
Security News
Ruby's Bundler 4.0.18 Extends Cooldown to bundle lock and bundle cache
The supply chain control that delays freshly published gems now covers lockfile generation and gem vendoring in Ruby projects.
@zeroheight/mcp-server
Advanced tools
MCP server for zeroheight
For a full walkthrough on how to use this MCP server, head over to our help centre article.
Add to Claude Desktop or VSCode (including Cursor/Windsurf) config:
{
"mcpServers": {
"zeroheight-mcp": {
"command": "npx",
"args": ["-y", "@zeroheight/mcp-server@latest"],
"env": {
"ZEROHEIGHT_ACCESS_TOKEN": "zhat_abc123",
"ZEROHEIGHT_CLIENT_ID": "zhci_abc123"
}
}
}
}
By default, the local MCP connects to zeroheight and starts a browser OAuth flow the first time authentication is needed. OAuth tokens are stored locally at ~/.zeroheight/mcp-oauth.json.
If your MCP client cannot complete OAuth, you can still configure zeroheight API credentials as environment variables. These can be created using these instructions:
ZEROHEIGHT_CLIENT_ID="your-client-id"
ZEROHEIGHT_ACCESS_TOKEN="your-access-token"
When both values are present, the local MCP sends them to zeroheight using X-API-CLIENT and X-API-KEY headers.
To help improve the experience this MCP server uses Sentry for error tracking. If you don't want to share error data, you can disable it by setting the environment variable ZEROHEIGHT_MCP_DISABLE_TELEMETRY=true
The server provides these MCP tools:
list-styleguides Discover available design systems that provide documented guidance for components, patterns, and styles. Call this tool first. If multiple systems are available, confirm with the user which should be used.
Helpful to reference before generating UI so decisions can reflect established design approaches.
For single-styleguide remote MCP connections, this tool is not exposed because the connection is already scoped to one design system.
list-pages View the navigation hierarchy of a design system — including categories, pages, and tabs — to better understand how guidance is organized. Call this tool immediately after list-styleguides with the desired styleguide ID.
Helpful when determining where to look for component or pattern documentation before generating UI.
For single-styleguide remote MCP connections, this tool does not require a styleguideId argument.
get-page Fetch guidance from a specific design system page, including usage notes, recommendations, and supporting context.
Particularly helpful ahead of UI generation to increase the likelihood that outputs reflect the intent of the design system.
{
"mcpServers": {
"zeroheight": {
"command": "npx",
"args": ["-y", "@zeroheight/mcp-server@latest"],
"env": {
"ZEROHEIGHT_ACCESS_TOKEN": "zhat_abc123",
"ZEROHEIGHT_CLIENT_ID": "zhci_abc123"
}
}
}
}
Create .vscode/mcp.json:
{
"servers": {
"zeroheight": {
"command": "npx",
"args": ["-y", "@zeroheight/mcp-server@latest"],
"env": {
"ZEROHEIGHT_ACCESS_TOKEN": "zhat_abc123",
"ZEROHEIGHT_CLIENT_ID": "zhci_abc123"
}
}
}
}
"List my styleguides"
"Show pages about buttons"
"Get the navigation for [styleguide name]"
"Find documentation about typography"
More info on setup can be found in the help centre article.
FAQs
MCP server for zeroheight
The npm package @zeroheight/mcp-server receives a total of 103 weekly downloads. As such, @zeroheight/mcp-server popularity was classified as not popular.
We found that @zeroheight/mcp-server demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
The supply chain control that delays freshly published gems now covers lockfile generation and gem vendoring in Ruby projects.

Security News
During a UK cyber test, a Mythos 5 agent used sockpuppets, social engineering, and prompt injection to try to get a maintainer to merge malware.

Company News
Socket is now in the AWS Security Hub Extended plan. Adopt it through AWS, apply committed spend, and block malicious open source packages.