Magic (21st.dev)
Create beautiful, modern UI components instantly through natural language descriptions.
0/100
0Tools
6Findings
4.5kStars
—Downloads
Mar 19, 2026Last Scanned
Score Breakdown5 categories
Code75
Dependencies85
Config32
Description100
Behavior100
OWASP MCP Top 10 Coverage
MCP10-supply-chainMCP10-supply-chainFail
MCP02-tool-poisoningMCP02-tool-poisoningPass
MCP07-insecure-configMCP07-insecure-configFail
MCP08-dependency-vulnMCP08-dependency-vulnFail
MCP01-prompt-injectionMCP01-prompt-injectionPass
MCP03-command-injectionMCP03-command-injectionFail
MCP04-data-exfiltrationMCP04-data-exfiltrationPass
MCP09-logging-monitoringMCP09-logging-monitoringPass
MCP05-privilege-escalationMCP05-privilege-escalationPass
MCP06-excessive-permissionsMCP06-excessive-permissionsPass
Findings6
3critical
2high
0medium
1low
0informational
criticalC1Command InjectionMCP03-command-injectionAML.T0054
Pattern "`[^`]+`" matched in source_code: "`Starting server v${VERSION} (PID: ${process.pid})`" (at position 859)
Replace exec()/execSync() with execFile() and pass arguments as an array, never as a string. Validate all inputs against an allowlist before use in any shell context. For subprocess.run, always pass a list and shell=False.
criticalJ2Git Argument InjectionMCP03-command-injectionAML.T0054
Pattern "--upload-pack|--receive-pack|--exec" matched in source_code: "--exec" (at position 3046)
Always terminate git argument lists with '--' before user-supplied paths. Never allow git_init on directories outside the configured workspace. Validate all git arguments against an allowlist. Block core.* config overrides in user-controlled inputs. See CVE-2025-68143/68144/68145 for the full attack chain.
criticalQ13MCP Bridge Package Supply Chain AttackMCP10-supply-chainAML.T0054
Pattern "npx\s+(?:mcp-remote|mcp-proxy|mcp-gateway|@modelcontextprotocol)(?!@\d)" matched in source_code: "npx @modelcontextprotocol" (at position 2860)
MCP bridge packages (mcp-remote, mcp-proxy, @modelcontextprotocol/sdk, fastmcp) are high-value supply chain targets — CVE-2025-6514 (CVSS 9.6) in mcp-remote affected 437,000+ installs. Always pin exact versions (no ^ or ~ ranges). Use lockfiles (package-lock.json, pnpm-lock.yaml, uv.lock). Never run `npx mcp-remote` without version pinning. Verify package integrity with `npm audit` or `pip-audit` before deployment. Reference: CVE-2025-6514, OWASP ASI04.
highD1Known CVEs in DependenciesMCP08-dependency-vuln
Dependency "@modelcontextprotocol/sdk@1.25.3" has known CVEs:
Update dependencies to versions that patch known CVEs. Run 'npm audit fix' or 'pip-audit' to identify and resolve vulnerable dependencies.
highK11Missing Server Integrity VerificationMCP10-supply-chainAML.T0054
Pattern "(connect|load|register|add)[_\s-]?(mcp|server|tool)(?!.*(?:verify|validate|checksum|hash|sign|cert|fingerprint|pin))" matched in source_code: "Register tool" (at position 603)
Implement cryptographic verification for MCP server connections: (1) Pin server TLS certificates or public keys, (2) Verify server tool definition checksums against a known-good manifest, (3) Use package manager integrity checks (npm integrity, pip --require-hashes). The MCP spec recommends but doesn't yet mandate server signing — implement it proactively. Required by ISO 27001 A.8.24 and CoSAI MCP-T6.
lowF4MCP Spec Non-ComplianceMCP07-insecure-config
Server fails MCP spec compliance checks: required:server_name; required:server_version; required:protocol_version; recommended:tool_descriptions; recommended:parameter_descriptions
Follow the MCP specification for server metadata. Include server name, version, and protocol version. Provide descriptions for all tools and parameters.
Security Category Deep Dive
Sub-Category Tree · Remediation Roadmap · Attack Stories · Compliance Overlay · ATLAS Techniques · Maturity Model
Prompt Injection
Prompt & context manipulation attacks
69
MATURITY
14
RULES
5
SUB-CATS
1
GAPS
64%
IMPL.
56
TESTS
1
STORIES
100%3 rules
Injection via tool descriptions and parameter fields
GAP-001Prompt Injection Coverage GapMissing detection coverage for emerging prompt injection attack variants not addressed by current rules
100%4 rules
Hidden instructions via external content and tool responses
100%2 rules
Context window saturation and prior-approval exploitation
100%3 rules
Payload hiding via invisible chars, base64, schema fields
100%2 rules
Injection via prompt templates and runtime tool output