← Back to search

@cascivo/mcp

GitHub Actions Scanned 7d ago

MCP server exposing the cascivo component registry to AI agents

npm
C
64.2 / 100

Versions

0.6.2latest
Jul 26, 2026
0.6.1
Jul 25, 2026
0.6.0
Jul 23, 2026
0.5.2
Jul 23, 2026
0.5.1
Jul 20, 2026
+ show 13 moreshow less
0.5.0
Jul 17, 2026
0.4.1
Jul 15, 2026
0.3.5
Jul 14, 2026
0.3.4
Jul 13, 2026
0.3.3
Jul 12, 2026
0.2.0
Jun 30, 2026
0.1.8
Jun 25, 2026
0.1.6
Jun 23, 2026
0.1.5
Jun 23, 2026
0.1.4
Jun 22, 2026
0.1.2
Jun 21, 2026
0.1.1
Jun 19, 2026
0.1.0
Jun 17, 2026
PermissionsTool SafetyAuthAnnotationsCode QualityStabilitySpecVuln HistoryAuthorTransparencyCommunity

Tools 23

list_registries
annotations: none low

List available component registries: the cascade directory plus any configured via CASCADE_REGISTRIES env.

list_components
annotations: none low

List all cascade components, optionally filtered by category and/or type.

get_component
annotations: none low

Get the full manifest (props, states, tokens, a11y, examples) for one component.

name string
search_components
annotations: none low

Fuzzy search components by name, tags, or description.

query string
add_to_project
annotations: none low

Add a component to the current project by running the cascade CLI.

name string outputDir string
list_templates
annotations: none low

List marketplace templates (whole-page compositions) from the static catalog, optionally filtered by category, tag, framework, or verified status.

tag string category string verifiedOnly boolean
get_template
annotations: none low

Get one marketplace template by name or install spec — its components, install command, demo link, and screenshots.

name string
add_template
annotations: none low

Install a marketplace template (its components + page/fixture files) into the current project by running the cascade CLI.

cwd string name string
create_app
annotations: none low

Scaffold a complete, ready-to-run cascivo app (Vite + React + TypeScript) wired with the app shell, side navigation, header, and a theme — one page per nav section, with signal-driven section switching. Runs `cascivo create` as a child process, writing the project into a new <name> directory.

name string
create_theme
annotations: none low

Generate a cascade theme CSS file from three colors.

name string accent string neutral string primary string
scaffold_page
annotations: none low

[Deprecated — use scaffold_view instead] Generate a JSX page layout from a description.

components array description string
validate_view
annotations: none low

Validate a CascadeView JSON config against the registry. Returns errors with exact paths.

config record
scaffold_view
annotations: none low

Generate a valid starter ViewConfig from a description. Always validates before returning.

components array description string
scaffold_flow
annotations: none low

Generate a starter declarative <Flow nodes edges /> (from @cascivo/flow) for a node/edge diagram — flowchart, DAG, or pipeline. Returns serializable nodes/edges plus ready-to-paste JSX. Edit the labels/edges to match the intent.

description string
get_view_grammar
annotations: none low

Get the bound-vocabulary grammar + system prompt for generating valid ViewConfig JSON, derived from the component manifests. Use this to constrain an LLM to cascivo's real components, props, and enum values (anti-hallucination). Optionally scope to a subset of components.

get_tokens
annotations: none low

Get the cascade token catalog (closed set). Agents must select from this catalog rather than hard-coding values. Returns the CANONICAL token set by default — exactly one name per purpose. Pass includeAliases: true to also list backwards-compat aliases, each tagged with its canonical name.

search_icons
annotations: none low

Resolve an icon by intent. cascivo icon export names differ from Lucide/Radix (e.g. LayoutDashboard→Dashboard, Rocket→Spaceship), so guessing an import name wastes a compile. Pass a concept, a familiar foreign name, or an intent word ("deploy", "git branch") and get the matching @cascivo/icons exports ranked by relevance. Omit the query to list every icon name.

limit number
get_variant_matrix
annotations: none low

Get the deterministic token variant matrix: a map from design intent (a colour role + state slot, e.g. accent + hover) to the exact token name, plus every semantic/component token resolved to a concrete value in each theme. Use this to answer "what is the warm theme\'s accent-hover value?" or "which token is the active state of primary?" without guessing how layered theme CSS resolves.

validate_component
annotations: none low

Run cascivo's structural invariants over candidate component source (TSX and/or CSS) before writing it to disk. Catches banned React hooks, off-scale @media/@container breakpoints, missing static fallbacks for progressive CSS (@function/if()), and hallucinated --cascivo-* tokens. Use this to self-correct generated code in a loop until `valid` is true.

css string tsx string name string
list_guides
annotations: none low

List the cascivo concept guides available to get_guide (getting-started, theming, tokens, troubleshooting, …).

get_guide
annotations: none low

Get the full markdown of one cascivo concept guide by slug (e.g. "getting-started", "theming", "troubleshooting"). Use list_guides for the slugs.

slug string
get_context
annotations: none low

Get intent, whenToUse/whenNotToUse, and authoring guidance for one component by name.

name string
select_component
annotations: none low

Heuristic ranking of cascade components by natural language need. Returns top matches with scores and reasons. Note: heuristic ranking, not a model call.

need string

Permissions 4

network medium
Server uses network capabilities via: fetch()
filesystem low
Server uses filesystem capabilities via: fs, fs sync ops, fs/promises, path
shell high
Server uses shell capabilities via: child_process, execSync(), spawn(), spawnSync()
env_vars low
Server uses env_vars capabilities via: process.env

Scan Findings 77

low
Tool 'list_registries' has no annotations annotation_checker · 100%
low
Tool 'list_components' has no annotations annotation_checker · 100%
low
Tool 'get_component' has no annotations annotation_checker · 100%
low
Tool 'search_components' has no annotations annotation_checker · 100%
low
Tool 'add_to_project' has no annotations annotation_checker · 100%
low
Tool 'list_templates' has no annotations annotation_checker · 100%
low
Tool 'get_template' has no annotations annotation_checker · 100%
low
Tool 'add_template' has no annotations annotation_checker · 100%
low
Tool 'create_app' has no annotations annotation_checker · 100%
low
Tool 'create_theme' has no annotations annotation_checker · 100%
low
Tool 'scaffold_page' has no annotations annotation_checker · 100%
low
Tool 'validate_view' has no annotations annotation_checker · 100%
low
Tool 'scaffold_view' has no annotations annotation_checker · 100%
low
Tool 'scaffold_flow' has no annotations annotation_checker · 100%
low
Tool 'get_view_grammar' has no annotations annotation_checker · 100%
low
Tool 'get_tokens' has no annotations annotation_checker · 100%
low
Tool 'search_icons' has no annotations annotation_checker · 100%
low
Tool 'get_variant_matrix' has no annotations annotation_checker · 100%
low
Tool 'validate_component' has no annotations annotation_checker · 100%
low
Tool 'list_guides' has no annotations annotation_checker · 100%
low
Tool 'get_guide' has no annotations annotation_checker · 100%
low
Tool 'get_context' has no annotations annotation_checker · 100%
low
Tool 'select_component' has no annotations annotation_checker · 100%
medium
OAuth implementation without PKCE auth_checker · 75%
info
Sandbox failed to start for behavioral verification behavioral_verifier · 100%
medium
Excessive dependency count: 181 direct dependencies dependency_analyzer · 90%
medium
Suspicious package name: react-dom dependency_analyzer · 60%
medium
Vulnerable dependency: vite-plus@catalog: (GHSA-33r3-4whc-44c2) dependency_analyzer · 95%
medium
Vulnerable dependency: vite-plus@catalog: (GHSA-fx2h-pf6j-xcff) dependency_analyzer · 95%
medium
Vulnerable dependency: vite-plus@catalog: (GHSA-g8mr-85jm-7xhm) dependency_analyzer · 95%
medium
Vulnerable dependency: vite-plus@catalog: (GHSA-v6wh-96g9-6wx3) dependency_analyzer · 95%
medium
Vulnerable dependency: @modelcontextprotocol/sdk@catalog: (GHSA-w48q-cv73-mx4w) dependency_analyzer · 95%
medium
Vulnerable dependency: zod@catalog: (GHSA-m95q-7qp3-xv42) dependency_analyzer · 95%
medium
Vulnerable dependency: valibot@catalog: (GHSA-5qjj-4xww-7phc) dependency_analyzer · 95%
medium
Vulnerable dependency: vitest@catalog: (GHSA-5xrq-8626-4rwp) dependency_analyzer · 95%
medium
Vulnerable dependency: vitest@catalog: (GHSA-9crc-q9x8-hgqq) dependency_analyzer · 95%
medium
Vulnerable dependency: esbuild@catalog: (GHSA-67mh-4wv8-2f99) dependency_analyzer · 95%
medium
Vulnerable dependency: playwright@catalog: (GHSA-7mvr-c777-76hp) dependency_analyzer · 95%
medium
Vulnerable dependency: astro@7 (GHSA-4g3v-8h47-v7g6) dependency_analyzer · 95%
medium
Vulnerable dependency: astro@7 (GHSA-7pw4-f3q4-r2p2) dependency_analyzer · 95%
medium
Vulnerable dependency: astro@7 (GHSA-8mv7-9c27-98vc) dependency_analyzer · 95%
medium
Vulnerable dependency: astro@7 (GHSA-f48w-9m4c-m7f5) dependency_analyzer · 95%
info
Tool: get_view_grammar manifest_parser · 85%
info
package.json metadata manifest_parser · 100%
info
Tool: list_registries manifest_parser · 85%
info
Tool: list_components manifest_parser · 85%
info
Tool: get_component manifest_parser · 85%
info
Tool: search_components manifest_parser · 85%
info
Tool: add_to_project manifest_parser · 85%
info
Tool: list_templates manifest_parser · 85%
info
Tool: get_template manifest_parser · 85%
info
Tool: add_template manifest_parser · 85%
info
Tool: create_app manifest_parser · 85%
info
Tool: create_theme manifest_parser · 85%
info
Tool: scaffold_page manifest_parser · 85%
info
Tool: validate_view manifest_parser · 85%
info
Tool: scaffold_view manifest_parser · 85%
info
Tool: scaffold_flow manifest_parser · 85%
info
Tool: get_tokens manifest_parser · 85%
info
Tool: search_icons manifest_parser · 85%
info
Tool: get_variant_matrix manifest_parser · 85%
info
Tool: validate_component manifest_parser · 85%
info
Tool: list_guides manifest_parser · 85%
info
Tool: get_guide manifest_parser · 85%
info
Tool: get_context manifest_parser · 85%
info
Tool: select_component manifest_parser · 85%
info
Transport: stdio manifest_parser · 90%
info
Required env vars (34) manifest_parser · 80%
info
Sandbox failed to start for output poisoning scan output_poisoning · 100%
medium
Permission: network access detected permission_analyzer · 70%
low
Permission: filesystem access detected permission_analyzer · 90%
high
Permission: shell access detected permission_analyzer · 95%
low
Permission: env_vars access detected permission_analyzer · 90%
info
SBOM generated: 94 components sbom_generator · 100%
high
Hardcoded Password found in cascivo-cascivo-3139d5e/packages/layouts/src/blocks/login-page/login-page.tsx secret_scanner · 65%
high
Hardcoded Password found in cascivo-cascivo-3139d5e/apps/site/public/r/shadcn/block-login-page.json secret_scanner · 65%
medium
No build provenance detected (SLSA L0) slsa_assessor · 90%