\n\n\n```\n\nthe player can be used in:\n\n- documentation,\n- educational content,\n- exercise guides,\n- blog posts,\n- and movement libraries.\n\n---\n\n## core libraries\n\ninstall the parser:\n\n```bash\nnpm install posecode-parser\n```\n\ninstall the renderer:\n\n```bash\nnpm install posecode-render\n```\n\nexample:\n\n```ts\nimport { parse } from \"posecode-parser\";\nimport { createviewer } from \"posecode-render\";\n\nconst source = `\nposecode exercise \"lateral raise\"\n rig humanoid\n pose start = standing\n\n step \"raise\" 1.4s settle:\n shoulders: abduct 90\n`;\n\nconst { ir, errors, warnings } = parse(source);\n\nif (!ir || errors.length > 0) {\n console.error(errors);\n} else {\n console.warn(warnings);\n const viewer = createviewer(document.queryselector(\"#viewer\"));\n viewer.load(ir);\n viewer.play();\n}\n```\n\nthe `#viewer` element is an html ``.\n\n### exporting motion (bvh)\n\n`posecode-render` can bake a movement into a [biovision hierarchy](https://en.wikipedia.org/wiki/biovision_hierarchy)\n(`.bvh`) file for import into blender and other animation tools. in the\nplayground, use the **download bvh** button; programmatically:\n\n```ts\nimport { parse } from \"posecode-parser\";\nimport { exportbvh } from \"posecode-render\";\n\nconst { ir } = parse(source);\nconst bvh = exportbvh(ir!, { fps: 30 }); // string, ready to write to disk\n```\n\noptions: `fps` (default 30), `scale` (default 1 = metres; pass `100` for\ncentimetres), `includefingers` (default false), and `proportions` for a\ncalibrated rig.\n\n- **coordinate system:** right-handed, **y-up**, figure faces **+z** in the\n rest pose (identical to the renderer and three.js). enable blender's \"y up\"\n bvh import option.\n- **units:** metres by default.\n- **rotation channels:** `zrotation xrotation yrotation` (euler order `zxy`).\n- **scope:** this exports the *authored* joint motion plus root travel/turn. it\n does not yet re-run the renderer's contact/ik solve, so ik-dependent movements\n (e.g. `reach: hand_left floor`) export the authored pose rather than the\n solved one. see [issue #63](https://github.com/posecode-dev/posecode/issues/63).\n\n### exporting motion (gltf / glb)\n\nfor web animation pipelines, `posecode-render` can export the rig **and** a\nbaked animation clip as a gltf/glb asset. in the playground, use **download\ngltf**; programmatically:\n\n```ts\nimport { parse } from \"posecode-parser\";\nimport { exportgltf } from \"posecode-render\";\n\nconst { ir } = parse(source);\nconst glb = await exportgltf(ir!); // glb arraybuffer (default)\nconst gltf = await exportgltf(ir!, { binary: false }); // gltf json object\n```\n\nthe result loads with three.js [`gltfloader`](https://threejs.org/docs/#gltfloader.load),\nand the clip plays on the included rig:\n\n```ts\nconst gltf = await new gltfloader().loadasync(url);\nconst mixer = new three.animationmixer(gltf.scene);\nmixer.clipaction(gltf.animations[0]).play();\n```\n\n- joint nodes are named by posecode bone id; the animated root is `posecode_root`.\n- **limitations:** exports the procedural mannequin rig, not a humanoid/mixamo\n skeleton, so there is **no retargeting** onto external rigs yet, and (as with\n bvh) it bakes the authored motion, not the contact/ik-solved motion. see\n [issue #90](https://github.com/posecode-dev/posecode/issues/90).\n\n---\n\n## how posecode stays honest\n\nposecode uses multiple layers of checking.\n\n### 1. range-of-motion clamping\n\njoint angles are constrained before rendering.\n\nfor example:\n\n```posecode\nknees: flex 200\n```\n\nis clamped to the configured knee-flexion limit and produces a warning instead of rendering an impossible angle.\n\n### 2. kinematic evaluation\n\nthe engine measures the actual resulting skeleton after:\n\n- parsing,\n- forward kinematics,\n- inverse kinematics,\n- and ground-lock corrections.\n\n### 3. geometric fidelity invariants\n\nmovement examples can define expected properties.\n\nfor example, a deadlift may require:\n\n- sufficient torso pitch,\n- limited forward knee travel,\n- stable foot contact,\n- and symmetrical hip movement.\n\n### 4. gpt-5.6 physics critic\n\nthe build week critic interprets the movement and deterministic measurements together.\n\nit explains biomechanical problems in natural language and proposes specific revisions.\n\n---\n\n## packages\n\n| package | purpose |\n| --- | --- |\n| `posecode-language` | language definitions and editor support |\n| `posecode-parser` | converts `.posecode` text into a validated, range-constrained intermediate representation |\n| `posecode-render` | renders animated figures with three.js, forward kinematics, and ik |\n| `posecode-share` | encodes posecode documents into url-safe share tokens |\n| `posecode-mcp` | exposes posecode capabilities to ai agents through mcp |\n| `posecode-eval` | runs headless biomechanical and geometric fidelity evaluations |\n| `playground` | interactive editor, 3d viewport, warnings, generation, critique, and sharing |\n\n---\n\n## technology\n\nposecode is built with:\n\n- typescript\n- javascript\n- node.js\n- three.js\n- webgl\n- vite\n- codemirror\n- model context protocol\n- zod\n- vitest\n- playwright\n- esbuild\n- gpt-5.6\n- codex\n\n---\n\n## scope\n\n### version 0.1\n\nposecode currently focuses on:\n\n- single-person human movement,\n- fitness,\n- physiotherapy demonstrations,\n- posture,\n- dance,\n- education,\n- rehabilitation visualization,\n- forward kinematics,\n- ground locking,\n- rom-constrained inverse kinematics,\n- hip hinging,\n- standing, seated, and lying poses,\n- basic scene props,\n- and browser-based rendering.\n\n### deferred\n\nthe following are outside the current scope:\n\n- two-person or partner motion,\n- comprehensive collision detection and rigid-body dynamics,\n- detailed object physics,\n- advanced equipment simulation,\n- multi-joint finger animation,\n- fbx or glb animation export,\n- and medical diagnosis.\n\n---\n\n## limitations and safety\n\nposecode is an engineering and visualization project.\n\nits range-of-motion values and biomechanical checks are based on general reference data and simplified models.\n\nthey are not:\n\n- medical advice,\n- diagnosis,\n- injury-prevention guarantees,\n- physiotherapy prescriptions,\n- or a substitute for a qualified professional.\n\ngenerated movements should be reviewed by a qualified expert before being used for healthcare, rehabilitation, or safety-critical applications.\n\n---\n\n## potential applications\n\nposecode could support:\n\n- game and character animation,\n- fitness instruction,\n- exercise visualization,\n- anatomy education,\n- physiotherapy demonstrations,\n- posture training,\n- dance and choreography prototyping,\n- sports technique analysis,\n- robotics research,\n- synthetic motion-data generation,\n- and embodied ai systems.\n\n---\n\n## repository structure\n\n```text\nposecode/\n\u251c\u2500\u2500 packages/\n\u2502 \u251c\u2500\u2500 posecode-language/\n\u2502 \u251c\u2500\u2500 posecode-parser/\n\u2502 \u251c\u2500\u2500 posecode-render/\n\u2502 \u251c\u2500\u2500 posecode-share/\n\u2502 \u251c\u2500\u2500 posecode-mcp/\n\u2502 \u2514\u2500\u2500 posecode-eval/\n\u251c\u2500\u2500 playground/\n\u251c\u2500\u2500 editors/\n\u251c\u2500\u2500 spec/\n\u251c\u2500\u2500 docs/\n\u251c\u2500\u2500 scripts/\n\u2514\u2500\u2500 readme.md\n```\n\n---\n\n## testing\n\nrun all unit tests:\n\n```bash\nnpm test\n```\n\nrun coverage:\n\n```bash\nnpm run coverage\n```\n\nrun type checking:\n\n```bash\nnpm run typecheck\n```\n\nrun biomechanical evaluations:\n\n```bash\nnpm run eval\n```\n\nthe ci workflow verifies that the project:\n\n- builds successfully,\n- passes type checking,\n- passes unit tests,\n- and satisfies configured movement invariants.\n\n---\n\n## background\n\nposecode follows the design study:\n\n> *kinematic motion definition protocols for large language models*\n\nthe project explores whether semantic, text-based movement programs can provide a controllable and inspectable alternative to black-box motion generation.\n\nthe specification covers:\n\n- dsl design,\n- biomechanical constraints,\n- client-side rendering,\n- agent integration,\n- and possible product applications.\n\nsee:\n\n- `spec/spec.md`\n- `spec/llm-authoring.md`\n- `docs/market-research.md`\n\n---\n\n## character assets\n\nthe hosted playground currently uses an adobe mixamo character and one showcase animation under the applicable adobe terms. these binary assets are not covered by posecode's software licenses. see third-party notices.\n\nthe renderer also includes a zero-asset procedural figure and accepts compatible humanoid glb characters through `characterurl`.\n\n---\n\n## licensing\n\nposecode is open source with a clear standard and product boundary:\n\n| layer | components | license |\n| --- | --- | --- |\n| open standard | specification, examples, parser, share codec, language service, lsp, vs code extension | apache-2.0 |\n| product layer | renderer, web embed, mcp server, eval harness, hosted playground | agpl-3.0-only |\n\norganizations that need to use an agpl component in a closed-source product may contact [hello@posecode.org](mailto:hello@posecode.org?subject=posecode%20commercial%20license) about a separate commercial agreement.\n\nearlier grants are unchanged. mit revisions remain mit, and the 0.2.2 npm packages remain apache-2.0. see licensing, commercial licensing, and trademark policy.\n\n---\n\n## feedback and support\n\nfeedback and contributions are welcome.\n\n- email: [hello@posecode.org](mailto:hello@posecode.org?subject=posecode%20feedback)\n- issues: [github issues](https://github.com/posecode-dev/posecode/issues)\n\n---\n

\n llms already have languages for software, data, and interfaces.\n
\n posecode gives them a language for movement.\n

", "installation_instructions": null, "categories": [ "Everything" ], "owners": [], "owner": null, "code_snippets": {}, "evaluation_results": [], "found_via_ownership_request": false, "hosting_eligible": false, "knative_enabled": false, "security_scans": [ { "repo_url": "https://github.com/posecode-dev/posecode", "repo_name": "posecode", "score": 83, "risk_level": "moderate", "score_explanation": "Score starts at 100, deducts points for security issues, and adds points for security best practices", "scan_id": "240f1051-b53c-4d73-ab42-751b4d43271a", "mcp_app_id": "39cce629-59ed-4b41-bf0e-5c45833c0399", "scan_time": "2026-08-13T11:19:08.750628+00:00", "created_at": "2026-08-13T11:19:08.753427+00:00", "updated_at": "2026-08-13T11:19:08.753427+00:00", "findings": [], "vulnerabilities": [ { "package_name": "@hono/node-server", "severity": "moderate", "references": [], "scan_id": "240f1051-b53c-4d73-ab42-751b4d43271a", "vulnerability_id": "ea913a85-31c1-4fc8-8a37-4fa0ed0bbc2d", "vulnerable_version": "unknown", "fixed_version": "unknown", "description": "[{'source': 1139322, 'name': '@hono/node-server', 'dependency': '@hono/node-server', 'title': 'Node.js Adapter for Hono: Path traversal in `serve-static` on Windows via encoded backslash (`%5C`)', 'url': 'https://github.com/advisories/GHSA-frvp-7c67-39w9', 'severity': 'moderate', 'cwe': ['CWE-22'], 'cvss': {'score': 5.9, 'vectorString': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N'}, 'range': '<1.19.15'}]", "created_at": "2026-08-13T11:19:08.753427+00:00" }, { "package_name": "hono", "severity": "moderate", "references": [], "scan_id": "240f1051-b53c-4d73-ab42-751b4d43271a", "vulnerability_id": "f95f13f1-8b42-4294-a183-ebfa239d4f4c", "vulnerable_version": "unknown", "fixed_version": "unknown", "description": "[{'source': 1130733, 'name': 'hono', 'dependency': 'hono', 'title': 'Hono: ReDoS in CORS middleware via Access-Control-Request-Headers', 'url': 'https://github.com/advisories/GHSA-8j4g-w8fx-2239', 'severity': 'moderate', 'cwe': ['CWE-1333'], 'cvss': {'score': 5.3, 'vectorString': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L'}, 'range': '<4.12.34'}, {'source': 1138771, 'name': 'hono', 'dependency': 'hono', 'title': 'Hono: `memo()` retains SSR output across requests, leading to cross-user data disclosure', 'url': 'https://github.com/advisories/GHSA-f23p-vx2j-j53r', 'severity': 'moderate', 'cwe': ['CWE-488'], 'cvss': {'score': 4.8, 'vectorString': 'CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N'}, 'range': '>=3.8.0 <4.12.34'}, {'source': 1138772, 'name': 'hono', 'dependency': 'hono', 'title': 'Hono: Proxy Helper does not remove response headers listed in the `Connection` header', 'url': 'https://github.com/advisories/GHSA-79qm-7rj5-m7r9', 'severity': 'low', 'cwe': ['CWE-200'], 'cvss': {'score': 3.7, 'vectorString': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N'}, 'range': '>=4.7.0 <4.12.34'}, {'source': 1138773, 'name': 'hono', 'dependency': 'hono', 'title': 'Hono: Algorithmic Complexity DoS in Language Middleware', 'url': 'https://github.com/advisories/GHSA-54fx-42gc-7vw4', 'severity': 'moderate', 'cwe': ['CWE-407'], 'cvss': {'score': 5.3, 'vectorString': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L'}, 'range': '>=4.12.0 <4.12.34'}]", "created_at": "2026-08-13T11:19:08.753427+00:00" }, { "package_name": "postcss", "severity": "moderate", "references": [], "scan_id": "240f1051-b53c-4d73-ab42-751b4d43271a", "vulnerability_id": "471416ac-fd34-42fc-ad96-3061206da9f8", "vulnerable_version": "unknown", "fixed_version": "unknown", "description": "[{'source': 1130709, 'name': 'postcss', 'dependency': 'postcss', 'title': 'PostCSS: incomplete fix of GHSA-6g55-p6wh-862q \u2014 attacker-controlled sourceMappingURL reads arbitrary .map files when `from` is unset', 'url': 'https://github.com/advisories/GHSA-fxqj-rqcc-2cmp', 'severity': 'moderate', 'cwe': ['CWE-22', 'CWE-200'], 'cvss': {'score': 0, 'vectorString': None}, 'range': '<=8.5.22'}]", "created_at": "2026-08-13T11:19:08.753427+00:00" }, { "package_name": "brace-expansion", "severity": "high", "references": [], "scan_id": "240f1051-b53c-4d73-ab42-751b4d43271a", "vulnerability_id": "69d556f0-63bb-4c42-9d0f-a5f4aa10d838", "vulnerable_version": "unknown", "fixed_version": "unknown", "description": "[{'source': 1130591, 'name': 'brace-expansion', 'dependency': 'brace-expansion', 'title': 'brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash', 'url': 'https://github.com/advisories/GHSA-mh99-v99m-4gvg', 'severity': 'high', 'cwe': ['CWE-400', 'CWE-770'], 'cvss': {'score': 7.5, 'vectorString': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}, 'range': '>=4.0.0 <5.0.8'}, {'source': 1130734, 'name': 'brace-expansion', 'dependency': 'brace-expansion', 'title': 'brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation', 'url': 'https://github.com/advisories/GHSA-rgw5-rvv9-x895', 'severity': 'high', 'cwe': ['CWE-400', 'CWE-770'], 'cvss': {'score': 7.5, 'vectorString': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}, 'range': '>=4.0.0 <5.0.9'}]", "created_at": "2026-08-13T11:19:08.753427+00:00" }, { "package_name": "fast-uri", "severity": "high", "references": [], "scan_id": "240f1051-b53c-4d73-ab42-751b4d43271a", "vulnerability_id": "72ef7132-3ed0-48ff-8ada-192bda239a9c", "vulnerable_version": "unknown", "fixed_version": "unknown", "description": "[{'source': 1124064, 'name': 'fast-uri', 'dependency': 'fast-uri', 'title': 'fast-uri vulnerable to host confusion via literal backslash authority delimiter', 'url': 'https://github.com/advisories/GHSA-v2hh-gcrm-f6hx', 'severity': 'high', 'cwe': ['CWE-436'], 'cvss': {'score': 7.5, 'vectorString': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N'}, 'range': '>=3.0.0 <=3.1.3'}, {'source': 1130720, 'name': 'fast-uri', 'dependency': 'fast-uri', 'title': 'fast-uri vulnerable to host confusion via backslash authority introducer', 'url': 'https://github.com/advisories/GHSA-7p8r-x3mc-p8w7', 'severity': 'high', 'cwe': ['CWE-436'], 'cvss': {'score': 7.5, 'vectorString': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N'}, 'range': '>=3.0.0 <3.1.5'}]", "created_at": "2026-08-13T11:19:08.753427+00:00" }, { "package_name": "ip-address", "severity": "high", "references": [], "scan_id": "240f1051-b53c-4d73-ab42-751b4d43271a", "vulnerability_id": "ef40b6bf-f3f0-4ab1-ba4f-1fb6935f76db", "vulnerable_version": "unknown", "fixed_version": "unknown", "description": "[{'source': 1130722, 'name': 'ip-address', 'dependency': 'ip-address', 'title': 'ip-address: Address4 decodes leading-zero octets as decimal while resolvers decode them as octal, allowing SSRF and trust-boundary bypass', 'url': 'https://github.com/advisories/GHSA-mwp4-54f8-5fhr', 'severity': 'high', 'cwe': ['CWE-20', 'CWE-918'], 'cvss': {'score': 0, 'vectorString': None}, 'range': '<=10.3.0'}, {'source': 1130723, 'name': 'ip-address', 'dependency': 'ip-address', 'title': 'ip-address: a CIDR suffix on the parsed address suppresses special-use classification and can bypass SSRF and trust-boundary checks', 'url': 'https://github.com/advisories/GHSA-4xrf-jv44-h6hh', 'severity': 'moderate', 'cwe': ['CWE-20', 'CWE-918'], 'cvss': {'score': 0, 'vectorString': None}, 'range': '>=10.1.1 <=10.2.1'}, {'source': 1130724, 'name': 'ip-address', 'dependency': 'ip-address', 'title': 'ip-address: misclassification of IPv4-mapped/NAT64 IPv6 addresses can bypass SSRF and trust-boundary checks', 'url': 'https://github.com/advisories/GHSA-22jq-vg5j-6vgg', 'severity': 'moderate', 'cwe': ['CWE-20', 'CWE-918'], 'cvss': {'score': 0, 'vectorString': None}, 'range': '>=10.1.1 <=10.2.0'}]", "created_at": "2026-08-13T11:19:08.753427+00:00" }, { "package_name": "js-yaml", "severity": "high", "references": [], "scan_id": "240f1051-b53c-4d73-ab42-751b4d43271a", "vulnerability_id": "297d8214-20d2-4700-9367-229539c47b50", "vulnerable_version": "unknown", "fixed_version": "unknown", "description": "[{'source': 1138114, 'name': 'js-yaml', 'dependency': 'js-yaml', 'title': 'JS-YAML: Quadratic CPU consumption in !!omap resolution (3.x and 4.x) \u2014 CVE-2026-59870 fix not backported', 'url': 'https://github.com/advisories/GHSA-5p4m-2wfm-xmqj', 'severity': 'high', 'cwe': ['CWE-407'], 'cvss': {'score': 7.5, 'vectorString': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}, 'range': '>=3.0.0 <3.15.1'}, {'source': 1138115, 'name': 'js-yaml', 'dependency': 'js-yaml', 'title': 'JS-YAML: Quadratic CPU consumption in !!omap resolution (3.x and 4.x) \u2014 CVE-2026-59870 fix not backported', 'url': 'https://github.com/advisories/GHSA-5p4m-2wfm-xmqj', 'severity': 'high', 'cwe': ['CWE-407'], 'cvss': {'score': 7.5, 'vectorString': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}, 'range': '>=4.0.0 <4.3.1'}]", "created_at": "2026-08-13T11:19:08.753427+00:00" }, { "package_name": "nanoid", "severity": "high", "references": [], "scan_id": "240f1051-b53c-4d73-ab42-751b4d43271a", "vulnerability_id": "56663b5a-589d-4a38-bcc9-2dc77a17de03", "vulnerable_version": "unknown", "fixed_version": "unknown", "description": "[{'source': 1138813, 'name': 'nanoid', 'dependency': 'nanoid', 'title': 'nanoid: custom generators can loop indefinitely when size is zero', 'url': 'https://github.com/advisories/GHSA-2v37-7h3g-55p8', 'severity': 'high', 'cwe': ['CWE-835'], 'cvss': {'score': 5.9, 'vectorString': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H'}, 'range': '<3.3.17'}]", "created_at": "2026-08-13T11:19:08.753427+00:00" } ] } ] } }