Stitch Slop for Claude Code
Lets Claude work on the embroidery design open in your
Stitch Slop browser tab. It can look at it,
describe it, change it, and hear you through the app's Talk button. Every change
is one undo step in the app, and every answer is the app's own words.
What you need
- Claude Code. The bridge runs on Node.js 18 or newer. If you have it,
even only in your terminal through nvm or Homebrew, the plugin finds it. If
you don't, Claude offers to fetch the official Node.js for the plugin's own
use: about 30 MB from nodejs.org, checked against a pinned SHA-256.
- Stitch Slop open in a desktop browser on the same computer. Chrome is
tested; Firefox connects the same way; Safari has not been tested.
- macOS or Linux. Windows is not supported yet: the plugin starts through a
shell script.
Install
In Claude Code:
/plugin marketplace add StitchSlop/claude-plugin
/plugin install stitchslop@stitchslop
Then start a new session: a plugin's tools arrive with a session, not in the
middle of one.
Connect
The first time on a computer:
- In Stitch Slop, open the ⌁ Agent panel and switch on Enable Agent
Connections.
- Click Copy, and paste the line into Claude Code.
Chrome will ask once whether the page may "access other apps and services on
this device". That is this connection, to a small bridge on your own computer:
allow it. Firefox doesn't ask.
After that, the computer stays paired. With the switch on, just ask Claude
to "connect to Stitch Slop".
Talk to it
In the ⌁ Agent menu, switch on Talk to your agent by voice. Then press
Talk (⌥M) and speak. Claude hears you even between turns, and replies in the
app, next to the Talk button. Voice needs Google Chrome on a computer.
What it can do
About everything the app's commands cover:
- look at the design, as a picture or as facts;
- select, move, resize and align;
- change stitch types and settings, threads and colours;
- lettering and fonts, patches, sewing order and layering;
- trace a background image into stitches;
- check for stitch problems;
- export a machine file (DST, PES, JEF, EXP, VP3 and more) into a folder you
choose, save the project, and import SVG, DXF and machine files.
The list comes from the app itself, so it grows as the app does. The fabric is
set in the app only.
Privacy
The bridge talks only to your own browser tab, over your own computer's
loopback. It sends nothing anywhere and has no telemetry. What Claude reads of
your design — names, lettering, pictures of it, what you say to it — goes to
Anthropic as part of your conversation, as anything you ask Claude about does.
Turning it off
- For now: switch off Enable Agent Connections. Nothing connects while
it is off. Nothing keeps running once your Claude Code session ends: the
bridge frees its port and exits with the session, even after a crash, and so
does
listen.
- For good, on this computer: delete
~/.stitchslop/pairing.json. The next
connection needs the pasted line again. ~/.stitchslop/runtime holds a Node.js
the plugin fetched, if it fetched one.
- The browser's half: clear Stitch Slop's site data in the browser's
settings.
- The plugin:
claude plugin uninstall stitchslop@stitchslop, or through
/plugin in a session.
When it won't connect
Ask Claude. It can see things the app deliberately does not show, such as why a
connection was refused, and it knows what each of the panel's status words
means. The details are in
skills/design/troubleshooting.md.
Security
See SECURITY.md: what the bridge can do on your computer, what
limits it, and how to report a problem privately.
Licence
Apache License 2.0. Copyright 2026 William Osman; see NOTICE.
Development
.claude-plugin/plugin.json the manifest, and the MCP server it starts
.claude-plugin/marketplace.json makes this repo its own marketplace
bin/stitchslop-bridge the launcher (POSIX sh): finds Node, or fetches it
bridge/stitchslop-bridge.mjs the bridge. Zero dependencies, Node 18+
skills/design/ how to connect, and how to work on a design
skills/connect/ /stitchslop:connect [the pasted line]
test/ the plugin's tests, and a stand-in tab
From a checkout: claude --plugin-dir /path/to/this/repo.
How it fits together
The app owns the design and its commands. The plugin never sees inside them.
The tab sends its tool list when it connects, and the bridge carries calls to it
and the app's answers back. Nothing here copies or re-describes a command, so
the plugin cannot drift from the app. The skill teaches how to read the app's
answers and the rules that bite, and defers to the live tool descriptions for
everything else.
The bridge implements Stitch Slop's wire protocol 1, published at
stitchslop.com/agent. What a plugin changes
about that problem:
| why |
|---|
--lazy: nothing listens until the agent asks | A plugin's MCP server starts with every session. Binding at start would have each claim a port, and the tab, which dials 8787 first, would attach to whichever session started first rather than the one you are talking to. |
The pair tool | The protocol hands a bridge its one-time token at launch, but a plugin's server starts before any token exists. So it arrives as a tool argument: not on the command line, where ps shows it, and not in a config file. |
| Sharing | If a bridge for the same site is already running, a second session drives it through its control plane instead of competing for the tab. If that bridge exits, the next one takes its port, and the tab reattaches by itself. ownBridge: true opts out, for two tabs. |
| Paired sites | A site this computer is paired with reconnects with no token, whichever site the bridge started on. The tab still has to present that site's own secret. |
| Origin allow-list | Pasted text is untrusted. pair accepts only the production site and loopback addresses. Anything else must be set by the user, with STITCHSLOP_ORIGIN. |
| Refusals are kept | The app shows a refused tab only as "Waiting to connect", so the bridge records why and connection_status reports it. |
| The tab's tool list is checked | Names are validated, the bridge's own names can't be shadowed, and sizes are capped. Anything dropped is reported. |
call_with_file, --file | An image goes to the app by path, never as base64 typed by the model. Images only, checked by their bytes. |
listen | The Talk button's speech as lines a watching host (Claude Code's Monitor) wakes on. It starts when the agent connects. |
| Heartbeat, frame caps, a pre-auth deadline | A tab that slept must not block the next one, and nothing unauthenticated gets a buffer. |
Secrets
This repo is public, so every commit is checked for secrets before it is made.
Install gitleaks, then turn the hook on
once per clone:
git config core.hooksPath .githooks
npm run secrets # the whole history, any time
The rules are gitleaks's own, plus Stitch Slop's tokens and pairing secrets
(.gitleaks.toml). The made-up tokens in the docs and tests are listed there
one by one; anything else of the same shape is treated as real.
Tests
npm test # the plugin's own tests, on ports 8797-8798 with a temp config dir
node test/fake-tab.mjs # a stand-in tab: --token or --secret, --utter "…", --voice-on-after N
Protocol conformance is checked by the Stitch Slop app's own suite, which is not
public.
