Storybook MCP — Watchlist

MCP100 Assessment

Watchlist / Tracking

Why we’re tracking it

Follow-up value is specific to Reusable Storybook component and documentation tools registered on a caller-owned MCP server: Does the library still expose a stable registration interface distinct from the managed Storybook addon?

Reviewed Oct 5, 2026 · Documentation review; complete setup workflow not independently tested

Best fit

Embedding Storybook component and documentation knowledge into an MCP endpoint owned by your application.

What we know

@storybook/mcp is a library that registers Storybook documentation/component tools from manifest data and is intended to be embedded in an application-owned endpoint.

Maintenance / activity evidence

@storybook/mcp 10.6.1 published 2026-09-29T17:15:54.696Z

Tracking evidence observed Oct 5, 2026. These dated signals do not establish current maintenance. Reviewed enrichment confidence: high.

Verification gaps / watch-outs

Installation and comprehensive security have not been independently audited.
Reads and returns manifest/documentation content supplied by the host.
No authentication is provided by the library itself.
Sensitive access: Potential private Storybook/component metadata

The library itself is read-oriented, but the host must secure the MCP endpoint and decide what component metadata is exposed.

Full authority, access and evidence limits are available in Review context and Access & risk.

Popularity

91,203 shared-repository stars · 9.5M package downloads / 30 days

Stars observed Oct 6, 2026. Downloads observed Oct 6, 2026.

Repository stars are shared across the Storybook monorepo; package downloads are exact to @storybook/mcp.

All limitations / Review context

Does the library still expose a stable registration interface distinct from the managed Storybook addon?

The bounded review of the publisher's documented Reusable Storybook component and documentation tools registered on a caller-owned MCP server and release notices identified no disclosed material condition preventing an accurately scoped public tracking entry. The resource's operational permissions remain uncertainty; this assessment does not certify installation safety.

The library itself is read-oriented, but the host must secure the MCP endpoint and decide what component metadata is exposed.
Reads and returns manifest/documentation content supplied by the host.
No authentication is provided by the library itself.
Component documentation/source metadata is exposed to connected MCP clients.
Sensitive access: Potential private Storybook/component metadata
Installation, client compatibility and comprehensive security have not been independently audited. Authentication and access depend on the configured services.
Runtime behavior, dependencies and undisclosed vulnerabilities were not independently audited.
Documented tool authority and any remote data handling must be checked before installation or use.
Tool inventory, client matrix and permissions completeness were not requirements for this Radar tracking review.
It is a library, not a standalone executable MCP server.
The host application must provide the HTTP endpoint, auth and manifest source.

Original activity observations

@storybook/mcp 10.6.1 published 2026-09-29T17:15:54.696Z

Technical identity

npm/@storybook/mcp

Exact implementation source: https://www.npmjs.com/package/@storybook/mcp ↗
Reviewed resource type: SDK
Repository identity: storybookjs/storybook
Package identity: npm:@storybook/mcp
Service endpoint: /mcp

Evidence & Sources

Evidence basis: Recorded source evidence
Setup runtime verification: Not independently runtime-tested by MCP100 for this setup workflow.

Reviewed Oct 5, 2026 · Latest source observation Oct 6, 2026

Package registry ↗
@storybook/mcp
Recorded package identity, distribution or download evidence.
Includes references whose attribution is not established.
GitHub repository ↗
storybookjs/storybook
Recorded repository material and project history.
Includes references whose attribution is not established.

Setup · Watchlist

SDK setup

Publisher instructions.

Source evidence observed Oct 14, 2026.

Additional setup details required — see the specific gaps below.

Install SDK / library
Publisher instructions
Library for self-hosting Storybook MCP endpoint from components.json (required) and optional docs.json. Needs Node 20+, an application HTTP handler, hosting and public/private endpoint configuration; not a standalone npx MCP server.
publisher documented install or registration · Publisher instructions
npm install @storybook/mcp
Configure / authenticate
MCP100 setup guide
Library for self-hosting Storybook MCP endpoint from components.json (required) and optional docs.json. Needs Node 20+, an application HTTP handler, hosting and public/private endpoint configuration; not a standalone npx MCP server.
Check connection
Suggested check
User-side suggested check (not executed): inspect registered tools/connection and perform publisher-supported read-only status/list operations. Do not send, purchase, publish, delete, sign, trade or alter data as a smoke test.
Remove / uninstall / revoke
MCP100 setup guide
Generic client guidance (not publisher-specific uninstall): unregister MCP entry in the chosen client. If installed globally, remove the npm package separately. Revoke provider access separately through account controls, where supported. This does not erase local data or revoke funds/credentials automatically.
Unregister the named MCP entry from the actual host separately from removing a global npm install; no claim that either revokes remote credentials.
Remove local stored keys/tokens and revoke or rotate corresponding provider authorization using documented provider account controls if available; exact procedure not verified for this package. Wallet private keys cannot be revoked.

Official Documentation & Sources

What it does

@storybook/mcp is a library that registers Storybook documentation/component tools from manifest data and is intended to be embedded in an application-owned endpoint.

Capability: Design & Creative
Resource type: SDK
Industry: Software & Technology
Best fit: Embedding Storybook component and documentation knowledge into an MCP endpoint owned by your application.

Representative uses

Expose Storybook component manifests
Serve documentation tools from /mcp
Provide custom manifest providers
Integrate component knowledge with AI development tools

Limitations

It is a library, not a standalone executable MCP server.
The host application must provide the HTTP endpoint, auth and manifest source.

Reviewed access

Access & risk

Review the exact access boundary before connecting this MCP to accounts, credentials, or sensitive data.

Authentication: No authentication is provided by the library itself.
Permissions: Reads and returns manifest/documentation content supplied by the host.
Data handling: Component documentation/source metadata is exposed to connected MCP clients.
Cost: free
Risk and cautions: The library itself is read-oriented, but the host must secure the MCP endpoint and decide what component metadata is exposed.

Access scope and cautions

Write actions: None in the reviewed inventory
Sensitive access: Potential private Storybook/component metadata
Risk level: moderate

FAQ

Based on reviewed evidence as of 2026-10-06. Watchlist tracking is not a recommendation or a security certification.

Which tasks are documented for this implementation?

The reviewed tasks include: Expose Storybook component manifests; Serve documentation tools from /mcp; Provide custom manifest providers; Integrate component knowledge with AI development tools.

What setup and authentication are documented?

Recorded installation/entrypoint step: npm install @storybook/mcp. Recorded transport: streamable_http. Prerequisites: Node.js 20+; Storybook component manifest. These are the documented setup details, not a claim that installation or client compatibility was independently tested. Authentication: Host application must provide endpoint authentication if needed.

Can it modify data or perform write operations?

The reviewed inventory lists no write actions. An empty inventory alone does not establish read-only authority. Recorded permission boundary: Reads and returns manifest/documentation content supplied by the host.

What data-handling boundary should I consider?

Component documentation/source metadata is exposed to connected MCP clients. Recorded sensitive-access context: Potential private Storybook/component metadata.

What limitations and risks should I check before use?

The library itself is read-oriented, but the host must secure the MCP endpoint and decide what component metadata is exposed. It is a library, not a standalone executable MCP server. The host application must provide the HTTP endpoint, auth and manifest source. Runtime behavior, dependencies and undisclosed vulnerabilities were not independently audited. Documented tool authority and any remote data handling must be checked before installation or use.

Is this an official MCP?

Storybook is listed as First-party MCP in MCP100’s current evidence.