Magic UI MCP

npm:@magicuidesign/mcp@2.0.0

github.com/magicuidesign/magicui

Score

B94

Findings

Tools

Last scan

2026-09-19

Severity breakdown

Critical0

High0

Medium3

Low0

Info0

Worst finding

Tool `listRegistryItems` accepts unconstrained string input

· listRegistryItems

The following string parameter(s) have no `maxLength` constraint: `kind`, `query`. Unbounded strings let an attacker stuff arbitrary payloads through the tool, including indirect-injection content.

fix: Add a `maxLength` to each string property, or constrain with an `enum` or `pattern`. Most legitimate tool inputs fit under a few hundred bytes.

All 3 findings

medium
Tool `listRegistryItems` accepts unconstrained string input· listRegistryItemsunconstrained input
The following string parameter(s) have no `maxLength` constraint: `kind`, `query`. Unbounded strings let an attacker stuff arbitrary payloads through the tool, including indirect-injection content.
fix: Add a `maxLength` to each string property, or constrain with an `enum` or `pattern`. Most legitimate tool inputs fit under a few hundred bytes.
medium
Tool `getRegistryItem` accepts unconstrained string input· getRegistryItemunconstrained input
The following string parameter(s) have no `maxLength` constraint: `name`. Unbounded strings let an attacker stuff arbitrary payloads through the tool, including indirect-injection content.
fix: Add a `maxLength` to each string property, or constrain with an `enum` or `pattern`. Most legitimate tool inputs fit under a few hundred bytes.
medium
Tool `searchRegistryItems` accepts unconstrained string input· searchRegistryItemsunconstrained input
The following string parameter(s) have no `maxLength` constraint: `kind`, `query`. Unbounded strings let an attacker stuff arbitrary payloads through the tool, including indirect-injection content.
fix: Add a `maxLength` to each string property, or constrain with an `enum` or `pattern`. Most legitimate tool inputs fit under a few hundred bytes.

Reproduce this

Every finding above comes from a public, deterministic rule engine — no LLM in the decision path, same input always the same output. You can run it against this server yourself and get byte-identical results:

curl -fsSL capframe.ai/install | sh
capframe find ./your-mcp-config.json --out findings.json

Five-step quickstart if you want the whole Find → Bind → Guard loop. If you'd rather have someone read your real tool definitions rather than the advertised surface — including the ones this public scan can't reach — that's the Agent Security Audit.

How this was scored

Source sandbox — live tools/list captured in an ephemeral Docker container (parameter schemas included → R1/R2/R4 fire). Findings are emitted by the public capframe.findings.v1 schema. Score = 100 − (10·Critical + 4·High + 2·Medium + 1·Low), clamped to [0, 100].

Disagree with a finding? Open an issue.