
Company News
AWS Security Hub Adds Socket for Supply Chain Security
Socket is now in the AWS Security Hub Extended plan. Adopt it through AWS, apply committed spend, and block malicious open source packages.
@zaai-dev/mcp
Advanced tools
Zaai Dev MCP server — exposes your captures (and, in v1.5, your brand brief) to MCP-compatible AI tools.
Model Context Protocol server for the Zaai Dev platform. Exposes your captured design references to MCP-compatible AI tools — Claude Code, Claude Desktop, Cursor, Continue, Cline, anything else that speaks MCP.
After a one-time token paste, prompts like "list my last 5 captures tagged hero and show me their palettes" call the workspace directly and pull back real data.
You need:
node --version)Add to claude_desktop_config.json — merge into the existing mcpServers block, don't replace the whole file.
~/Library/Application Support/Claude/claude_desktop_config.json%APPDATA%\Claude\claude_desktop_config.json~/.config/Claude/claude_desktop_config.json{
"mcpServers": {
"zaai-dev": {
"command": "npx",
"args": ["-y", "@zaai-dev/mcp"],
"env": {
"ZAAI_API_TOKEN": "zaai_mcp_YOUR_SECRET_HERE"
}
}
}
}
Restart Claude Desktop. The 9 tools below appear in the slash-command picker.
Add to ~/.cursor/mcp.json — same JSON shape as Claude Desktop.
{
"mcpServers": {
"zaai-dev": {
"command": "npx",
"args": ["-y", "@zaai-dev/mcp"],
"env": {
"ZAAI_API_TOKEN": "zaai_mcp_YOUR_SECRET_HERE"
}
}
}
}
Restart Cursor.
One-liner — updates ~/.claude/mcp_servers.json automatically:
claude mcp add zaai-dev -e ZAAI_API_TOKEN=zaai_mcp_YOUR_SECRET_HERE -- npx -y @zaai-dev/mcp
All tools except health need a valid token. All tools except health and whoami charge 1 credit per successful call (your workspace plan determines the monthly credit grant — see pricing).
| Tool | What it does |
|---|---|
health | Server status + version + uptime. No auth, no charge. |
whoami | Returns your userId, orgId, project scope, and credit balance. No charge. |
list_captures | Paginated list of your captures (newest first). Args: q, cursor, limit. |
search_captures | Same as list but with q required. Tuned description for targeted retrieval. |
get_capture | Full payload + signed screenshot URLs for one capture id. |
get_palette | Just the palette slice (page) or eyedropper picks (element/composite). |
get_html | Just the HTML. Page → full HTML; element → outerHTML; composite → concat with markers. |
get_animation | Just the animation data — CSS transitions, keyframes, library hints. |
get_media | Just the media inventory — videos, images, backgrounds, carousels. |
Plus the zaai-capture://{id} resource template — attach individual captures to a conversation via the resource picker.
| Error class | Meaning | Action |
|---|---|---|
Unauthorized | Token invalid, revoked, or wrong kind | Mint a fresh mcp token, update your config, restart |
InsufficientCredits | Out of credits for the month | Top up or wait for the monthly grant |
CaptureNotFound | id doesn't exist OR is in a project the token can't see | list_captures to find valid ids |
InvalidCaptureId | id isn't a UUID | Pass an id from list_captures or the workspace URL |
UnknownCaptureField | Hit a focused-getter route with an unknown field | Use one of: palette, html, animation, media |
Errors return as isError: true in the tool result so the LLM can read and act on them.
The server holds only your MCP token — it never sees your password, your Supabase service-role key, or other users' data. The workspace's verifyToken derives userId + orgId from your token on every request; queries are scoped to that user + the token's project allowlist (which you set at mint time). A revoked token causes the next tool call to fail with Unauthorized.
The server itself runs entirely on your machine — npx -y @zaai-dev/mcp downloads the package once, then your AI tool launches it as a subprocess. No telemetry, no analytics SDK.
git clone https://github.com/POLONIBOI/ZAAI_dev_mcp.git
cd ZAAI_dev_mcp
pnpm install
pnpm build
pnpm inspector # MCP Inspector for interactive testing
You'll need ZAAI_API_TOKEN set as an env var (or pasted into the Inspector's Environment Variables panel before clicking Connect).
MIT.
FAQs
Zaai Dev MCP server — exposes your captures, brand brief, and design docs to MCP-compatible AI tools.
The npm package @zaai-dev/mcp receives a total of 52 weekly downloads. As such, @zaai-dev/mcp popularity was classified as not popular.
We found that @zaai-dev/mcp demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Company News
Socket is now in the AWS Security Hub Extended plan. Adopt it through AWS, apply committed spend, and block malicious open source packages.

Research
/Security News
Popular npm packages keyv and cacheable compromised.

Security News
A misconfiguration gave three Anthropic models internet access, and one, believing it was in a simulation, shipped a credential-stealing package to PyPI.