Magic

Overview

From the repository's own README, as read at the audited commit.

# Magic MCP → 21st MCP> **Magic MCP is now the 21st MCP.** The Magic MCP server (`@21st-dev/magic`) has been replaced by the unified **21st MCP**, installed via the **21st CLI** — setup at [21st.dev/mcp](https://21st.dev/mcp). This package remains published as a thin compatibility proxy so old configs keep working.## Install the 21st MCP (recommended)```bashnpx @21st-dev/cli@latest init --client cursor   # or: claude | vscode | windsurf | codex```Or add it manually — it is a plain HTTP MCP server:```json{  "mcpServers": {    "21st": {      "url": "https://21st.dev/api/mcp",      "headers": { "x-api-key": "YOUR_21ST_API_KEY" }    }  }}```Get an API key at [21st.dev/mcp](https://21st.dev/mcp).> **Old Magic API keys were reset.** Keys issued by the old Magic console no longer work anywhere. Generate a fresh key at [21st.dev/mcp](https://21st.dev/mcp).## What this package does now (v0.2.0+)`npx -y @21st-dev/magic@latest API_KEY="..."` still works: since v0.2.0 it is a small stdio proxy that forwards every MCP message to the 21st MCP server. Existing `mcp.json` entries that reference `@21st-dev/magic` keep functioning — but they now speak to the same server as the 21st CLI, with the tools available to the authenticated account.The API key is accepted in all the historical forms: positional `API_KEY="..."`, `--API_KEY=...`, `/API_KEY:...`, `-API_KEY ...`, or the `TWENTY_FIRST_API_KEY` / `API_KEY_21ST` environment variables.## AI accessBuilder component access does not enable hosted 21st AI. The server lists`generate` and `iterate_generation` only when AI access is enabled. Check`get_usage.aiGenerationEnabled`; this reports access, not the remaining AIcredit balance. With AI off, use `search` and `get_component`, then adapt thecode with your own coding agent. Existing drafts remain readable.A cached or legacy generation call can return `ai_subscription_required`. Donot retry until AI is enabled. Refresh the client tool list or reconnect afterenabling AI. The proxy forwards

Connect

Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.

claude mcp add magic --env API_KEY=${API_KEY} --env API_KEY_21ST=${API_KEY_21ST} --env TWENTY_FIRST_API_KEY=${TWENTY_FIRST_API_KEY} -- npx -y @21st-dev/[email protected]

{
  "mcpServers": {
    "magic": {
      "command": "npx",
      "args": [
        "-y",
        "@21st-dev/[email protected]"
      ],
      "env": {
        "API_KEY": "${API_KEY}",
        "API_KEY_21ST": "${API_KEY_21ST}",
        "TWENTY_FIRST_API_KEY": "${TWENTY_FIRST_API_KEY}"
      }
    }
  }
}

Details

Source

21st-dev/magic-mcp

npm

@21st-dev/magic@0.2.3

Transports

streamable-http

Credentials it reads

API_KEYAPI_KEY_21STTWENTY_FIRST_API_KEY

Tools

Registered at runtime; the list could not be read from source.

License

ISC

Stars

5,854 · pushed 3d ago

Trust audit

Nothing in the source contradicts what it says it does. Grade A is reserved for packages that have also passed the behavioural sandbox.

What the source does

Filesystem

none-observed

Network

declared (1 observation(s))

Shell

none-observed

Dependencies

not all pinned

Secrets in source

none-found

Findings (2)

@types/node, shx, typescript

Gates applied: no_behavioural_pass.

Audited 2026-09-13 · audit v0.4.0 · source sha c75f0aabca59 · full audit: observations/trust-audit/mcp-server/21st-dev__magic-1.json · Report an issue or request a re-scan

Audit history

Alternatives

Other servers in the same categories, safer ones first.

Questions