registry / record
@21st-dev/magic
Does @21st-dev/magic MCP work in Claude Code and Cursor? Throne executed @21st-dev/magic mcp in a single-use Firecracker microVM and replayed both recorded client behaviours. Compatibility verdict: not fit. Is @21st-dev/magic mcp safe? Static security scan: 3 finding(s) to review under security ruleset v1. The full per-step results, security findings, scan date, and evidence hash are below.
> throne registry @21st-dev/magic
sealed
- scan id
- 7013138945164a2e8f8f82ec79c68af3
- target
- @21st-dev/magic
- sealed at
- 2026-06-16 17:11:35Z
- evidence hash
- sha256:a05463ceca9e4cbe611717eb0a4354f698a5f889637e86d58353ace07031809b
initialize ok: server 21st-magic 0.0.46, negotiated protocolVersion 2025-11-25, capabilities ['tools']
supported: tools/list (4 tools); method not found (tolerated): resources/list, prompts/list
all 4 tool inputSchemas are valid JSON Schema
called 4 of 4 tools (cap 10, strategy=serial): 3 ok, 0 returned tool-level errors (expected for synthesized args), 1 did not answer within 10s (tool may do heavy work)
server process died during error probes, wrong_type_args: 21st_magic_component_builder:accepted (returned result); logo_search:accepted (returned result); 21st_magic_component_inspiration:accepted (returned result); 21st_magic_component_refiner:accepted (returned result); unknown_method: error(-32601); invalid_id: unexpected: {'jsonrpc': '2.0', 'method': 'window/logMessage', 'params': {'type': 3, 'message': 'Shutting down server (PID: 792)...'}}; oversized_input: died (stdin pipe closed); recovery: died (stdin pipe closed); cancellation: died (stdin pipe closed during cancel); old_version: accepted old version 2024-10-07, negotiated 2024-10-07, server may have stale protocol handling
no streaming-capable tool declared by this server
resources capability not declared
concurrency ladder failed at the first level, level 1: id mapping broken, 1 distinct request ids, 0 matched exactly once (expected 1)
transport closed and relaunched; re-handshake ok (protocolVersion 2025-11-25, first session was 2025-11-25)
initialize ok: server 21st-magic 0.0.46, negotiated protocolVersion 2025-11-25, capabilities ['tools'] [request_strategy=pipelined, connection_count=2, second connection established]
supported: tools/list (4 tools); method not found (tolerated): resources/list, prompts/list; notes: connection 2 confirms 4 tools
all 4 tool inputSchemas are valid JSON Schema
called 4 of 4 tools (cap 10, strategy=pipelined): 3 ok, 0 returned tool-level errors (expected for synthesized args), 1 did not answer within 10s (tool may do heavy work)
server process died during error probes, wrong_type_args: 21st_magic_component_builder:accepted (returned result); logo_search:accepted (returned result); 21st_magic_component_inspiration:accepted (returned result); 21st_magic_component_refiner:accepted (returned result); unknown_method: error(-32601); invalid_id: unexpected: {'jsonrpc': '2.0', 'method': 'window/logMessage', 'params': {'type': 3, 'message': 'Shutting down server (PID: 960)...'}}; oversized_input: died (stdin pipe closed); recovery: died (stdin pipe closed); cancellation: died (stdin pipe closed during cancel); old_version: accepted old version 2024-10-07, negotiated 2024-10-07, server may have stale protocol handling
no streaming-capable tool declared by this server
resources capability not declared
concurrency ladder failed at the first level, level 1: id mapping broken, 1 distinct request ids, 0 matched exactly once (expected 1)
transport closed and relaunched; re-handshake ok (protocolVersion 2025-11-25, first session was 2025-11-25)
filesystem call with a path built from request-like input and no visible normalization in the file (heuristic, review): open('`http://21st.dev/magic-chat?q=${encodeURIComponent(standaloneRequestQu'
package/dist/tools/create-ui.js:34"prepare" runs on git-dependency installs and local dev (not registry installs): 'npm run build:prod'
package/package.json3 non-local endpoint host(s) referenced in code, verify each is expected for this server's purpose: 21st.dev (package/dist/tools/create-ui.js:34), api.svgl.app (package/dist/tools/logo-search.js:41), magic.21st.dev (package/dist/utils/http-client.js:6)
package/dist/tools/create-ui.js:34- target
- @21st-dev/magic npm
- engine
- sandboxed
- claude code
- calibration: partial recorded=9,spec=0,assumed=9
- cursor
- calibration: partial recorded=11,spec=0,assumed=7
- chatgpt desktop
- calibration: unavailable recorded=0,spec=2,assumed=16
- steps exercised
- 14 of 18
- test suite
- v1.0.0
- security ruleset
- v1.0.0
- sealed at
- 2026-06-16 17:11:35Z
- evidence hash
- sha256:a05463ceca9e4cbe611717eb0a4354f698a5f889637e86d58353ace07031809b
- valid until
- 2026-09-14
maintainer of this server? challenge this record: hello@usethrone.dev. tell us what we got wrong and we re-run it in the open.
this page renders the stored record of a real run. nothing on it is asserted without the execution that proved it.