Add UIZZE — STOP UI SLOP remote MCP

[samuelbushi]

Closes #1344.

Adds the first-party UIZZE Streamable HTTP server as an Official remote entry.

STOP UI SLOP. UIZZE gives Codex, Claude Code, Cursor, and Copilot 800,000+ real web and iOS interfaces, product-specific design contracts, validation, deterministic audits, and a hard finish gate before generic UI ships. The manifest documents the required secret Authorization header and current 14-tool catalogue.

Checks completed:

• JSON parse
• SVG parse
• git diff --check

Disclosure: first-party UIZZE submission.

[amirejaz]

MCP Server Review — UIZZE (Remote)

Type: Remote (streamable-http) · Repository: https://github.com/uizze/uizze-mcp · Verdict: REQUEST_CHANGES

One blocking item, one recommendation worth taking, and two minor notes. The entry is well formed — it gets the registry conventions right, which is more than most first submissions manage.

---

Verified working

• POST https://uizze.com/mcp returns 401 with a valid RFC 9728 challenge. /.well-known/oauth-authorization-server advertises PKCE S256, dynamic client registration, refresh tokens, and client_id_metadata_document_supported: true. Solid implementation.
• name is io.github.stacklok/uizze-remote — correct for this catalog.
• Icon follows the convention (repo-hosted SVG, mimeType: image/svg+xml, sizes: ["any"]) and icon.svg is committed alongside server.json.
• _meta extension key matches remotes[0].url exactly.
• tags include remote; title uses the (Remote) suffix.
• remotes[].headers is a supported shape — grafana uses the same pattern — and the token is correctly marked isSecret: true.
• MIT licensed; task catalog:validate passes.
• tier: "Official" is correct under Tiered classifications: UIZZE is the platform owner of the integrated service, and the submission is disclosed as first-party.

---

Blocking

Version mismatch. The entry declares "version": "1.0.0", but the upstream server.json in uizze/uizze-mcp is at 1.1.20, and the linked issue #1344 states 1.1.5. Three different numbers across the three sources. Please set this to the version this entry actually corresponds to.

---

Recommendation

The manual token is a downgrade from what your server already supports. The entry asks users to paste a long-lived bearer token into an Authorization header, but your endpoint supports full OAuth — dynamic client registration at /oauth/register, PKCE S256, refresh tokens, and client ID metadata documents. Clients that speak OAuth discovery could authenticate without users handling a raw secret at all. Worth switching unless there's a reason the header path is preferred.

---

Notes

• Your upstream manifest points at a dead URL. uizze/uizze-mcp's own server.json declares https://uizze.com/mcp/preview, which returns 404. The URL in this PR (https://uizze.com/mcp) is the live one, so this PR is correct and the upstream manifest looks stale — flagging it since it affects your official MCP Registry listing.
• Overview heading. ## STOP UI SLOP. sits where the convention (adding-entries-llm.md, Overview Field Format) expects a title heading, e.g. ## UIZZE (Remote). The marketing line reads fine as the sentence that follows.
• Icon is a raster in an SVG wrapper. icon.svg embeds a base64 PNG via <image> rather than vector paths, so it won't scale cleanly. Not disqualifying — database-toolbox does the same — but a true vector icon would render better.
• Repository contains no server code. uizze/uizze-mcp reports languages: {}; it holds documentation, skills, workflows, and server.json, with the server itself running as the hosted service. Recording this because it comes up under Open source requirements — it is not a blocker here, since the Proprietary service references exemption covers a genuinely first-party vendor entry.
• Tools not independently verified. The 14 declared tools could not be checked against a live tools/list because the endpoint requires authentication. Noting as a limitation of this review, not a defect.

---

Summary

Correct the version and this is ready. The OAuth recommendation is the one thing I'd genuinely encourage beyond that; everything else is optional.