macaron

A command that starts the Macaron WebUI, a browser-based interface for building generated user interfaces, switching models, and managing sessions.

In plain words
What is it for?
Use it to launch the Claude Code version of Macaron on its configured local port.
Why use it?
It opens the required local interface and prepares its cached build when needed, so you do not have to set up the web app manually.

Command

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add commands/mindverse-ltd/macaron-artifacts/macaron
Clone the repo
git clone --depth 1 https://github.com/mindverse-ltd/macaron-artifacts
Per session 18 Only the description is in the session, so the agent can decide to use it. The body loads when it is invoked.
When invoked 1,074 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 1 finding. Scan, not verified.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5 $0.00018 $0.01074
Opus 5 $0.00009 $0.00537
Sonnet 5 $0.00004 $0.00215
Haiku 4.5 $0.00002 $0.00107

Measured 2d ago against content hash 3ef45c6dfc31, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade A, and why

macaron scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Makes network callslowCapability

Not a fault in itself. Listed so you know the mod talks to something, and to what.

bash <(curl -fsSL https://macaron.im/install.sh)
commands/macaron.md · 50 lines

How it starts

The opening of the file, as written. The whole thing — 50 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Start the Macaron WebUI server. The Claude Code flavor always launches on the fixed port 7878 (Codex uses 7979, Kimi 7980, so all three can run side by side) — there is no port argument.

The plugin arrives as source (no committed dist/) — start.sh uses corepack pnpm to install and build on first launch (~60s), then reuses the cached build on subsequent launches. When invoked from a plugin cache directory (which the host can prune under us), it transparently mirrors source into ~/.macaron/runtime/<version>/ and runs from there so node_modules / dist survive. Port collisions, install / build retries, and URL printing are all handled inside the script. Do NOT rm node_modules, run npm install, run npm run build, or otherwise "prepare" the plugin before invoking start.sh — call it once and let it print. If it errors out, follow the "fix:" line it prints on stderr and try again.

Run exactly this and nothing else. MACARON_ENGINE=claude and MACARON_PORT=7878 are both explicit so stray shell exports (e.g. from a prior Codex/Kimi-side session) can't flip the WebUI to the wrong engine or port:

MACARON_ENGINE=claude MACARON_PORT=7878 bash "${CLAUDE_PLUGIN_ROOT}/start.sh"

Zero-config provider (relay operators): if the user's shell has any of the following env vars set when /macaron runs (or when install.sh runs — see below), the server upserts them as a saved provider at boot and auto-selects it (unless the user has already picked a non-system provider manually). Same env-var contract works for the claude CLI, so a single copy-paste snippet on a relay's docs page bootstraps both flows:

MACARON_PROVIDER_ENDPOINT  or  ANTHROPIC_BASE_URL             (required)
MACARON_PROVIDER_TOKEN     or  ANTHROPIC_AUTH_TOKEN | ANTHROPIC_API_KEY  (required)
MACARON_PROVIDER_MODEL     or  ANTHROPIC_MODEL                (default: macaron-v1-venti)
MACARON_PROVIDER_NAME                                         (default: derived from endpoint host, e.g. "Mint (env)")
MACARON_DISABLE_ENV_PROVIDER_SEED=1                           (escape hatch — skip the whole thing)

Provider id is sha1(endpoint + model), so re-running the same snippet upserts the same row instead of piling up duplicates. Later env changes (e.g. rotated key) refresh in place on the next /macaron.

For users who don't want to open Claude Code just to launch the WebUI, the repo also ships install.sh — a standalone bootstrap that clones/updates the plugin source into ~/.macaron/artifacts-src, runs its start.sh, and opens the browser once the port binds. Intended for hosting at https://macaron.im/install.sh:

export ANTHROPIC_BASE_URL='https://mint.macaron.im/v1'
export ANTHROPIC_AUTH_TOKEN='sk-xxx'
bash <(curl -fsSL https://macaron.im/install.sh)

Both paths (/macaron inside Claude Code and install.sh standalone) end up calling the same start.sh and the same seedProviderFromEnv(), so provider seeding behaviour is identical.

After the server prints Macaron WebUI (engine=claude): http://localhost:7878, run open "http://localhost:7878" to launch the browser, then quote the URL verbatim to the user (don't paraphrase it) and briefly summarize what's there:

  • Dashboard — all workspaces from ~/.claude/projects, sorted by last activity
  • Workspace — one project's sessions with previews; start a new session from here
  • Session — full transcript (thinking, tool calls, live GenUI previews) + follow-up chat
  • Settings — manage Anthropic-compatible providers (Macaron, OpenRouter, LiteLLM, …) and pick the active one

If start.sh prints an error:

  • Port busy: start.sh kills whatever holds 7878 before binding, so this should not occur; if the server still fails to come up, quote the raw stderr and check /tmp/macaron-plugin.log.
  • Install / build failed: start.sh prints one or more [macaron] fix: <command> lines on stderr. Run each printed fix command in order and retry start.sh after each; report the outcome to the user.
  • Anything else: quote the raw stderr, then check /tmp/macaron-plugin.log for the server-side tail before proposing next steps.

Read the full file on GitHub · 50 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 2d ago First seen · 50 lines · 18 tokens per session scan A 3ef45c6dfc31

Subscribe to this mod's changes

macaron is a command published in the GitHub repository mindverse-ltd/macaron-artifacts (10 stars, last pushed 10d ago), licensed Apache-2.0. It adds 18 tokens to every session and 1,074 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.