Atlas / MCP servers / jpisnice / Shadcn UI v4 MCP Server

Shadcn UI v4 MCP ServerBLOCK

Name: Shadcn UI v4 MCP Server
Author: jpisnice

mcp/jpisnice/shadcn-ui-mcp-server

MCP server by jpisnice · ai · expo · mcp · Audited 2026-10-12

A mcp server to allow LLMS gain context about shadcn ui component structure,usage and installation,compaitable with react,svelte 5,vue & React Native

Verdict

BLOCK

Grade

Trust score

69 /100

Exposed tools

33 27r · 5w · 1d

Transport

streamable-http

License

MIT

Stars

3,041

Overview

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

[](https://badge.fury.io/js/@jpisnice%2Fshadcn-ui-mcp-server) [](https://opensource.org/licenses/MIT) [](https://modelcontextprotocol.io/specification/2026-07-28)

[](https://archestra.ai/mcp-catalog/jpisnice__shadcn-ui-mcp-server)

🚀 The fastest way to integrate shadcn/ui components into your AI workflow

A Model Context Protocol (MCP) server that provides AI assistants with comprehensive access to shadcn/ui v4 components, blocks, demos, and metadata. Seamlessly retrieve React, Svelte, Vue, and React Native implementations for your AI-powered development workflow.

✨ Key Features

🎯 Multi-Framework Support - React, Svelte, Vue, and React Native implementations
📦 Component Source Code - Latest shadcn/ui v4 TypeScript source
🎨 Component Demos - Example implementations and usage patterns
🏗️ Blocks Support - Complete block implementations (dashboards, calendars, forms)
📋 Metadata Access - Dependencies, descriptions, and configuration details
🔍 Directory Browsing - Explore repository structures
⚡ Smart Caching - Efficient GitHub API integration with rate limit handling, plus protocol cache hints (ttlMs/cacheScope) on list and read results
⌨️ Argument Completion - Autocomplete for prompt and resource-template arguments (component names, package managers, build tools, and more)
🌐 Streamable HTTP Transport - Stateless /mcp endpoint for multi-client deployments (MCP spec 2026-07-28)
🐳 Docker Ready - Production-ready containerization with Docker Compose

🚀 Quick Start

# Basic usage (60 requests/hour)
npx @jpisnice/shadcn-

Read from source at commit efe9c798fd9cOBSERVED · 2026-10-12

Connect

Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.

claude-code

claude mcp add shadcn-ui-mcp-server --env GITHUB_PERSONAL_ACCESS_TOKEN=${GITHUB_PERSONAL_ACCESS_TOKEN} -- npx -y @jpisnice/[email protected]

claude-desktop

{
  "mcpServers": {
    "shadcn-ui-mcp-server": {
      "command": "npx",
      "args": [
        "-y",
        "@jpisnice/[email protected]"
      ],
      "env": {
        "GITHUB_PERSONAL_ACCESS_TOKEN": "${GITHUB_PERSONAL_ACCESS_TOKEN}"
      }
    }
  }
}

Exposed tools (33)

27 read · 5 write · 1 destructive. Blast radius: 1 tool can delete or overwrite — an agent that can be talked into calling a tool can be talked into calling this one.

Tool	Risk	Description
`actions`	destructive	Row actions (edit, delete, view, custom)
`apply_theme`	write	Apply a TweakCN theme preset to the project
`authType`	read	Authentication type (login, register, forgot-password, two-factor)
`build-shadcn-page`	read	Generate a complete shadcn/ui page using v4 components and blocks
`component`	read	Component name to optimize
`create-auth-flow`	write	Generate authentication pages using shadcn/ui v4 login blocks
`create-dashboard`	write	Create a comprehensive dashboard using shadcn/ui v4 blocks and components
`create-data-table`	write	Create advanced data tables with shadcn/ui components
`dashboardType`	read	Type of dashboard (analytics, admin, user, project, sales)
`dataType`	read	Type of data to display (users, products, orders, analytics)
`features`	read	Specific features or components needed (comma-separated)
`get_block`	read	Get source code for a specific shadcn/ui v4 block (e.g., dashboard-01, login-02, sidebar-01)
`get_component`	read	Get the source code for a specific shadcn/ui v4 component
`get_component_demo`	read	Get demo code illustrating how a shadcn/ui v4 component should be used
`get_component_metadata`	read	Get metadata for a specific shadcn/ui v4 component
`get_components`	read	List of available shadcn/ui components that can be used in the project
`get_directory_structure`	read	Get the directory structure of the shadcn-ui v4 repository
`get_install_script_for_component`	write	Generate installation script for a specific shadcn/ui component based on package manager
`get_installation_guide`	read	Get the installation guide for shadcn/ui based on build tool and package manager
`get_theme`	read	Get details of a specific tweakcn theme
`get_theme_metadata`	read	Returns metadata about the currently configured theme
`layout`	read	Layout preference (sidebar, header, full-width, centered)
`list_blocks`	read	Get all available shadcn/ui v4 blocks with categorization
`list_components`	read	Get all available shadcn/ui v4 components
`list_themes`	read	List available tweakcn themes
`navigation`	read	Navigation style (sidebar, top-nav, breadcrumbs)
`optimization`	read	Type of optimization (performance, accessibility, responsive, animations)
`optimize-shadcn-component`	read	Optimize or enhance existing shadcn/ui components with best practices
`pageType`	read	Type of page to build (dashboard, login, calendar, sidebar, products, custom)
`providers`	read	Auth providers (email, google, github, apple)
`style`	read	Design style (minimal, modern, enterprise, creative)
`useCase`	read	Specific use case or context for the component
`widgets`	read	Dashboard widgets needed (charts, tables, cards, metrics)

Trust audit

BLOCKgrade D · trust 69/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.

Layer	What it checks	Result
L0	Provenance & inventory	WARN
L1	Static analysis of the code	FAIL
L2	Instruction surface (what it tells the agent)	PASS
L3	Class-specific surface	WARN
L4	Behavioural (sandbox)	SKIPPED

What the source does

Filesystem: declared (6 observation(s))
Network: declared (5 observation(s))
Shell: declared (5 observation(s))
Dependencies: not all pinned
Secrets in source: none-found

Findings (15)

HIGHCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95

src/tools/tweakcn/fetch-presets.ts:92

const obj = new Function(`return (${sanitized})`)();

Why it matters. evaluates text as code

Fix. remove; use a parser or a dispatch table

HIGHCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95

src/tools/tweakcn/fetch-presets.ts:118

const obj = new Function(`return (${sanitized})`)();

Why it matters. evaluates text as code

Fix. remove; use a parser or a dispatch table

MEDIUMInventory / provenance · inv.binary · CWE-1104

shadcn-ui-mcp-server.mcpb

shadcn-ui-mcp-server.mcpb

Why it matters. a compiled or binary member cannot be reviewed from source

Fix. ship source, or explain the binary in the README

MEDIUMObfuscation / stealth · obf.zero_width · CWE-506, CWE-94

test-package.ps1:1

# Test script for shadcn-ui-mcp-server (Windows PowerShell)

MEDIUMFilesystem / path · mcp.destructive_tools · CWE-22, CWE-59

actions

Why it matters. 1 tool(s) can delete or overwrite

Fix. prefer a read-only mode or scoped tokens; the page states the blast radius

LOWInventory / provenance · inv.hidden_file · CWE-1104

.mcpbignore

.mcpbignore

Why it matters. hidden member outside the usual dotfiles

Fix. review its purpose