Evaluation record · mcp-server-shadcn

shadcn MCP Server

vCLI 4.x

shadcn

MCPui-componentsdesign-systemfrontendregistry

Strong

About This MCP

MCP server built into the shadcn CLI (run via npx shadcn@latest mcp) that lets AI agents browse, search, and install UI components from any shadcn-compatible registry, including private registries, using @registry/name namespacing. Shipped with CLI 3.0 in August 2025; CLI v4 (March 2026) added shadcn/skills for coding agents, design-system presets, and --dry-run/--diff/--view flags to inspect registry changes before installation.

Last Evaluated: July 9, 2026

Official Website

Trust Vector Analysis

Dimension Breakdown

🚀Performance & Reliability

registry resolution accuracy

Registry resolution testing across namespaces

Evidence

shadcn Registry MCP Documentation — Namespaced @registry/name resolution reliably targets components across configured registries

highVerified: 2026-07-09

installation success rate

Component installation success testing

Evidence

shadcn CLI 3.0 Changelog — Installs reuse the mature shadcn add pipeline, handling dependencies, file placement, and framework detection

highVerified: 2026-07-09

component search quality

Search relevance assessment over public registries

Evidence

shadcn Registry MCP Documentation — Browse and search tools surface components with metadata from any shadcn-compatible registry

mediumVerified: 2026-07-09

error recovery

Failure mode and error message testing

Evidence

shadcn-ui/ui Repository — CLI surfaces clear errors for missing registries, unreachable URLs, and dependency conflicts; partial installs may need manual cleanup

mediumVerified: 2026-07-09

🛡️Security

supply chain risk

Supply chain threat modeling of registry-sourced code installation

Evidence

shadcn Registry Documentation — Installs source code from any configured shadcn-compatible registry directly into the project; third-party registries are unvetted and the key risk surface

highVerified: 2026-07-09

code installation control

Write-action control and approval flow analysis

Evidence

shadcn Registry MCP Documentation — Agent-initiated installs write component files and add npm dependencies; review depends on the MCP client's approval flow and code review practices

shadcn CLI v4 Changelog — CLI v4 (March 2026) adds --dry-run, --diff, and --view flags so registry changes can be inspected before installation, improving pre-install review of agent-driven installs

mediumVerified: 2026-07-09

registry authentication

Registry authentication mechanism review

Evidence

shadcn Registry Documentation — Private registries supported with token-based authentication configured via environment variables in components.json

mediumVerified: 2026-07-09

credential handling

Credential storage and flow analysis

Evidence

shadcn Registry Documentation — Registry tokens read from local environment; no credentials sent to third parties beyond the configured registry endpoints

mediumVerified: 2026-07-09

unauthorized action risk

Blast radius assessment of install actions

Evidence

shadcn CLI 3.0 Changelog — An agent can install components (and transitively their dependencies) into the codebase; a malicious or typosquatted registry entry executes at build/runtime

mediumVerified: 2026-07-09

🔒Privacy & Compliance

data exposure

Data flow analysis of registry requests

Evidence

shadcn Registry MCP Documentation — Server only fetches public or configured registry metadata and component source; it does not read or transmit project code externally

highVerified: 2026-07-09

sensitive data protection

Sensitive data surface assessment

Evidence

shadcn Registry Documentation — Minimal sensitive data involved; main consideration is keeping private registry tokens out of committed configuration

mediumVerified: 2026-07-09

third party data sharing

Outbound request and data sharing review

Evidence

shadcn Registry Documentation — Search and install requests are visible to whichever registries are configured, including third-party ones

mediumVerified: 2026-07-09

local execution privacy

Local execution and telemetry review

Evidence

shadcn Registry MCP Documentation — Runs locally over stdio via npx shadcn@latest mcp with no hosted service or telemetry pipeline collecting project data

highVerified: 2026-07-09

👁️Trust & Transparency

documentation quality

Documentation completeness review

Evidence

shadcn Registry MCP Documentation — Clear official docs covering MCP setup per client, registry configuration, and namespacing, plus a detailed CLI 3.0 changelog

highVerified: 2026-07-09

operation visibility

Traceability of agent actions assessment

Evidence

shadcn CLI 3.0 Changelog — Installed files and dependency changes are fully visible in the project diff; tool calls appear in MCP client logs

mediumVerified: 2026-07-09

open source transparency

Source code and license review

Evidence

shadcn-ui/ui Repository — MIT-licensed; MCP server ships as part of the open shadcn-ui/ui monorepo and CLI

highVerified: 2026-07-09

tool coverage clarity

Tool surface documentation review

Evidence

shadcn Registry MCP Documentation — Tool surface is small and well-defined: browse, search, and install components from configured registries

highVerified: 2026-07-09

⚙️Operational Excellence

ease of setup

Setup complexity assessment

Evidence

shadcn Registry MCP Documentation — One-line stdio config (npx shadcn@latest mcp) with documented one-command setup for major MCP clients

highVerified: 2026-07-09

performance

Operation latency characterization

Evidence

shadcn-ui/ui Repository — Lightweight local process; latency dominated by registry HTTP fetches and npm dependency installs

mediumVerified: 2026-07-09

reliability

Maintenance cadence and stability analysis

Evidence

shadcn CLI v4 Changelog — Built on the actively maintained shadcn CLI with frequent releases since the August 2025 3.0 launch; CLI v4 shipped March 2026 (npm shadcn at v4.13.0 as of 2026-07-09) with skills, presets, and expanded init templates

mediumVerified: 2026-07-09

feature coverage

Feature completeness assessment within its domain

Evidence

shadcn Registry MCP Documentation — Covers discovery and installation across public and private shadcn-compatible registries; scoped to UI components rather than general tooling

highVerified: 2026-07-09

community adoption

Ecosystem adoption analysis

Evidence

shadcn-ui/ui Repository — shadcn/ui is one of the most-starred UI projects on GitHub and the MCP server is the standard agent integration for its ecosystem

highVerified: 2026-07-09

Strengths

+First-party integration with the dominant shadcn/ui component ecosystem
+Browse, search, and install from any shadcn-compatible registry, including private ones
+Runs locally over stdio with no hosted service and minimal data exposure
+Trivial setup via npx shadcn@latest mcp with per-client docs
+All installed code lands in the project diff for review
+MIT-licensed and developed in the open shadcn-ui/ui monorepo

Limitations

!Installs third-party source code and npm dependencies into the project — registry supply-chain risk is the key concern
!No built-in vetting or signing of third-party registry components
!Agent-initiated installs depend on the MCP client's approval flow for human oversight
!Scope limited to UI component workflows in shadcn-compatible projects
!Private registry tokens must be carefully kept out of committed config

Metadata

license: MIT

supported platforms

0: All platforms with Node.js

programming languages

0: TypeScript

github repo: https://github.com/shadcn-ui/ui

package name: shadcn

package version: 4.13.0

installation: npx shadcn@latest mcp

authentication: Optional registry tokens for private registries

first release: 2025-08

maintained by: shadcn

transport types

0: stdio

installation methods

0: npm

Use Case Ratings

code generation

Excellent for AI-assisted frontend development: agents can find and install real, vetted-by-usage components instead of hallucinating UI code

content creation

Useful when building landing pages and content sites on shadcn-based stacks

education

Good for teaching modern React/Tailwind component patterns with installable examples

research assistant

Limited to exploring component registries; not a general research tool

data analysis

Only relevant for installing chart and dashboard UI components, not for analysis itself

shadcn MCP Server

Trust Vector Analysis

Dimension Breakdown

Use Case Ratings

code generation

content creation

education

research assistant

data analysis

Similar MCPs

Context7 MCP

Playwright MCP