
Security News
upm Launches as a Fast, Tiny Package Manager Written in TypeScript
upm uses Node.js to deliver fast npm installs in about 250 KB, with a JavaScript API and security defaults.
A semantic index across shadcn-format component registries: find a component by what it does, not what it is called.
A semantic index across shadcn-format component registries: find a component by what it does, rather than what it is called.
Homepage: matchcn.dev
matchcn is an independent, unofficial project. It is not affiliated with, endorsed by, or a partner of shadcn, any of the registries it indexes, or classifier.dev/TypeSafe.
Hundreds of registries now publish components in the shadcn
registry.json format, and npx shadcn add can install from any of
them. No developer or coding agent can hold that many registries in
context, and existing directory tools only search component names, which
does not help when you know what you need but not what any given
registry decided to call it. matchcn tags every component across a fixed
set of properties (category, motion, visual density, interaction model,
and two others) using classifier.dev, then
matches a plain-language brief against those tags with deterministic
code, so the same brief always ranks the same way.
This is a 2-3 day MVP covering 11 of the 372+ registries shadcn's own public list currently has. It is not a comprehensive index. Specific, known weak points, in order of how much they matter:
masonry-bento-grid-with-images) whose
install command actually required Aceternity Pro. A full-scale check
(not a sample) found 163 of aceternity's 282 tagged components
(57.8% overall) return HTTP 401 "Unauthorized" at their real install
URL: 163 of 170 registry:block page-template demo pages (95.9%),
while all 112 registry:ui primitives are free. The 163 gated
page-templates are excluded from shipping; the full 282 remain
tagged and preserved, not lost, same as shadcnblocks below.npx shadcn add actually work unauthenticated,
not just what the index claims) found roughly half of its components
return 401/403 "License required" at their real install URL, something
invisible in the registry's own index data. shadcn-dashboard had the
same problem at a smaller scale (32.5%) and was fixed by filtering the
paywalled components out before shipping; shadcnblocks' own full-scale
check got contaminated by the vendor's rate limiter partway through
(see docs/ROADMAP.md for the full account) before a
clean filter could be produced, so it was pulled entirely rather than
ship it unfiltered or filter it against bad data. Its tagged data is
preserved, not lost, and it is expected back once a clean check runs.visual_density is the weakest tagged dimension. 36% of pilot
answers on this dimension score under 0.6 confidence, the worst of the
six tagged dimensions, even after a rewrite. A confidence-weighted
matcher discounts weak tags automatically, but a visual_density-heavy
brief is still the most likely to disappoint. Full numbers:
docs/PILOT_REPORT.md, docs/DIMENSIONS.md.category, motion,
visual_density, interaction_model) score under 0.6 confidence,
across the 1,783 components shipped as of the first product-UI
expansion. Close to the original 23.9% baseline at the
1,069-component size; assistant-ui pulls this up, and shadcn-dashboard's
paywall filtering has no effect on tag confidence either way, see below.
This has not yet been recomputed for cnippet and uiable (added after
this measurement; the catalog is now 3,717 components after also
correcting aceternity's paywall exclusion below); a 20-item
category-only sample taken during cnippet/uiable's pre-tagging recon
scored 35% under 0.6 confidence, higher than this baseline, not yet confirmed at
full scale.shortlist or no_match than a confident pick,
even when a relevant assistant-ui component exists and ranks near the
top by text similarity, because its underlying dimension tags carry low
confidence.registry:block page-templates, 163 hit
this same 401 and are the ones excluded as paywalled; those 163 were
never enriched (21-27 characters of tagging text each). The 7 that
actually ship were enriched successfully from real source
(1,595-8,043 characters each), so this limitation applies only to
those 7, not to the page-template catalog as a whole. aceternity's
112 registry:ui primitives do not have this problem and are enriched
from real source. Details: docs/DECISIONS.md #12.registry.json sits behind
a Vercel bot challenge that a plain HTTP request cannot pass. Details:
docs/DECISIONS.md #6.None of these cause a wrong forced answer: when confidence is genuinely
low, pick_component returns a shortlist or an explicit no-match, never
a single silent guess. See docs/DEMO_REPORT.md for
real examples of all three outcomes, including two briefs designed to
fail.
npx matchcn
Add to your MCP client's config (for example Claude Desktop's
claude_desktop_config.json, or Claude Code's .mcp.json):
{
"mcpServers": {
"matchcn": {
"command": "npx",
"args": ["-y", "matchcn"]
}
}
}
This exposes one tool, pick_component(brief, registry?, maxResults?).
$ pnpm demo
Brief: a dense bento grid for a landing page. This is real output from a
real run. classifier.dev does not guarantee identical answers across
calls, so the exact confidence number will vary between runs (0.79 to
0.98 observed across repeated runs during development); the outcome, the
chosen component, and the install command have been stable across every
run tried.
BRIEF: a dense bento grid for a landing page
----------------------------------------------------------------------
OUTCOME: CONFIDENT
Selected "bento-grid" from magicui.
-> bento-grid (magicui) confidence 0.85
install: npx shadcn@latest add https://magicui.design/r/bento-grid.json
matched: category, motion, visual_density, interaction_model, needs_external_data, decorative_only
not matched: (none)
resolve used: true decisions spent: 7
Every response includes a per-dimension reason (which of the six tagged dimensions matched the brief and which did not), never just a name. Full JSON shape and more examples, including a shortlist and two deliberate no-match cases: docs/DEMO_REPORT.md.
Five stages: Ingest, Tag, Match, Resolve, Surface. Tagging runs ahead of
time and is committed as reviewable JSON (data/tags/); matching at
query time is deterministic code, not a model call, so the same brief
always ranks the same way. Full architecture, every design decision and
its rejected alternatives, and the exact tagging criteria used:
matchcn stores only derived tags (category, motion, density, and so on)
and a link back to each registry's own install command. It never copies,
stores, or redistributes any registry's component source code. Every
component you install still comes directly from its own registry via
npx shadcn add <url>.
| registry | homepage | components indexed |
|---|---|---|
| react-bits | reactbits.dev | 204 |
| magicui | magicui.design | 79 |
| aceternity | ui.aceternity.com | 119 |
| kokonutui | kokonutui.com | 51 |
| animate-ui | animate-ui.com | 420 |
| motion-primitives | motion-primitives.com | 33 |
| shadcn-dashboard | shadcndashboard.dev | 343 |
| assistant-ui | assistant-ui.com | 154 |
| bundui | bundui.io | 217 |
| cnippet | ui.cnippet.dev | 1128 |
| uiable | uiable.com | 969 |
3,717 components total, drawn from the eleven registries above (343 of shadcn-dashboard's 508 tagged components ship, the other 165 filtered out as paywalled; 119 of aceternity's 282 tagged components ship, the other 163 filtered out as paywalled; see the limitations section above for both). The first six are the motion/marketing family from the original MVP; the rest are a product-UI expansion (forms, tables, dashboards, data display) added after per-registry filter verification, see docs/REGISTRY_EXPANSION_STEP1_2.md. Three other product-UI candidates (shadcn-ui-blocks, plate, react-aria) were evaluated and excluded for specific, evidenced filter gaps; shadcnblocks was tagged but is not currently shipped, both tracked in docs/ROADMAP.md. cnippet and uiable were added in a second product-UI expansion; two other candidates from that same recon, shadcnuikit and shadcn-space, were evaluated and excluded after a real per-item availability check found genuine paywalls on 40% and 33.3% of a 30-item sample respectively. uiable's descriptions are largely name-echo templates ("X component.") rather than hand-written text, a known limitation for that registry, shipped as is rather than blocked on. Tagging runs through classifier.dev, a free, keyless classification endpoint backed by TypeSafe's Jev decision model.
pnpm install
pnpm ingest # fetch and normalize all registries
pnpm tag # tag all components via classifier.dev
pnpm demo # run 3 briefs end to end
pnpm test # determinism tests for the matcher
pnpm typecheck
MIT, see LICENSE.
FAQs
A semantic index across shadcn-format component registries: find a component by what it does, not what it is called.
The npm package matchcn receives a total of 1,103 weekly downloads. As such, matchcn popularity was classified as popular.
We found that matchcn demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
upm uses Node.js to deliver fast npm installs in about 250 KB, with a JavaScript API and security defaults.

Company News
Socket is joining the OpenJS Security Stewardship Program to fund Node.js vulnerability research, maintainer remediation, and security releases.

Security News
Two compromised GitHub Actions were re-enabled with malicious tags intact, exposing thousands of downstream repositories to Mini Shai-Hulud.