# UI Registry (npm · ui-registry-mcp)

Live access to 12 shadcn-style component libraries so agents compose UI from real components.

- Trust score: 63/100 (medium)
- Change this week: +20
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-08-03

## Components

- npm · `ui-registry-mcp`: 63/100 (this document), [markdown](https://verifymcp.io/servers/mrityunjay-tiwari-ui-registry-mcp/ui-registry-mcp.md), [page](https://verifymcp.io/servers/mrityunjay-tiwari-ui-registry-mcp/ui-registry-mcp)

## Channel facts

- Registry: `npm`
- Package: `ui-registry-mcp`
- Version: `0.7.1`
- Transport: `stdio`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-08-03.

- **Supply Chain Security**: 87/100
  - No malware found by supply-chain analysis.
  - Only part of the dependency tree could be resolved (95 of 99), so this covers what we could see, not the whole tree.
  - No install/post-install scripts declared.
  - Only part of the dependency tree could be resolved (95 of 99), so this covers what we could see, not the whole tree.
- **Provenance & Transparency**: 45/100
  - Source repository is publicly reachable at the declared URL.
  - Provenance check failed: no build-provenance attestation is published.
  - Clear OSI-approved license (MIT).
  - Actively maintained (last published 20 days ago).
  - Disclosure check failed: no security disclosure policy was found in the source repository.
- **Schema Quality & AI Usability**: 64/100
  - AI-judged instruction clarity (excellent).
  - Context-footprint check failed: tool/resource definitions use about 1292 tokens (~215/item across 6 items; 6 tools + 0 resources), over budget; trim descriptions and params.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 0/100
  - Stability not yet verified: not enough scan history yet (needs a 30-day window).
- **Tool Coverage**: 100/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 100% of tool parameters carry a description.
- **Capabilities**: 100/100
  - Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.

**Unverified: 1 category.** A category scored 0 because we could not verify it: a data source with nothing on this package, evidence we could not reach, or a check we could not run. We only credit what we can confirm.

## Install

### Claude

```bash
claude mcp add mrityunjay-tiwari-ui-registry-mcp -- npx -y ui-registry-mcp
```

### Codex

```bash
codex mcp add mrityunjay-tiwari-ui-registry-mcp -- npx -y ui-registry-mcp
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "mrityunjay-tiwari-ui-registry-mcp": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "ui-registry-mcp"
      ],
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add mrityunjay-tiwari-ui-registry-mcp --command npx --arg -y --arg ui-registry-mcp
```

### Hermes

```yaml
mcp_servers:
  mrityunjay-tiwari-ui-registry-mcp:
    command: "npx"
    args: ["-y", "ui-registry-mcp"]
```

### Other

```json
{
  "mcpServers": {
    "mrityunjay-tiwari-ui-registry-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "ui-registry-mcp"
      ]
    }
  }
}
```

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-08-03 (score 63, +25)

- [security regression] Provenance: unverified → fail
- [security improvement] Install scripts: unverified → pass
- [security improvement] Known CVEs: unverified → partial
- [functional improvement] Schema quality: unverified → excellent
- [functional improvement] Dependency health: unverified → partial
- [functional improvement] License: unverified → pass
- [functional improvement] Maintenance: unverified → pass
- [functional] Licence: MIT

### 2026-08-02 (score 38, +20)

- [security improvement] Malware scan: unverified → pass
- [security] Stability: Stability not yet verified: not enough scan history yet (needs a 30-day window).
- [functional improvement] MCP protocol: unverified → pass

### 2026-08-01 (score 18, +13)

- [functional improvement] Tool coverage: unverified → 100

### 2026-07-31 (score 5, −20)

- [functional] We updated how we score, so this day's move reflects our rubric, not a change to the server

### 2026-07-30 (score 25, −18)

- [security regression] Malware scan: pass → unverified

### 2026-07-27 (score 43)

First indexed and scored.

## MCP tools (6)

### `list_registries` (~71 tokens)

List component registries

List the component libraries this server can pull from (id, name, homepage, license, and any notes such as premium/gated warnings). Call this first to see what is available. When a registry's notes mention premium/gated components, use verified:true in search_components to get only installable ones.

### `search_components` (~249 tokens)

Search components across libraries

Search all configured component libraries (or one) for components matching a natural-language query, e.g. 'pricing table', 'date picker', 'sidebar'. Synonym-aware: 'modal' also finds 'dialog', 'dropdown' finds 'select', etc. Returns a ranked, lightweight list (registry, name, type, title, description) — NOT the source. Pick the best match, then call get_component to fetch its real code. Set verified:true to return only components confirmed installable (filters out premium/gated ones that would 401).

Input parameters:

- `limit` (integer): Max results (default 20)
- `query` (string, required): What you need, e.g. 'pricing table' or 'avatar group'
- `registry` (string): Optional registry id to restrict the search (see list_registries)
- `type` (string): Optional type filter: 'ui' (single component), 'block' (composed section), 'component', 'hook'
- `verified` (boolean): When true, fetch-check results and return only components that are actually installable (drops premium/gated items that would 401). Slower; use when you want guaranteed-installable results.

### `get_component` (~123 tokens)

Get a component's real source

Fetch the full, current source of one component from a specific library: file contents, npm dependencies, registry dependencies, and the exact install command. Use this after search_components. The returned source is real code you can drop into the project and edit freely. IMPORTANT: relay the returned 'attribution' line to the user so they know which library and source URL the component came from.

Input parameters:

- `name` (string, required): Component name exactly as returned by search_components
- `registry` (string, required): Registry id, e.g. 'reui' (see list_registries)

### `compare_components` (~107 tokens)

Compare a component across libraries

For a given intent (e.g. 'pricing table', 'date picker'), fetch the single best match from EACH library and return them side by side: dependencies, file count, lines of code, install command, and a source preview. Use this to choose the nicest implementation instead of taking the first search hit.

Input parameters:

- `query` (string, required): The component intent, e.g. 'pricing table'
- `registries` (array): Optional subset of registry ids to compare (default: all)

### `check_consistency` (~95 tokens)

Check design consistency across components

Given a set of components (from get_component / search results), statically analyze their source for design clashes when mixed together: inconsistent border-radius scales, hardcoded colors vs theme tokens, missing dark-mode variants, and conflicting icon/animation libraries. Returns findings with concrete pointers so you can normalize the UI before shipping. Run this after assembling components from different libraries.

Input parameters:

- `components` (array, required): The components you plan to use together

### `list_components` (~175 tokens)

List the full component directory

Browse the complete directory of every component across all libraries, each with its DIRECT URL (the registry JSON / shadcn install URL). Paginated — thousands of entries. Filter by registry and/or type, and page with offset/limit. Use this to enumerate what exists or to fetch a component's canonical source URL for attribution. Note: the directory includes premium/gated components too — some URLs 401 on install; use search_components(verified:true) when you need installable-only results.

Input parameters:

- `limit` (integer): Max entries per page (default 200)
- `offset` (integer): Pagination offset (default 0)
- `registry` (string): Optional registry id to restrict to one library
- `type` (string): Optional type filter: 'ui' | 'block' | 'component' | 'hook'

## Diagnostics

Captured diagnostic sections: Provenance, Dependencies. The full working is on the page: https://verifymcp.io/servers/mrityunjay-tiwari-ui-registry-mcp/ui-registry-mcp#diagnostics

## Score history

- 2026-08-03: 63
- 2026-08-02: 38
- 2026-08-01: 18
- 2026-07-31: 5
- 2026-07-30: 25
- 2026-07-28: 43
- 2026-07-27: 43

## Links

- npm package: https://www.npmjs.com/package/ui-registry-mcp
- Socket report: https://socket.dev/npm/package/ui-registry-mcp
- Repository: https://github.com/mrityunjay-tiwari/ui-registry-mcp
- Changelog RSS feed: https://verifymcp.io/servers/mrityunjay-tiwari-ui-registry-mcp/ui-registry-mcp/changelog.xml
- Changelog JSON feed: https://verifymcp.io/servers/mrityunjay-tiwari-ui-registry-mcp/ui-registry-mcp/changelog.json
- HTML version of this page: https://verifymcp.io/servers/mrityunjay-tiwari-ui-registry-mcp/ui-registry-mcp