MCP server · Org-owned · Audited from source

Magic MCP server

by 21st-dev/magic-mcpISC licenceAudited 21 Sep 2026 · source c75f0aabca59

npm @21st-dev/magic 0.2.3streamable-http★ 5,904

✓SAFEGrade B · 89/100 · 21 Sep 2026 · c75f0aa

5,904GitHub stars

Is it safe? Yes — SAFE, grade B (89/100). The tool list is built at runtime, so we cannot read it from the source. The audit recorded 2 findings (0 critical, 0 high, 0 medium, 2 low). Maintainer's description: It's like v0, but in your Cursor / Claude Code / Windsurf: search 10,000+ React/Tailwind components, generate new UI with AI, and publish your own — right from your editor. Magic MCP is now the 21st MCP; this package keeps old configs working. Setup: 21st.dev/mcp

Ask an AI about this pageGChatGPT CClaude PPerplexity GeGemini XGrok

CoCopilot AIGoogle AI Mode

Cite

Cite this page

ModelsAtlas. “Magic MCP server (21st-dev/magic-mcp)”. Retrieved 21 Sep 2026. https://modelsatlas.com/mcp/21st-dev/magic-1

Trust audit

Audit 0.4.1 · full source read 21 Sep 2026

Trust score89/100✓SAFE B

0 critical0 high0 medium2 low0 info

2 findings, listed below with the file and line each was found on. Grade A needs a sandboxed behavioural run too; this audit read the source only.

What the source does

FilesystemNone observedNothing seen in the source
NetworkDeclared1 observation
ShellNone observedNothing seen in the source
DependenciesNot pinnedSome ranges float
SecretsNone foundNo keys in source

“Declared” means the server says it does this and the source agrees. Browser, file and shell access are expected of some kinds of server.

Five audit layers

Layer	What we check	Result
`L0` Provenance	Repo owner, licence, archive status, activity	PASS
`L1` Static source	Secrets, path traversal, supply chain	PASS 1 finding
`L2` Instructions	Prompt injection and authority framing in docs and tool descriptions	PASS
`L3` Inventory	Declared tools match the source	PASS 1 finding
`L4` Sandbox	Run in isolation and watch behaviour	SKIPPED

Provenance & runtime

Who published it, and what the audit could and could not run

Provenance

Repository owner 21st-devOrganizationAccount type recorded when we read the repository.
PackagePublished on npm@21st-dev/magic at version 0.2.3
LicenceISCFrom the repository, as read at the audited commit.
Last push11 days agoActivity of the repository when we read it.
Source commit readc75f0aabca59The audit covers exactly this commit, read on 21 Sep 2026.

Runtime

Sandbox runNot run yetThis audit read the source only; it did not execute the server.
Tool inventoryBuilt at runtimeThe source declares no tools; the server lists them when a client connects, so we cannot read them.

Every value here is read from the record's own repository and audit.Suggest a correction

Findings (2)

Sorted by severity

LOWSupply chainsupply.unpinned · package.json

F-08 Supply chainCWE-829 · CWE-1357Layer L1

@types/node, shx, typescript

Why: 3 dependency range(s) float
Fix: pin exact versions or ship a lockfile

LOWInventory / provenancemcp.no_tools_extracted · server.json

F-13 Inventory / provenanceCWE-1104Layer L3

Why: the tool list is enumerated at runtime by tools/list, not declared in source
Fix: the page says so rather than showing an empty table

Tools it exposes

None declared in source

The tool list is built at runtime, so we cannot read it from the source.

Install

Package version 0.2.3 · audited commit c75f0aa

Add to Cursor Add to VS Code

One-click links open your editor with the config below filled in, exactly as the snippets show it, pinned to version 0.2.3. The audit covers commit c75f0aa only.

claude mcp add magic --env API_KEY=${API_KEY} --env API_KEY_21ST=${API_KEY_21ST} --env TWENTY_FIRST_API_KEY=${TWENTY_FIRST_API_KEY} -- npx -y @21st-dev/[email protected]

{
  "mcpServers": {
    "magic": {
      "command": "npx",
      "args": [
        "-y",
        "@21st-dev/[email protected]"
      ],
      "env": {
        "API_KEY": "${API_KEY}",
        "API_KEY_21ST": "${API_KEY_21ST}",
        "TWENTY_FIRST_API_KEY": "${TWENTY_FIRST_API_KEY}"
      }
    }
  }
}

The command pins the package version recorded in the source (0.2.3); the audit covers commit c75f0aabca59. Transport: streamable-http. Reads these environment variables: API_KEY, API_KEY_21ST, TWENTY_FIRST_API_KEY. Give it the narrowest token it needs.

Audit history

2026-09-21
✓SAFE B 89 / 100
Source changed, verdict held · c75f0aabca59

README badge

For maintainers · updates on every re-audit

[![ModelsAtlas: SAFE B](https://modelsatlas.com/mcp/21st-dev/magic-1/badge.svg)](https://modelsatlas.com/mcp/21st-dev/magic-1/)

The badge always shows the latest audit; a maintainer cannot pin an old verdict.

Other ratings

Cited, never blended into our score

No third-party security ratings are recorded for this server yet. When they exist they appear here with their source and date, beside, not inside, our grade.

Questions about Magic MCP server

What is the Magic MCP server?

It's like v0, but in your Cursor / Claude Code / Windsurf: search 10,000+ React/Tailwind components, generate new UI with AI, and publish your own — right from your editor. Magic MCP is now the 21st MCP; this package keeps old configs working. Setup: 21st.dev/mcp

Is Magic safe to connect to an agent?

The audit found nothing in the source that contradicts what it says it does, and graded it B (89/100). Grade A is held back for packages that have also passed a sandboxed behavioural run, which is why a clean server reads B.

What credentials does Magic need?

It reads API_KEY, API_KEY_21ST and TWENTY_FIRST_API_KEY from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.

How does Magic run?

It speaks streamable-http, so it runs as a service you connect to over the network. It is published on npm as @21st-dev/magic at 0.2.3.

How current is this page?

The grade is for one exact copy of the source (c75f0aabca59), read on 2026-09-21. The repository is watched and re-audited when it changes.

Sources

21st-dev/magic-mcp on GitHub — the source we read, its licence, stars and activityObserved · 21 Sep 2026
ModelsAtlas trust audit — SAFE verdict for commit c75f0aabca59Observed · 21 Sep 2026

Spotted something wrong? Report a correction · Methodology

Keep going in your AI

Opens with this page as the source. We add nothing else to the prompt.

What is the Magic MCP server?
GChatGPT CClaude PPerplexity
Is Magic safe to connect to an agent?
GChatGPT CClaude PPerplexity
What credentials does Magic need?
GChatGPT CClaude PPerplexity