StorybookBLOCK
A MCP server for Storybook.
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
[](https://www.npmjs.com/package/storybook-mcp)
A Model Context Protocol (MCP) server that provides tools to interact with Storybook documentation and component information.
Features
- getComponentList: Get a list of all components from a configured Storybook
- getComponentsProps: Get detailed props information for multiple components using headless browser automation
- Custom Tools: Create custom tools that can extract any information from your Storybook pages using JavaScript
Installation and Configuration
MCP Settings
Add the following configuration to MCP settings:
{
"mcpServers": {
"storybook": {
"command": "npx",
"args": ["-y", "storybook-mcp@latest"],
"env": {
"STORYBOOK_URL": "/index.json"
}
}
}
}storybook-mcp starts immediately and installs Chromium in the background the first time it runs. If you want to preinstall the browser ahead of time, run npx -y storybook-mcp@latest install-browser. Until that download finishes, the first browser-backed tool call can take longer.
Environment Variables
STORYBOOK_URL(required): The URL to your Storybook's index.json fileCUSTOM_TOOLS(optional): JSON array of custom tool definitions for extracting specific information from your Storybook
Usage
The server provides built-in tools and supports custom tools:
Built-in Tools
1. getComponentList
Retrieves a list of all available components from the configured Storybook.
Example:
Available components: Accordion Avatar
ba45f07d6df8OBSERVED · 2026-10-08Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control.
claude mcp add storybook-mcp -- npx -y [email protected]
{
"mcpServers": {
"storybook-mcp": {
"command": "npx",
"args": [
"-y",
"[email protected]"
]
}
}
}Exposed tools (5)
5 read · 0 write · 0 destructive.
| Tool | Risk | Description |
|---|---|---|
anotherInvalidTool | read | Valid description |
brokenTool | read | Fails |
getComponentList | read | Get a list of all components from the configured Storybook |
getComponentsProps | read | Get props information for multiple components |
getIconList | read | Get All Icons from the Icon page |
Trust audit
BLOCKgrade D · trust 69/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | FAIL |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- none-observed
- Network
- declared (2 observation(s))
- Shell
- declared (2 observation(s))
- Dependencies
- not all pinned
- Secrets in source
- none-found
Findings (4)
const propsTableHTML = await page.$eval(
return new Function(`return ${handlerCode}`).call(null);@modelcontextprotocol/sdk, playwright, zod, @eslint/js, @types/node, @typescript-eslint/eslint-plugin, @typescript-eslint/parser, @vitest/coverage-v8
2. **DOM Access**: You have full access to the DOM of the loaded page
Gates applied: no_behavioural_pass.
ba45f07d6df8full audit observations/trust-audit/mcp-server/mcpland__storybook-2.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-08 | ba45f07d6df8 | BLOCK | D | 69 | first audit |
Questions
What is the Storybook MCP server?
A MCP server for Storybook.
What tools does Storybook expose?
5 in total: 5 read-only, 0 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.
Is Storybook safe to connect to an agent?
No — not without reading the findings first. The audit graded it D (69/100) and found 2 critical or high issues in the source. Each one is listed on this page with the file and line it is on.
What credentials does Storybook need?
No credential environment variables were found in its source, so it appears to need none.
How does Storybook run?
It speaks stdio, so it runs as a local process your client starts. It is published on npm as storybook-mcp at 0.5.1.
How current is this page?
The grade is for one exact copy of the source (ba45f07d6df8), read on 2026-10-08. The repository is watched and re-audited when it changes.