ModelsAtlas
Explore
Atlas / MCP servers / heroui-inc / HeroUI MCP Monorepo

HeroUI MCP MonorepoBLOCK

mcp/heroui-inc/heroui-mcp
MCP server by heroui-inc · Audited 2026-10-12
⚑ Report / re-scanSource ↗

⚙️ MCP servers for HeroUI React v3 and HeroUI Native.

Verdict
BLOCK
Grade
D
Trust score
64 /100
Exposed tools
9 7r · 2w · 0d
Transport
stdio · streamable-http
License
MIT
Stars
61
01

Overview

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

Model Context Protocol (MCP) servers for the HeroUI design system. Access HeroUI component documentation directly in your AI assistant.

MCPs

Quick Start

Installation

Choose your package based on your platform:

For Web (React/Next.js):

# Cursor, Claude Code, Windsurf, etc.
npx -y @heroui/react-mcp@latest

For React Native:

npx -y @heroui/native-mcp@latest

See package-specific READMEs for detailed installation instructions for your IDE.

What's Included

  • 🔍 Component Discovery - Search and browse all HeroUI components
  • 📚 Complete Documentation - Props, types, and usage examples
  • 🎨 Theme Information - Access theme variables and design tokens
  • 💻 Source Code - View component implementation and styles
  • 🔄 Always Up-to-Date - Latest component data fetched automatically

Local Development

# Clone and install
git clone https://github.com/heroui-inc/heroui-mcp.git
cd heroui-mcp
pnpm install

# Set up environment variables (required for data extraction)
cp .env.example .env
# Edit .env with your Cloudflare R2 and GitHub credentials

Available Scripts

Build Commands:

pnpm build                    # Build all packages
pnpm build:react              # Build React MCP only
pnpm build:native             # Build Native MCP only

Development Servers:

pnpm dev                      # Start all dev servers (excludes mastra)
pnpm dev:react                # React MCP API server (http://localhost:8787)
pnpm dev:native               # Native MCP API server (http://localhost:8788)
pnpm dev:mastra
Read from source at commit 41e58a09a78cOBSERVED · 2026-10-12
Advertisement
02

Connect

Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.

claude-code
claude mcp add mastra --env ANTHROPIC_API_KEY=${ANTHROPIC_API_KEY} --env AWS_ACCESS_KEY_ID=${AWS_ACCESS_KEY_ID} --env AWS_SECRET_ACCESS_KEY=${AWS_SECRET_ACCESS_KEY} --env GITHUB_TOKEN=${GITHUB_TOKEN} -- npx -y @heroui/[email protected]
claude-desktop
{
  "mcpServers": {
    "mastra": {
      "command": "npx",
      "args": [
        "-y",
        "@heroui/[email protected]"
      ],
      "env": {
        "ANTHROPIC_API_KEY": "${ANTHROPIC_API_KEY}",
        "AWS_ACCESS_KEY_ID": "${AWS_ACCESS_KEY_ID}",
        "AWS_SECRET_ACCESS_KEY": "${AWS_SECRET_ACCESS_KEY}",
        "GITHUB_TOKEN": "${GITHUB_TOKEN}"
      }
    }
  }
}
03

Exposed tools (9)

7 read · 2 write · 0 destructive.

ToolRiskDescription
ButtonreadA pressable element that triggers an action.
CardreadA surface that groups related content.
CheckboxreadA control that toggles between checked and unchecked.
TabswriteA set of layered sections of content.
analyze-and-planwriteAnalyze the project to identify all HeroUI v2 components and create a migration plan. Supports both full and incremental migration approaches. This is the first step in migration.
get_component_docsreadGet complete HeroUI Native component documentation (including examples, props, usage) directly from heroui.com. Accepts an array of component names and returns the full MDX documentation for each component. Returns raw markdown content from the component
heroui-buttonreadRoot element of the button.
implement-migrationreadImplement HeroUI v2 to v3 component migrations. Supports both full and incremental migration approaches. Use this to migrate components phase by phase with checkpoints for user approval.
migrationTypereadMigration approach:
04

Trust audit

BLOCKgrade D · trust 64/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.

LayerWhat it checksResult
L0Provenance & inventoryPASS
L1Static analysis of the codeFAIL
L2Instruction surface (what it tells the agent)PASS
L3Class-specific surfacePASS
L4Behavioural (sandbox)SKIPPED

What the source does

Filesystem
declared (5 observation(s))
Network
declared (5 observation(s))
Shell
declared (5 observation(s))
Dependencies
not all pinned
Secrets in source
none-found

Findings (16)

HIGHCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95
apps/migration-mcp/src/mcp/tools/get-component-migration-guides.ts:31
exec(server, {name, description, config}) {
Why it matters. evaluates text as code
Fix. remove; use a parser or a dispatch table
HIGHCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95
apps/migration-mcp/src/mcp/tools/get-hooks-migration-guide.ts:25
exec(server, {name, description, config}) {
Why it matters. evaluates text as code
Fix. remove; use a parser or a dispatch table
HIGHCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95
apps/migration-mcp/src/mcp/tools/get-migration-guide.ts:29
exec(server, {name, description, config}) {
Why it matters. evaluates text as code
Fix. remove; use a parser or a dispatch table
HIGHCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95
apps/migration-mcp/src/mcp/tools/get-styling-migration-guide.ts:27
exec(server, {name, description, config}) {
Why it matters. evaluates text as code
Fix. remove; use a parser or a dispatch table
HIGHCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95
apps/migration-mcp/src/mcp/tools/list-migration-guides.ts:63
exec(server, {name, description, config}) {
Why it matters. evaluates text as code
Fix. remove; use a parser or a dispatch table
LOWInventory / provenance · inv.hidden_file · CWE-1104
apps/react-mcp/.bumprc
.bumprc
Why it matters. hidden member outside the usual dotfiles
Fix. review its purpose
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
apps/migration-mcp/src/api/lib/package-info.ts:5
import packageJson from "../../../package.json";
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
apps/migration-mcp/src/api/lib/server.ts:5
import type {ToolConfig} from "../../mcp/types";
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
apps/migration-mcp/src/api/lib/server.ts:10
import {initializePrompts} from "../../mcp/prompts";
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
apps/migration-mcp/src/api/lib/server.ts:11
import {initializeTools} from "../../mcp/tools";
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
apps/migration-mcp/src/api/middleware/analytics.ts:4
import packageJson from "../../../package.json";
LOWSupply chain · supply.unpinned · CWE-829, CWE-1357
apps/migration-mcp/package.json
@hono/mcp, @modelcontextprotocol/sdk, hono, posthog-node, zod, @cloudflare/workers-types, @types/node, dotenv-cli
Why it matters. 12 dependency range(s) float
Fix. pin exact versions or ship a lockfile
LOWSupply chain · supply.unpinned · CWE-829, CWE-1357
apps/native-mcp/package.json
@aws-sdk/client-s3, @modelcontextprotocol/sdk, @xmldom/xmldom, hono, posthog-node, zod, @cloudflare/vitest-pool-workers, @cloudflare/workers-types
Why it matters. 20 dependency range(s) float
Fix. pin exact versions or ship a lockfile
LOWSupply chain · supply.unpinned · CWE-829, CWE-1357
apps/react-mcp/package.json
@aws-sdk/client-s3, @hono/zod-validator, @modelcontextprotocol/sdk, @xmldom/xmldom, hono, posthog-node, zod, @cloudflare/vitest-pool-workers
Why it matters. 22 dependency range(s) float
Fix. pin exact versions or ship a lockfile
LOWSupply chain · supply.unpinned · CWE-829, CWE-1357
package.json
@types/node, prettier, tsup, turbo, typescript
Why it matters. 5 dependency range(s) float
Fix. pin exact versions or ship a lockfile
LOWSupply chain · supply.unpinned · CWE-829, CWE-1357
packages/analytics/package.json
@types/node, eslint, tsup, typescript
Why it matters. 4 dependency range(s) float
Fix. pin exact versions or ship a lockfile

Gates applied: no_behavioural_pass.

Audited 2026-10-12 · audit v0.4.1 · source sha 41e58a09a78cfull audit observations/trust-audit/mcp-server/heroui-inc__heroui-mcp.json · Report an issue / request a re-scan
05

Audit history

Every audit this server has had. A grade with a past is a grade somebody is still checking.

DateSourceVerdictGradeScoreChange
2026-10-1241e58a09a78cBLOCKD64first audit
06

Questions

What is the @heroui/react-mcp MCP server?

⚙️ MCP servers for HeroUI React v3 and HeroUI Native.

What tools does @heroui/react-mcp expose?

9 in total: 7 read-only, 2 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.

Is @heroui/react-mcp safe to connect to an agent?

No — not without reading the findings first. The audit graded it D (64/100) and found 5 critical or high issues in the source. Each one is listed on this page with the file and line it is on.

What credentials does @heroui/react-mcp need?

It reads ANTHROPIC_API_KEY, AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, GITHUB_TOKEN, HEROUI_API_KEY, OPENAI_API_KEY, R2_ACCESS_KEY_ID and R2_SECRET_ACCESS_KEY from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.

How does @heroui/react-mcp run?

It speaks stdio and streamable-http, so it runs as a local process your client starts. It is published on npm as @heroui/mastra at 1.0.0.

How current is this page?

The grade is for one exact copy of the source (41e58a09a78c), read on 2026-10-12. The repository is watched and re-audited when it changes.

Advertisement