shadcn-ui MCP Server — Watchlist

MCP100 Assessment

Watchlist / Tracking

Why we’re tracking it

Follow registry, component, and package changes as the UI catalog evolves

Reviewed Oct 5, 2026 · Documentation review; complete setup workflow not independently tested

Best fit

Retrieving shadcn/ui component source, blocks, demos and metadata in coding agents.

What we know

The server exposes shadcn/ui component source, demos, blocks and metadata to MCP clients and supports multiple UI-library modes.

Maintenance / activity evidence

Observed Oct 3, 2026 (UTC)Merge pull request 65 from Jpisnice/feat/mcp-spec-2026-07-28

Tracking evidence observed Oct 5, 2026. These dated signals do not establish current maintenance. Reviewed enrichment confidence: high.

Activity source · commits ↗Activity source · releases ↗

Verification gaps / watch-outs

Installation and comprehensive security have not been independently audited.
Reads GitHub repository/component content.
Optional GitHub PAT; no built-in remote MCP endpoint auth documented.
Sensitive access: GitHub token if configured

The server is read-oriented, but remote deployment can expose a network MCP endpoint and an optional GitHub token must be protected.

Security source · repository notice ↗

Full authority, access and evidence limits are available in Review context and Access & risk.

Popularity

3,028 repository stars · 12.9k package downloads / 30 days

Stars observed Oct 6, 2026. Downloads observed Oct 6, 2026.

All limitations / Review context

Does the server still generate components from the current shadcn registry?

The bounded assessment reviewed the official README, repository notices, security policy path, and security page for known material public-tracking blockers. No such blocker was identified. This is a public-tracking assessment, not an installation safety certification.

The server is read-oriented, but remote deployment can expose a network MCP endpoint and an optional GitHub token must be protected.
Reads GitHub repository/component content.
Optional GitHub PAT; no built-in remote MCP endpoint auth documented.
Component/source content is fetched from GitHub and returned to MCP clients.
Sensitive access: GitHub token if configured
Installation, client compatibility and comprehensive security have not been independently audited. Authentication and access depend on the configured services.
A project-specific SECURITY.md policy was not available at the fetched official path; the review remains limited to published repository notices.
No installation, runtime, client matrix, or complete tool-contract audit was performed in this review.
The fetched official SECURITY.md path returned HTTP 404; it was not treated as positive evidence.
GitHub API rate limits apply.
Node.js 20+ is required for current releases.
Remote HTTP deployment needs operator-managed endpoint security.

Original activity observations

2026-10-03T15:16:34Z: Merge pull request 65 from Jpisnice/feat/mcp-spec-2026-07-28

Technical identity

github.com/jpisnice/shadcn-ui-mcp-server

Exact implementation source: https://github.com/jpisnice/shadcn-ui-mcp-server ↗
Reviewed resource type: MCP Server
Repository identity: Jpisnice/shadcn-ui-mcp-server
Package identity: npm:@jpisnice/shadcn-ui-mcp-server
Service endpoint: http://localhost:7423/mcp

Evidence & Sources

Evidence basis: Recorded source evidence
Setup runtime verification: Not independently runtime-tested by MCP100 for this setup workflow.

Reviewed Oct 5, 2026 · Latest source observation Oct 6, 2026

GitHub repository ↗
jpisnice/shadcn-ui-mcp-server
Recorded repository material and project history.
Includes references whose attribution is not established.
Package registry ↗
@jpisnice/shadcn-ui-mcp-server
Recorded package identity, distribution or download evidence.
Includes references whose attribution is not established.

Setup · Watchlist

Install & Agents

claude-desktop

Publisher instructions with a documented client setup path.

Source evidence observed Oct 14, 2026.

Additional setup details required — see the specific gaps below.

Install / connect
Publisher instructions
For stdio, use publisher `npx @jpisnice/shadcn-ui-mcp-server --github-api-key <token>`; for HTTP deployment run `docker compose up -d` and register `claude mcp add --scope user --transport http shadcn-mcp-server http://localhost:7423/mcp`. Choose **one** route.
mcp stdio launcher or diagnostic · Publisher instructions
npx @jpisnice/shadcn-ui-mcp-server
Configure / authenticate
Publisher instructions
Run via npx @jpisnice/shadcn-ui-mcp-server, optionally with a GitHub token for rate limits. Modern HTTP uses /mcp; the old /sse endpoint has been removed.
Check connection
Suggested check
Inspect safe component-list/search tool discovery; token is optional.
Remove / uninstall / revoke
MCP100 setup guide
For publisher HTTP CLI registration; if using Docker Compose run `docker compose down` from deployment directory. For MCPB use Claude Desktop extension manager.
Distinguish client registration removal from software uninstall, persistent data deletion and provider OAuth/API-key revocation.
claude mcp remove shadcn-mcp-server

Official Documentation & Sources

What it does

The server exposes shadcn/ui component source, demos, blocks and metadata to MCP clients and supports multiple UI-library modes.

Capability: Developer Tools
Resource type: MCP Server
Industry: Software & Technology
Best fit: Retrieving shadcn/ui component source, blocks, demos and metadata in coding agents.

Representative uses

Retrieve component source and demos
Browse component metadata
Use React/Svelte/Vue/React Native modes
Run local stdio or remote HTTP mode

Limitations

GitHub API rate limits apply.
Node.js 20+ is required for current releases.
Remote HTTP deployment needs operator-managed endpoint security.

Reviewed access

Access & risk

Review the exact access boundary before connecting this MCP to accounts, credentials, or sensitive data.

Authentication: Optional GitHub PAT; no built-in remote MCP endpoint auth documented.
Permissions: Reads GitHub repository/component content.
Data handling: Component/source content is fetched from GitHub and returned to MCP clients.
Cost: free
Risk and cautions: The server is read-oriented, but remote deployment can expose a network MCP endpoint and an optional GitHub token must be protected.

Access scope and cautions

Write actions: None in the reviewed inventory
Sensitive access: GitHub token if configured
Risk level: moderate

FAQ

Based on reviewed evidence as of 2026-10-06. Watchlist tracking is not a recommendation or a security certification.

Which tasks are documented for this implementation?

The reviewed tasks include: Retrieve component source and demos; Browse component metadata; Use React/Svelte/Vue/React Native modes; Run local stdio or remote HTTP mode.

What setup and authentication are documented?

Recorded installation/entrypoint step: npx @jpisnice/shadcn-ui-mcp-server. Recorded endpoint: http://localhost:7423/mcp. Recorded transport: stdio, streamable_http. Recorded environment-variable notes: GITHUB_PERSONAL_ACCESS_TOKEN; MCP_TRANSPORT_MODE; MCP_PORT; MCP_HOST; MCP_CORS_ORIGINS; MCP_PROTOCOL; UI_LIBRARY. No configuration values are supplied here. Prerequisites: Node.js 20+. These are the documented setup details, not a claim that installation or client compatibility was independently tested. Authentication: Optional GitHub token for higher API limits; endpoint auth is not documented.

Can it modify data or perform write operations?

The reviewed inventory lists no write actions. An empty inventory alone does not establish read-only authority. Recorded permission boundary: Reads GitHub repository/component content.

What data-handling boundary should I consider?

Component/source content is fetched from GitHub and returned to MCP clients. Recorded sensitive-access context: GitHub token if configured.

What limitations and risks should I check before use?

The server is read-oriented, but remote deployment can expose a network MCP endpoint and an optional GitHub token must be protected. GitHub API rate limits apply. Node.js 20+ is required for current releases. Remote HTTP deployment needs operator-managed endpoint security. A project-specific SECURITY.md policy was not available at the fetched official path; the review remains limited to published repository notices.

Is this an official MCP?

Jpisnice is listed as Community implementation in MCP100’s current evidence.