THRONE
See report Verify server

registry / record

@21st-dev/magic

npm / sealed 2026-06-12 / No. ece7183d

> throne registry @21st-dev/magic sealed
receiptsealed evidence
scan id
ece7183d6fb64d9c8e8fed98099ffecb
target
@21st-dev/magic
sealed at
2026-06-12 18:25:31Z
evidence hash
sha256:3d124434aeba0ef60c7847cd55fc9f567eda8665bb076991e90f4f8df3e52e85
01connectPASS1.0s

initialize ok: server 21st-magic 0.0.46, negotiated protocolVersion 2025-11-25, capabilities ['tools']

02discoverPASS19ms

supported: tools/list (4 tools); method not found (tolerated): resources/list, prompts/list

03validate_schemasPASS3ms

all 4 tool inputSchemas are valid JSON Schema

04smoke_test_toolsPASS10.5s

called 4 of 4 tools (cap 10): 3 ok, 0 returned tool-level errors (expected for synthesized args), 1 did not answer within 10s (tool may do heavy work)

05error_handlingPASS1.0s

structured error responses, connection survived — wrong_type_args: accepted (returned result); unknown_method: error(-32601); invalid_id: unexpected: {'jsonrpc': '2.0', 'method': 'window/logMessage', 'params': {'type': 3, 'message': 'Shutting down server (PID: 788)...'}}

06streamingPASS0ms

no streaming-capable tool declared by this server; not applicable (pass-na)

07resource_lifecyclePASS4ms

resources capability not declared; not applicable (pass-na)

08concurrent_callsFAIL10.0s

concurrency ladder failed at the first level — level 1: id mapping broken — 1 distinct request ids, 0 matched exactly once (expected 1)

09reconnectPASS4.0s

transport closed and relaunched; re-handshake ok (protocolVersion 2025-11-25, first session was 2025-11-25)

01connectPASS950ms

initialize ok: server 21st-magic 0.0.46, negotiated protocolVersion 2025-11-25, capabilities ['tools']

02discoverPASS15ms

supported: tools/list (4 tools); method not found (tolerated): resources/list, prompts/list

03validate_schemasPASS2ms

all 4 tool inputSchemas are valid JSON Schema

04smoke_test_toolsPASS10.4s

called 4 of 4 tools (cap 10): 3 ok, 0 returned tool-level errors (expected for synthesized args), 1 did not answer within 10s (tool may do heavy work)

05error_handlingPASS841ms

structured error responses, connection survived — wrong_type_args: accepted (returned result); unknown_method: error(-32601); invalid_id: unexpected: {'jsonrpc': '2.0', 'method': 'window/logMessage', 'params': {'type': 3, 'message': 'Shutting down server (PID: 910)...'}}

06streamingPASS0ms

no streaming-capable tool declared by this server; not applicable (pass-na)

07resource_lifecyclePASS1ms

resources capability not declared; not applicable (pass-na)

08concurrent_callsFAIL10.0s

concurrency ladder failed at the first level — level 1: id mapping broken — 1 distinct request ids, 0 matched exactly once (expected 1)

09reconnectPASS3.2s

transport closed and relaunched; re-handshake ok (protocolVersion 2025-11-25, first session was 2025-11-25)

chatgpt desktopemulation profile pending real-traffic captureCOMING SOON
SECURITY: REVIEW / 3 finding(s) / review material, not a verdict
MEDIUMTHR-PATH-01 / Path traversal in file-serving tools

filesystem call with a path built from request-like input and no visible normalization in the file (heuristic — review): open('`http://21st.dev/magic-chat?q=${encodeURIComponent(standaloneRequestQu'

package/dist/tools/create-ui.js:34
LOWTHR-INSTALL-03 / Install-time script execution (npm lifecycle)

"prepare" runs on git-dependency installs and local dev (not registry installs): 'npm run build:prod'

package/package.json
LOWTHR-NET-05 / Hardcoded outbound endpoints

3 non-local endpoint host(s) referenced in code — verify each is expected for this server's purpose: 21st.dev (package/dist/tools/create-ui.js:34), api.svgl.app (package/dist/tools/logo-search.js:41), magic.21st.dev (package/dist/utils/http-client.js:6)

package/dist/tools/create-ui.js:34
VERDICT: NOT FIT TO SHIPSANDBOXED RUN — submitted server executed in a disposable microVM — compatibility: 2 fail / 0 warn across 2 clients / security: review — 3 finding(s), 0 highsealed by THRONE / No. ece7183d / 2026-06-12
executed in a disposable microVM, created for this scan and destroyed after it. nothing outlives a run.

maintainer of this server? challenge this record: hello@usethrone.dev. tell us what we got wrong and we re-run it in the open.

this page renders the stored record of a real run. nothing on it is asserted without the execution that proved it.