish are stated as still evolving. A Rust binary rather than an npm install, so the platform build matters.

It records what the app actually asked for, so an entity no recorded journey touched is not in the dataset and replay will not answer for it. Its own README asks for `fiori-tools-appreload` to be disabled while recording, because a reload loop is what happens otherwise.

The version list comes from ui5.sap.com, so a build that cannot reach it has nothing to match the project's version against. It checks the version written in `ui5.yaml`; a framework version a deployed app loads from elsewhere is outside what it sees.

Its README assumes a `manifest.json` with an app ID, JavaScript files that start with `sap.ui.define`, and access to ui5.sap.com to preload the standard library metadata. It says of TypeScript that ts-morph, its parser there, has drawbacks, and that not all linters work for TypeScript.

Where the login cannot be completed by configuration. Its authentication page states that multi-factor authentication is not supported, because a media break between browser and phone cannot be managed out of the box.

Neither the package manifest nor the repository tree declares a licence.