Everything in UI5

Not where the UI library itself is expected to bind data: the documentation leaves binding a component's content and events to the host framework. Not from a CDN script tag: the project publishes none, so it assumes a build step.

Neither the package manifest nor the repository tree declares a licence.

It reads a UI5 project and the framework's own documentation, not a running system or a backend: a question about the service behind the app is answered somewhere else. Node.js v20.17 or v22.9 and above.

Host-specific: outside Kiro the automatic context activation is the part that does not come with it, and what remains is prose you would have to wire in yourself. Breadth over depth by design — thirty-five skills across six product areas is an orientation layer, not a substitute for the focused sets in each.

Its README calls it early-stage — the core workflows run end-to-end against real systems and packaging, documentation and polish are stated as still evolving. A Rust binary rather than an npm install, so the platform build matters.

Knowledge about theming, not a theme build: nothing here compiles a theme or deploys one, and it says nothing about a custom control's own parameters.

GPL-3.0, which is a licence to read before vendoring any of it into something you ship. Forty plugins is also a lot of always-available surface — the ledger is there because breadth and verification pull in opposite directions, and it does not resolve that so much as report it.

Two skills, narrowly scoped: nothing here scaffolds an application or answers what a component's API is — that is [@ui5/webcomponents-mcp-server](artifact:ui5-webcomponents-mcp-server), which reads the same library's documentation.

Guidance, not access: these are instructions handed to an agent, and what the agent can then read of your project comes from [@ui5/mcp-server](artifact:ui5-mcp-server) or the editor. A modernisation workflow that runs autonomously across a codebase is also a thing to point at a branch rather than at main.

Neither the package manifest nor the repository tree declares a licence.

Not where the UI library itself is expected to bind data: the documentation leaves binding a component's content and events to the host framework. Not from a CDN script tag: the project publishes none, so it assumes a build step.

It is text processing, not an agent: there is no tool calling, no retrieval and no conversation. It needs SAP AI Core, and the backend half needs [@sap-ai-sdk/orchestration](artifact:sap-ai-sdk-orchestration) installed alongside it — an optional peer, so a frontend-only install stays lean.

Neither the package manifest nor the repository tree declares a licence.

No license Neither the package manifest nor the repository tree declares a licence.

Functional boundary The repository publishes no licence, so reusing its code needs the author's permission.

It audits through npm: a project that resolves its dependencies with another package manager, or has no `package.json`, has nothing for it to run. What it reports is what `npm audit` knows, so a vulnerability outside the npm advisory data is not in its table.

A team that does not keep one long-lived branch per environment has no environment branches for it to compare feature branches against. What it reports is the merge state of branches in Git, so it says nothing about whether a merged change has been built or deployed to the environment.

The version list comes from ui5.sap.com, so a build that cannot reach it has nothing to match the project's version against. It checks the version written in `ui5.yaml`; a framework version a deployed app loads from elsewhere is outside what it sees.

It targets the Application Frontend service only — not the HTML5 application repository — fixes authentication to IAS, and always creates new service instances, so reusing existing ones means editing the generated `mta.yaml` afterwards. Version 0.1.0 is the only release.

It records what the app actually asked for, so an entity no recorded journey touched is not in the dataset and replay will not answer for it. Its own README asks for `fiori-tools-appreload` to be disabled while recording, because a reload loop is what happens otherwise.

The version list comes from ui5.sap.com, so a build that cannot reach it has nothing to match the project's version against. It checks the version written in `ui5.yaml`; a framework version a deployed app loads from elsewhere is outside what it sees.

Neither the package manifest nor the repository tree declares a licence.

Neither the package manifest nor the repository tree declares a licence.

There is nothing to run: it is published for a generator or a script to call, not for a developer to invoke in a project, and it declares Node.js 22 or later.

The class has to be moved by hand: an abapGit pull of the exported ZIP, or a paste into ADT or SE24. The palette is held to the 121 controls of UI5 1.71, and a control inserted by its class name instead comes from whatever UI5 the canvas has loaded, with nothing checking it against 1.71 - *Checks* reports that. An app class that builds no view, or more than one, is refused.

Not for a single-application project with no deployment configuration: for that the README points to [generator-ui5-app](artifact:ui5-community-generator-ui5-app) instead.

Not in a project whose dependencies must all carry an open-source licence: KAEV is proprietary software, its licence page states that downloading or viewing the npm package does not by itself grant permission to use, copy, modify, redistribute, sublicense, sell, host or create derivative works, and the LICENSE file shipped with the package carries the controlling terms. Not as the last word on whether a UI5 application is secure: its rule reference states that a heuristic finding is not proof of a vulnerability, and its documentation puts professional security review beside it rather than under it.

Its README assumes a `manifest.json` with an app ID, JavaScript files that start with `sap.ui.define`, and access to ui5.sap.com to preload the standard library metadata. It says of TypeScript that ts-morph, its parser there, has drawbacks, and that not all linters work for TypeScript.

Lowercase HTML tags such as `<div>` typecheck but throw: the default renderer constructs UI5 controls, and the HTML-aware renderer plugin is described as planned. `withScope` restores the previous scope on a synchronous return only, so an `await` inside its callback leaks the scope on runtimes without `AsyncLocalStorage`. A view that has to stay adaptable through UI5 flexibility has no path here yet: the project's [Devtoberfest session](content:devtoberfest-2026-ui5-views-type-safe-tsx) states that flexibility support is not built in yet.

It reads a UI5 project and the framework's own documentation, not a running system or a backend: a question about the service behind the app is answered somewhere else. Node.js v20.17 or v22.9 and above.

Not where the UI library itself is expected to bind data: the documentation leaves binding a component's content and events to the host framework. Not from a CDN script tag: the project publishes none, so it assumes a build step.