
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
An advanced MCP (Model Context Protocol) server for shadcn/ui component references. This server provides AI assistants like Claude with detailed, structured information about shadcn/ui components to help developers implement them correctly.
# Install globally
npm install -g shadcn-mcp
# Or run with npx (no installation required)
npx shadcn-mcp
# Clone the repository
git clone https://github.com/yourusername/shadcn-mcp.git
cd shadcn-mcp
# Install dependencies
npm install
# Build the project
npm run build
# Start the server (runs on port 3176 by default)
npm start
# Start in development mode (auto-restart on changes)
npm run watch
# Test with the inspector
npm run inspector
npm start - Start the MCP servernpm run dev - Start the server in development modenpm run watch - Start the server with auto-restart on file changesnpm run build - Build the TypeScript projectnpm run inspector - Test the MCP server with the inspector utilitynpm run sync - Synchronize components from shadcn/ui GitHub repositorynpm run validate - Run component validation toolnpm run analytics - View component query analyticsnpm run add-component - Add a new component interactivelyUse the interactive component adding tool:
npm run add-component
Or manually add a JSON file to the data/components directory following this structure:
{
"name": "ComponentName",
"description": "Description of the component",
"code": "// Full component code here",
"usage": "<ComponentName>Example usage</ComponentName>",
"version": "1.0.0",
"lastUpdated": "2025-05-16T12:00:00Z",
"props": {
"propName": {
"type": "string",
"description": "Description of the prop",
"required": false,
"default": "Default value"
}
},
"importStatement": "import { ComponentName } from \"@/components/ui/component-name\"",
"dependencies": ["package-name"],
"examples": [
{
"name": "Example name",
"code": "<ComponentName>Example code</ComponentName>",
"description": "Example description"
}
],
"compositionPatterns": [
{
"name": "Pattern name",
"description": "Pattern description",
"code": "// Example code using multiple components",
"components": ["ComponentName", "AnotherComponent"]
}
],
"themeCustomization": {
"cssVariables": "--component-bg: oklch(var(--p));",
"tailwindConfig": "theme: { extend: {...} }",
"examples": [
{
"name": "Custom theme",
"description": "Theme description",
"code": ":root { ... }"
}
]
},
"responsiveExamples": [
{
"breakpoint": "sm",
"description": "Mobile layout",
"code": "<div className=\"sm:flex\">...</div>"
}
],
"accessibility": {
"wcagLevel": "AA",
"considerations": ["Keyboard navigable", "Screen reader support"]
},
"features": ["feature1", "feature2"],
"category": "Input",
"relatedComponents": ["RelatedComponent"]
}
By default, the server runs on port 3176 to avoid conflicts with common development tools like Next.js. You can customize the port using an environment variable:
# Run on a custom port
PORT=4567 npm start
Add to your .claude.json configuration file (usually in your home directory):
{
"mcpServers": {
"shadcn-ui-server": {
"command": "npx",
"args": ["-y", "shadcn-mcp"]
}
}
}
Add to your configuration:
{
"mcpServers": {
"shadcn-ui-server": {
"command": "npx",
"args": ["-y", "shadcn-mcp"]
}
}
}
All endpoints are available at http://localhost:3176 by default:
POST /mcp/v1/components - Search for components
{ "query": "button" }{ "components": [...] }GET /mcp/v1/components/:id - Get component by ID/name
{ "component": {...} }POST /mcp/v1/validate - Validate component code
{ "code": "// Component code" }{ "results": { "valid": true, "errors": [], "warnings": [], "suggestions": [] } }GET /mcp/v1/analytics - Get component query analytics
{ "stats": { "topQueries": [...], "totalQueries": 100 } }GET /mcp/v1/categories - Get component categories
{ "categories": ["Input", "Display", ...] }GET /mcp/v1/categories/:category - Get components by category
{ "components": [...] }GET /mcp/v1/patterns - Get component patterns
?category=Form (optional){ "patterns": [...] }GET /mcp/v1/patterns/:name - Get pattern by name
{ "pattern": {...} }GET /mcp/v1/migrations - Get migrations
{ "migrations": [...] }GET /mcp/v1/migrations/:id - Get migration by ID
{ "migration": {...} }GET /mcp/v1/best-practices - Get best practices
?category=Styling (optional){ "bestPractices": [...] }GET /mcp/v1/best-practices/:id - Get best practice by ID
{ "bestPractice": {...} }GET /health - Health check endpoint
{ "status": "healthy", "version": "1.2.0" }Here are some examples of how to use the shadcn-ui MCP with Claude:
The enhanced MCP features particularly benefit Claude Code, enabling it to generate better quality components that follow shadcn/ui patterns and best practices.
MIT
FAQs
MCP server for shadcn/ui component references
We found that shadcn-mcp demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.