THRONE
See report Verify server

registry / record

@21st-dev/magic

npm / sealed 2026-06-16 / No. 70131389

Does @21st-dev/magic MCP work in Claude Code and Cursor? Throne executed @21st-dev/magic mcp in a single-use Firecracker microVM and replayed both recorded client behaviours. Compatibility verdict: not fit. Is @21st-dev/magic mcp safe? Static security scan: 3 finding(s) to review under security ruleset v1. The full per-step results, security findings, scan date, and evidence hash are below.

> throne registry @21st-dev/magic sealed
receiptsealed evidence
scan id
7013138945164a2e8f8f82ec79c68af3
target
@21st-dev/magic
sealed at
2026-06-16 17:11:35Z
evidence hash
sha256:a05463ceca9e4cbe611717eb0a4354f698a5f889637e86d58353ace07031809b
01connectPASS1.1s

initialize ok: server 21st-magic 0.0.46, negotiated protocolVersion 2025-11-25, capabilities ['tools']

02discoverPASS19ms

supported: tools/list (4 tools); method not found (tolerated): resources/list, prompts/list

03validate_schemasPASS2ms

all 4 tool inputSchemas are valid JSON Schema

04smoke_test_toolsPASS10.5s

called 4 of 4 tools (cap 10, strategy=serial): 3 ok, 0 returned tool-level errors (expected for synthesized args), 1 did not answer within 10s (tool may do heavy work)

05error_handlingFAIL2.9s

server process died during error probes, wrong_type_args: 21st_magic_component_builder:accepted (returned result); logo_search:accepted (returned result); 21st_magic_component_inspiration:accepted (returned result); 21st_magic_component_refiner:accepted (returned result); unknown_method: error(-32601); invalid_id: unexpected: {'jsonrpc': '2.0', 'method': 'window/logMessage', 'params': {'type': 3, 'message': 'Shutting down server (PID: 792)...'}}; oversized_input: died (stdin pipe closed); recovery: died (stdin pipe closed); cancellation: died (stdin pipe closed during cancel); old_version: accepted old version 2024-10-07, negotiated 2024-10-07, server may have stale protocol handling

06streamingNOT_APPLICABLE0ms

no streaming-capable tool declared by this server

07resource_lifecycleNOT_APPLICABLE3ms

resources capability not declared

08concurrent_callsFAIL10.0s

concurrency ladder failed at the first level, level 1: id mapping broken, 1 distinct request ids, 0 matched exactly once (expected 1)

09reconnectPASS4.3s

transport closed and relaunched; re-handshake ok (protocolVersion 2025-11-25, first session was 2025-11-25)

01connectPASS2.3s

initialize ok: server 21st-magic 0.0.46, negotiated protocolVersion 2025-11-25, capabilities ['tools'] [request_strategy=pipelined, connection_count=2, second connection established]

02discoverPASS21ms

supported: tools/list (4 tools); method not found (tolerated): resources/list, prompts/list; notes: connection 2 confirms 4 tools

03validate_schemasPASS3ms

all 4 tool inputSchemas are valid JSON Schema

04smoke_test_toolsPASS10.0s

called 4 of 4 tools (cap 10, strategy=pipelined): 3 ok, 0 returned tool-level errors (expected for synthesized args), 1 did not answer within 10s (tool may do heavy work)

05error_handlingFAIL2.4s

server process died during error probes, wrong_type_args: 21st_magic_component_builder:accepted (returned result); logo_search:accepted (returned result); 21st_magic_component_inspiration:accepted (returned result); 21st_magic_component_refiner:accepted (returned result); unknown_method: error(-32601); invalid_id: unexpected: {'jsonrpc': '2.0', 'method': 'window/logMessage', 'params': {'type': 3, 'message': 'Shutting down server (PID: 960)...'}}; oversized_input: died (stdin pipe closed); recovery: died (stdin pipe closed); cancellation: died (stdin pipe closed during cancel); old_version: accepted old version 2024-10-07, negotiated 2024-10-07, server may have stale protocol handling

06streamingNOT_APPLICABLE0ms

no streaming-capable tool declared by this server

07resource_lifecycleNOT_APPLICABLE1ms

resources capability not declared

08concurrent_callsFAIL10.0s

concurrency ladder failed at the first level, level 1: id mapping broken, 1 distinct request ids, 0 matched exactly once (expected 1)

09reconnectPASS4.9s

transport closed and relaunched; re-handshake ok (protocolVersion 2025-11-25, first session was 2025-11-25)

chatgpt desktop calibratingemulation profile pending real-traffic captureCOMING SOON
SECURITY: REVIEW / 3 finding(s) (1 medium) / review recommended
MEDIUMTHR-PATH-01 / Path traversal in file-serving tools

filesystem call with a path built from request-like input and no visible normalization in the file (heuristic, review): open('`http://21st.dev/magic-chat?q=${encodeURIComponent(standaloneRequestQu'

package/dist/tools/create-ui.js:34
LOWTHR-INSTALL-03 / Install-time script execution (npm lifecycle)

"prepare" runs on git-dependency installs and local dev (not registry installs): 'npm run build:prod'

package/package.json
LOWTHR-NET-05 / Hardcoded outbound endpoints

3 non-local endpoint host(s) referenced in code, verify each is expected for this server's purpose: 21st.dev (package/dist/tools/create-ui.js:34), api.svgl.app (package/dist/tools/logo-search.js:41), magic.21st.dev (package/dist/utils/http-client.js:6)

package/dist/tools/create-ui.js:34
VERDICT: NOT FIT14 of 18 steps exercised across 2 clientsSANDBOXED RUN, submitted server executed in a disposable microVM, compatibility: 4 fail / 0 warn (14 of 18 steps exercised across 2 clients) / security: review, 3 finding(s), 0 highsealed by THRONE / No. 70131389 / 2026-06-16
scopeattestation tuple
target
@21st-dev/magic npm
engine
sandboxed
claude code
calibration: partial recorded=9,spec=0,assumed=9
cursor
calibration: partial recorded=11,spec=0,assumed=7
chatgpt desktop
calibration: unavailable recorded=0,spec=2,assumed=16
steps exercised
14 of 18
test suite
v1.0.0
security ruleset
v1.0.0
sealed at
2026-06-16 17:11:35Z
evidence hash
sha256:a05463ceca9e4cbe611717eb0a4354f698a5f889637e86d58353ace07031809b
valid until
2026-09-14
executed in a disposable microVM, created for this scan and destroyed after it. nothing outlives a run.

maintainer of this server? challenge this record: hello@usethrone.dev. tell us what we got wrong and we re-run it in the open.

this page renders the stored record of a real run. nothing on it is asserted without the execution that proved it.