Like MCP - but for your app’s UI

Let your users
personalize the UI
as they like.

Your users just describe the page they want, and AI builds it for them on the spot. You stay in control: it can only use the data and actions you allow.

AMTP
0+ builders already joined

Three steps. That’s the whole thing.

STEP 01

You set the rules

Declare the data and actions your app allows in plain natural language. Pass the real implementations; they remain completely private to your server.

veneer.config.js
const registry = {
dataSources: [{ id: 'tasks' }],
actions: [
{ id: 'createTask', desc: 'Create task.' },
{ id: 'updateTask', desc: 'Update task.' }
]
};
STEP 02

Users describe it

Your users just say how they want the page to look. No settings to dig through, no templates to memorize—Veneer invents the layout on the fly.

USER REQUEST

“Show me a board of my tasks grouped by due date, with high priority tasks at the top”

compiling sandboxed UI…
STEP 03

AI builds it, safely

Every generated element is loaded inside a read-only iframe sandbox. The model can style anything, but can only invoke the native functions you exposed.

SECURE SANDBOX BOUNDARY
Origin Handshake✔ VERIFIED
Capability Registry✔ SECURE
Data Source Bridge✔ ENFORCED
Live · this is the real open-source package running

Try it yourself, right here

Below is an ordinary task app built with the veneer-sdk. Click the button in the corner and tell the AI how you want it to look. Everything it invents runs inside the sandboxed canvas.

app.yoursaas.com/tasks
Adding a task deletion like “add a delete button” will be politely refused, because no deleteTask is registered.
Why Veneer

One app. A perfect fit for everyone.

A manager wants a dashboard; a teammate just wants today’s checklist. Instead of building both, you ship the pieces — and each person shapes the page to fit how they work, while you stay in control of what’s possible.

Kanban

Full creative freedom over the UI

Change the UI to your liking with AI

Hard security sandbox

Opaque origin, no network, validated bridge — three independent layers.

veneer.action('updateTask')

MCP for the UI layer

A typed, described capability surface the model composes against.

Per-user & private

Each person's layout is saved to their own browser. Nobody else sees it.

$ npm i veneer-sdk

Open-source React package

A provider, a frame, a chat. Three components and you're live. (Note: Package naming is a placeholder subject to change on release.)

Bring your own model

One endpoint returns { code, reply }. Use any LLM you like.

The security model

Free-form code. Bounded power.

The model can write anything. It still can’t do anything you didn’t allow. Three independent layers each block the same impossible action — at once.

1

Opaque origin

sandbox="allow-scripts"

No allow-same-origin, so the frame runs at an opaque origin: zero access to the parent’s cookies, localStorage, or DOM.

2

No network

connect-src 'none'

A strict CSP means generated code cannot fetch, XHR, open a WebSocket, or send a beacon. There is no path off the page.

3

Validated bridge

registry.actions[id]

The parent validates every { action, args } message against the registry and runs the real implementation only if the id is registered.

deleteTaskimpossible by construction

No deleteTask is registered, so even if generated code tried to delete via the network, the opaque origin blocks it, the CSP blocks it, and the bridge rejects it. Deletion fails on every layer.

For developers

Three components. Your real implementations.

No new backend, no source-code delivery, no rebuild. Register what your app can do in plain natural language, hand over the functions, and drop in the open-source package.

  • Typed capability surface
    Data sources and actions, each described for the model and enforced by id at runtime.
  • Your code stays yours
    You pass the real implementations. The model never sees them — only the registry.
  • Model-agnostic
    One endpoint returns { code, reply }. Wire up Gemini, Claude, or anything else.
  • Persisted per user
    Generated UI is saved to localStorage and reloaded automatically.
page.jsx
// 1. Register the capabilities your app exposes const registry = { dataSources: [ { id: 'tasks', description: 'The user’s tasks.' } ], actions: [ { id: 'createTask', description: 'Create a task.' }, { id: 'updateTask', description: 'Update a task.' }, // no deleteTask → generated UIs can never delete ], }; // 2. Pass the REAL implementations + live data <VeneerProvider registry={registry} actions={actions} data={{ tasks }}> <VeneerFrame style={{ height: 620 }} /> <VeneerChat /> </VeneerProvider>

That’s the whole integration. The registry is the contract; the sandbox is the guarantee.

If you know MCP, you already get Veneer.

MCP gives an AI model a typed, described set of capabilities to work with. Veneer is the same idea — just pointed at your interface.

MCP

Model Context Protocol

Lets a model use the tools and data your systems expose — through one typed, described surface. It can only ever call what’s on it.

  • Exposes your tools & data
  • Each described in plain language
  • The model can only call what you exposed
Veneer

An MCP for the UI layer

The exact same shape — but the surface is your interface. The model composes a real UI against your registered data and actions, inside a sandbox.

  • Exposes your data sources & actions
  • Each described in plain language
  • The model can only use what you registered
Same protocol-shaped idea: a typed capability surface the model composes against. MCP points it at your tools — Veneer points it at your UI.
FAQ

Questions, answered.

Is the generated code actually safe to run?+

Yes — that’s the core of the product. Generated UI runs in an opaque-origin iframe with no same-origin access, a CSP that blocks all network, and a bridge that only runs actions you registered. Three independent layers, each load-bearing.

Do I have to ship my source code?+

No. You keep your code and pass the real action implementations into the provider. The model only ever sees the registry’s plain-English descriptions and ids — never your implementations.

Which AI model does it use?+

Whichever you want. Your generator endpoint returns { code, reply }, so you can wire up Gemini, Claude, or any other model. The demo uses gemini-2.5-flash.

Can a user break something or delete data?+

Only if you registered an action for it. If there is no deleteTask in the registry, no generated UI can delete — by construction. The bridge rejects any unregistered action id.

How does the waitlist work?+

Veneer is in private beta. Join the waitlist and we’ll send an invite as access opens up in batches — no spam, just your invite.

Give your users a canvas,
not just a theme picker.

Rethink the last mile of software delivery. Ship the primitives — let your users design the interface they actually want. Join the waitlist for early access.

AMTP
0+ builders already joined