Magic MCP — Watchlist

MCP100 Assessment

Watchlist / Tracking

Why we’re tracking it

The repository is a live migration bridge from Magic MCP to the 21st MCP; a follow-up can verify whether the compatibility package remains supported while old client configurations transition.

Reviewed Oct 5, 2026 · Documentation review; complete setup workflow not independently tested

Best fit

Searching 21st.dev component catalogs and generating UI from an AI coding client.

What we know

Magic MCP is a compatibility proxy that forwards MCP requests to 21st.dev's unified MCP service.

Maintenance / activity evidence

Observed Sep 9, 2026 (UTC)ci: publish release archives with npm trusted publishing

Tracking evidence observed Oct 5, 2026. These dated signals do not establish current maintenance. Reviewed enrichment confidence: high.

Activity source · commits ↗Activity source · releases ↗

Verification gaps / watch-outs

Installation and comprehensive security have not been independently audited.
Access is limited to the capabilities and component libraries exposed by the 21st.dev service. Writes: May generate or return code for insertion by the client.
21st.dev account/API key.
Sensitive access: Potential team/private component libraries

The local package is a proxy to a hosted service; account scope and team-library access should be reviewed.

Security source · repository notice ↗

Full authority, access and evidence limits are available in Review context and Access & risk.

Popularity

5,975 repository stars · 119.5k package downloads / 30 days

Stars observed Oct 6, 2026. Downloads observed Oct 6, 2026.

All limitations / Review context

Does the compatibility proxy still forward to the current 21st MCP endpoint, and is a separate legacy installation still useful to track?

The bounded assessment reviewed the official README, repository notices, security policy path, and security page for known material public-tracking blockers. No such blocker was identified. This is a public-tracking assessment, not an installation safety certification.

The local package is a proxy to a hosted service; account scope and team-library access should be reviewed.
Access is limited to the capabilities and component libraries exposed by the 21st.dev service.
21st.dev account/API key.
Requests are forwarded to the hosted 21st.dev service.
Reviewed write actions: May generate or return code for insertion by the client
Sensitive access: Potential team/private component libraries
Installation, client compatibility and comprehensive security have not been independently audited. Authentication and access depend on the configured services.
A project-specific SECURITY.md policy was not available at the fetched official path; the review remains limited to published repository notices.
No installation, runtime, client matrix, or complete tool-contract audit was performed in this review.
The fetched official SECURITY.md path returned HTTP 404; it was not treated as positive evidence.
The legacy standalone Magic backend has been retired.
Existing configurations may need a fresh API key or migration to the unified service.

Original activity observations

2026-09-09T20:38:21Z: ci: publish release archives with npm trusted publishing

Technical identity

github.com/21st-dev/magic-mcp

Exact implementation source: https://github.com/21st-dev/magic-mcp ↗
Reviewed resource type: MCP Server
Repository identity: 21st-dev/magic-mcp
Package identity: npm:@21st-dev/magic

Evidence & Sources

Evidence basis: Recorded source evidence
Setup runtime verification: Not independently runtime-tested by MCP100 for this setup workflow.

Reviewed Oct 5, 2026 · Latest source observation Oct 6, 2026

GitHub repository ↗
21st-dev/magic-mcp
Recorded repository material and project history.
Package registry ↗
@21st-dev/magic
Recorded package identity, distribution or download evidence.
Includes references whose attribution is not established.

Setup · Watchlist

Install & Agents

Codex

Publisher instructions with a documented client setup path.

Source evidence observed Oct 13, 2026.

Additional setup details required — see the specific gaps below.

Warning

Do not recommend the old @21st-dev/magic proxy as the preferred new setup.
HTTP custom-header support depends on client; CLI is recommended.
Publisher-specific exact credential-revocation procedure not established; use the issuing provider controls only if credentials actually exist.
Credential revocation is external-provider-specific or not documented in examined official project Setup/README; do not assert exact revocation CLI.
This mcpServers JSON is a publisher example for JSON-capable clients; it is NOT the Codex config.toml format or a Claude Code CLI command. Follow the primary client CLI command when using the named client. Renderer target is the known JSON syntax path; do not label as the primary CLI host. Replace the supplied credential/path placeholders privately; use only the named configuration schema.

Install / connect
Publisher instructions
Legacy Magic was replaced by 21st MCP. Use `npx @21st-dev/cli@latest init --client codex`, generate a NEW key; old Magic keys no longer work. The legacy npm package is a compatibility proxy only.
npx @21st-dev/cli@latest init --client codex
Configure / authenticate
Publisher instructions
The old Magic package is now a compatibility proxy. New installs should use 21st CLI/hosted HTTP. Generate a NEW key at https://21st.dev/mcp; legacy Magic keys were reset. JSON shape is publisher example, client support for fixed headers varies.
Advanced configuration · Generic JSON MCP client, not Codex TOML
{ "mcpServers": { "21st": { "headers": { "x-api-key": "YOUR_21ST_API_KEY" }, "url": "https://21st.dev/api/mcp" } } }
Check connection
Suggested check
Restart the registered 21st client and inspect its 21st MCP tool listing. Authentication requires a newly issued 21st key: old Magic keys no longer work. If connected, inspect get_usage.aiGenerationEnabled before attempting hosted generation; search and get_component can be used without hosted AI generation. Client registration check: `codex mcp list` (checks registration; inspect tools/read-only calls separately to verify authenticated service access).
Remove / uninstall / revoke
MCP100 setup guide
Run `codex mcp remove 21st` if the 21st CLI registered the `21st` entry; for other clients remove only the `21st` connector in settings. Remove the old `magic`/`@21st-dev/magic` entry separately if present.
codex mcp remove 21st

Official Documentation & Sources

What it does

Magic MCP is a compatibility proxy that forwards MCP requests to 21st.dev's unified MCP service.

Capability: Design & Creative
Resource type: MCP Server
Industry: Software & Technology
Best fit: Searching 21st.dev component catalogs and generating UI from an AI coding client.

Representative uses

Search component catalogs
Retrieve component code
Generate UI components
Use team component libraries

Limitations

The legacy standalone Magic backend has been retired.
Existing configurations may need a fresh API key or migration to the unified service.

Reviewed access

Access & risk

Review the exact access boundary before connecting this MCP to accounts, credentials, or sensitive data.

Authentication: 21st.dev account/API key.
Permissions: Access is limited to the capabilities and component libraries exposed by the 21st.dev service.
Data handling: Requests are forwarded to the hosted 21st.dev service.
Cost: unknown
Risk and cautions: The local package is a proxy to a hosted service; account scope and team-library access should be reviewed.

Access scope and cautions

Write actions: May generate or return code for insertion by the client
Sensitive access: Potential team/private component libraries
Risk level: moderate

FAQ

Based on reviewed evidence as of 2026-10-06. Watchlist tracking is not a recommendation or a security certification.

Which implementation does this page cover?

Magic MCP is a compatibility proxy that forwards MCP requests to 21st.dev's unified MCP service.

What setup and authentication are documented?

Recorded installation/entrypoint step: npx @21st-dev/cli@latest init --client cursor. Recorded transport: stdio. Prerequisites: Node.js/npm. These are the documented setup details, not a claim that installation or client compatibility was independently tested. Authentication: 21st.dev API key/account authentication is required by the unified service.

Can it modify data or perform write operations?

Documented write actions include: May generate or return code for insertion by the client. Recorded permission boundary: Access is limited to the capabilities and component libraries exposed by the 21st.dev service.

What data-handling boundary should I consider?

Requests are forwarded to the hosted 21st.dev service. Recorded sensitive-access context: Potential team/private component libraries.

What limitations and risks should I check before use?

The local package is a proxy to a hosted service; account scope and team-library access should be reviewed. The legacy standalone Magic backend has been retired. Existing configurations may need a fresh API key or migration to the unified service. A project-specific SECURITY.md policy was not available at the fetched official path; the review remains limited to published repository notices.

Is this an official MCP?

21st.dev is listed as First-party MCP in MCP100’s current evidence.

Why we’re tracking it

Best fit

What we know

Maintenance / activity evidence

Verification gaps / watch-outs

Popularity

Original activity observations

Evidence & Sources

Install & Agents

Install / connect

Configure / authenticate

Check connection

Remove / uninstall / revoke

Official Documentation & Sources

What it does

Representative uses

Limitations

Access & risk

Access scope and cautions

FAQ