Shadcn SvelteSAFE
tmcp MCP server for live shadcn-svelte docs, Bits UI API, and Lucide icons.
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
[](https://github.com/Michael-Obele/shadcn-svelte-mcp/releases) [](https://www.npmjs.com/package/shadcn-svelte-mcp) [](https://opensource.org/licenses/MIT)
[](https://cursor.com/en-US/install-mcp?name=shadcn-svelte&config=eyJ0eXBlIjoiaHR0cCIsInVybCI6Imh0dHBzOi8vc2hhZGNuLnN2ZWx0ZS1hcHBzLm1lL21jcCJ9)
[!IMPORTANT] The hosted server goes down in a few days. I pay forhttps://shadcn.svelte-apps.me/mcpout of pocket and I'm turning it off soon. Switch to the npm package:npx -y shadcn-svelte-mcp. It runs the same server on your machine, so the shutdown doesn't affect you. Want an HTTP endpoint instead? Deploy it yourself to Fly.io or Render. ❤️ Sponsor @Michael-Obele if you want to chip in. Thank you!
Real-time shadcn-svelte docs for AI editors, via tmcp. Scrapes shadcn-svelte.com and bits-ui.com live — no stale docs.
npm (recommended): npx -y shadcn-svelte-mcp · Hosted (shutting down soon): https://shadcn.svelte-apps.me/mcp · Local dev: bun run src/stdio.ts
What you get
- Live shadcn-svelte + Bits UI docs (no stale bundles)
- 5 tools: list, get, search, icons, Bits UI API
- 5 guided prompts: install a component, set up theming, CLI usage, project init, and which tool to use when
- Intent-aware search (concept queries, categories, multi-query) with typo tolerance + install snippets per package manager
- 1,800+ Lucide icons with import snippets
- 3-day cache (memory + disk) for fast repeats
- Optional: a design skill and a per-editor agent on top of the server
Connect (30 seconds)
npm (recommended):
9b7ac34084b0OBSERVED · 2026-10-07Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control.
claude mcp add shadcn-svelte-mcp -- npx -y [email protected]
{
"mcpServers": {
"shadcn-svelte-mcp": {
"command": "npx",
"args": [
"-y",
"[email protected]"
]
}
}
}Exposed tools (10)
7 read · 3 write · 0 destructive.
| Tool | Risk | Description |
|---|---|---|
bits-ui-get | read | Bits UI primitive internals. Use only after shadcn-svelte-get returns docs.bitsuiName or tooling.bitsUi.exactName, and only when you need the underlying primitive API. Accepts canonical Bits UI names, PascalCase names, component URLs, or some shadcn component names. |
cli-usage | read | Comprehensive guide for using shadcn-svelte CLI commands |
install-component | write | Step-by-step guide to install a specific shadcn-svelte component with proper CLI usage |
project-init | read | Guide to initialize a new shadcn-svelte project from scratch |
setup-theming | write | Guide to set up custom theming and CSS variables for shadcn-svelte |
shadcn-svelte-get | read | PRIMARY tool for shadcn-svelte. Get docs for any component, block, chart, or doc section. Use FIRST for shadcn-svelte questions. Svelte only, not React. If the response includes tooling.bitsUi.exactName, that is the only value to pass to bits-ui-get. |
shadcn-svelte-icons | read | Search real Lucide icons for lucide-svelte by name or tag (1600+ icons, no hallucination). Icons only — for components use shadcn-svelte-get, shadcn-svelte-search, or shadcn-svelte-list. Accepts comma- or space-separated names (e.g. |
shadcn-svelte-list | read | List shadcn-svelte components (grouped by category), blocks, charts, docs, utilities, and Bits UI primitives, discovered live from shadcn-svelte.com. Optionally filter by category. |
shadcn-svelte-search | write | Search shadcn-svelte components, bits, blocks, charts, docs, and utilities. Send 1-3 KEYWORD terms (nouns naming the thing you want), not a question or a sentence — |
tool-usage | read | Which shadcn-svelte MCP tool to use for a given task, including the get -> bits-ui-get chaining flow |
Trust audit
SAFEgrade B · trust 89/100 Nothing in the source contradicts what it says it does. Grade A is reserved for packages that have also passed the behavioural sandbox.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | WARN |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (5 observation(s))
- Network
- declared (4 observation(s))
- Shell
- declared (2 observation(s))
- Dependencies
- not all pinned
- Secrets in source
- none-found
Findings (9)
CMD bun -e "fetch('http://127.0.0.1:3000/health').then(r=>{if(!r.ok)process.exit(1)}).catch(()=>process.exit(1))" || exit 1.fallowrc.json
.releaserc.json
} from "../../services/doc-fetcher.js";
import { discoverBitsUIComponents } from "../../services/bits-ui-discovery.js";} from "../../services/doc-fetcher.js";
import { getFromCache, saveToCache } from "../../services/cache-manager.js";import { fetchWithTimeout } from "../../services/http.js";@orama/orama, @tmcp/adapter-valibot, @tmcp/transport-http, @tmcp/transport-stdio, cheerio, srvx, tmcp, turndown
Gates applied: no_behavioural_pass.
9b7ac34084b0full audit observations/trust-audit/mcp-server/michael-obele__shadcn-svelte.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-07 | 9b7ac34084b0 | SAFE | B | 89 | first audit |
Questions
What is the Shadcn Svelte MCP server?
tmcp MCP server for live shadcn-svelte docs, Bits UI API, and Lucide icons.
What tools does Shadcn Svelte expose?
10 in total: 7 read-only, 3 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.
Is Shadcn Svelte safe to connect to an agent?
The audit found nothing in the source that contradicts what it says it does, and graded it B (89/100). Grade A is held back for packages that have also passed a sandboxed behavioural run, which is why a clean server reads B.
What credentials does Shadcn Svelte need?
No credential environment variables were found in its source, so it appears to need none.
How current is this page?
The grade is for one exact copy of the source (9b7ac34084b0), read on 2026-10-07. The repository is watched and re-audited when it changes.