Our grade: 4 checks
Based on public data, not a full audit. See how we grade. Something changed? Request a re-grade.
Community rating
- 5 1
- 4 4
- 3 4
- 2 0
- 1 0
Trust in production
- Trust it - 33%
- With caveats - 56%
- Wouldn't - 11%
89% would recommend this server
How reviewers scored it
- Setup & docs 3.6
- Auth experience 3.7
- Reliability 3.9
- Maintainer responsiveness 3.9
Why it got a B
Magic MCP is now the 21st MCP. The server is hosted by 21st.dev at https://21st.dev/api/mcp, and the 21st CLI writes the config for Claude, Cursor, VS Code, Windsurf or Codex. The old npm package @21st-dev/magic still works, but since v0.2.0 it is only a small stdio proxy to the same server; old Magic API keys were reset, so old configs need a fresh key. Tools search components, themes, templates and logos, fetch code (some of it paid), manage bookmarks and team libraries, and generate UI when your account has hosted AI enabled. The old tool names still work. The hosted server and the CLI are not open source. Biggest deduction: access is one unscoped API key that sits in your editor config, so store it in an env var and rotate it if it leaks.
How to connect
// MCP client config (plain HTTP setup from the README)
{ "mcpServers": { "21st": { "url": "https://21st.dev/api/mcp",
"headers": { "x-api-key": "YOUR_21ST_API_KEY" } } } }npx @21st-dev/cli@latest init --client claudeIs 21st.dev Magic MCP (now the 21st MCP) safe?
Is 21st.dev Magic MCP (now the 21st MCP) safe to use?
21st.dev Magic MCP (now the 21st MCP) grades B (solid, with minor gaps). Login is required, but access is coarse: one sign-in or key covers more than your agent needs, so grant the narrowest account you can. Upkeep is hard to verify (closed source or a single maintainer), so pin the version you tested.
Does 21st.dev Magic MCP (now the 21st MCP) have known vulnerabilities?
Not in our current data: it has no open CVEs or advisories. We re-check as new ones are published.
Does 21st.dev Magic MCP (now the 21st MCP) support authentication?
Yes. It requires a login, so access can be tied to a person or a scoped key.
Alternatives in Developer Tools
- A Atlassian Rovo MCP ServerOfficial hosted Atlassian server for Jira, Confluence, Jira Service Management, Compass, Bitbucket, Loom, Goals, Projects, and Teams, with OAuth 2.1 sign-in.
- A Buildkite MCP ServerOfficial Buildkite server for pipelines, builds, jobs, logs, annotations, and Test Engine data, hosted or local.
- A Dynatrace Remote MCP ServerDynatrace's hosted MCP server, running inside your Dynatrace SaaS environment, to run and explain DQL, look into problems, vulnerabilities and Kubernetes events, and forecast time series.
- A GitHub MCP ServerOfficial GitHub server for repos, issues, pull requests, Actions, and code security, hosted or local.
- A GitLab MCP ServerGitLab's built-in MCP server for projects, merge requests, work items, code, and CI pipelines, on GitLab.com or your own instance.
Embed this badge
[](https://trustedmcp.io/servers/21st-dev-magic-mcp)<a href="https://trustedmcp.io/servers/21st-dev-magic-mcp"><img src="https://trustedmcp.io/badge/21st-dev-magic-mcp.svg" alt="TrustedMCP grade B" height="80"></a>Community reviews
Useful, with a few rough edges
I like it, with reservations. Nice that it supports both stdio and HTTP, I use stdio locally and HTTP for the shared agent.
Used for Letting a coding agent open and triage issues
- Setup & docs 3/5
- Auth experience 3/5
- Reliability 3/5
- Maintainer responsiveness 4/5
Trustworthy enough for real work
Our agents call this dozens of times a day. Auth is handled properly, and revoking access later was one click. Nice that it supports both stdio and HTTP, I use stdio locally and HTTP for the shared agent.
Used for Pairing with Claude Code on a monorepo
- Setup & docs 3/5
- Auth experience 4/5
- Reliability 4/5
- Maintainer responsiveness 3/5
Clean integration, sensible permissions
Tried it on a side project first, then rolled it out at work. Being official from 21st.dev counts for a lot when I pitch it to security. Scoped the token to just what the agent needs and it respected that.
Used for Code review summaries for pull requests
- Setup & docs 4/5
- Auth experience 4/5
- Reliability 4/5
- Maintainer responsiveness 4/5
Does the job, docs could be better
Some tools are great, a couple feel half finished. Nice to use something maintained by 21st.dev rather than a random fork.
Used for Debugging sessions in Cursor
- Setup & docs 3/5
- Auth experience 2/5
- Reliability 4/5
- Maintainer responsiveness 4/5
Exactly what I needed from 21st.dev Magic (now the 21st )
Been running this for about a month now. Sign-in flow was painless and I never had to paste a key into a config file. You can tell it is actively maintained, the rough edges keep getting fixed. It is in our production agent and I sleep fine.
Used for Automating release notes
- Setup & docs 5/5
- Auth experience 4/5
- Reliability 5/5
- Maintainer responsiveness 5/5
Mixed feelings after two weeks
Works well enough for what I need. Nice to use something maintained by 21st.dev rather than a random fork.
Used for Looking up 21st.dev Magic (now the 21st ) data without leaving the editor
- Setup & docs 3/5
- Auth experience 3/5
- Reliability 3/5
- Maintainer responsiveness 4/5
Set it up once, forgot about it
Set this up for our team after comparing a few options. Gave it its own API key so I can revoke it without breaking anything else. Scoped the token to just what the agent needs and it respected that. Recommended, with sensible guardrails.
Used for Onboarding new devs with an agent that answers repo questions
- Setup & docs 5/5
- Auth experience 4/5
- Reliability 5/5
- Maintainer responsiveness 4/5
Saves me a context switch every hour
I use this almost daily. Releases come often and the changelog is clear. I like that access goes through a proper sign-in instead of a long-lived secret on disk. Would recommend without hesitation.
Used for CI failure investigation
- Setup & docs 4/5
- Auth experience 5/5
- Reliability 4/5
- Maintainer responsiveness 3/5
Works, just lock it down
Took longer to configure than I expected. Sign-in flow was painless and I never had to paste a key into a config file.
Used for Internal developer assistant
- Setup & docs 2/5
- Auth experience 4/5
- Reliability 3/5
- Maintainer responsiveness 4/5
Write a review
Ran this server? Tell other teams how it went. You get one review per server. We email you a link to confirm it, then an editor checks it before it goes up. We never show your email.