← Back to search

@unpunnyfuns/swatchbook-mcp

GitHub Actions Scanned 24d ago

Model Context Protocol server for swatchbook — exposes a DTCG project's tokens, axes, and diagnostics to AI agents without running Storybook.

C
62.2 / 100

Versions

2.0.0latest
Jul 20, 2026
1.2.0
Jul 19, 2026
1.1.1
Jul 18, 2026
1.1.0
Jul 17, 2026
1.0.0
Jul 11, 2026
+ show 75 moreshow less
1.0.0-alpha.2
Jul 11, 2026
1.0.0-alpha.1
Jul 11, 2026
1.0.0-alpha.0
Jul 11, 2026
0.69.1
Jul 5, 2026
0.69.0
Jul 4, 2026
0.68.0
Jun 30, 2026
0.67.0
Jun 29, 2026
0.66.3
Jun 28, 2026
0.66.2
Jun 28, 2026
0.66.1
Jun 28, 2026
0.66.0
Jun 20, 2026
0.65.0
Jun 19, 2026
0.64.0
Jun 18, 2026
0.63.0
Jun 18, 2026
0.62.4
Jun 15, 2026
0.62.3
Jun 14, 2026
0.62.2
Jun 14, 2026
0.62.1
Jun 13, 2026
0.61.0
Jun 2, 2026
0.60.9
May 31, 2026
0.60.8
May 31, 2026
0.60.7
May 30, 2026
0.60.6
May 22, 2026
0.60.5
May 22, 2026
0.60.4
May 22, 2026
0.60.3
May 20, 2026
0.60.2
May 20, 2026
0.60.1
May 20, 2026
0.60.0
May 19, 2026
0.59.1
May 18, 2026
0.59.0
May 18, 2026
0.58.1
May 18, 2026
0.58.0
May 18, 2026
0.57.1
May 18, 2026
0.57.0
May 18, 2026
0.56.0
May 18, 2026
0.55.0
May 17, 2026
0.54.0
May 17, 2026
0.53.0
May 16, 2026
0.52.0
May 15, 2026
0.51.1
May 15, 2026
0.51.0
May 15, 2026
0.50.0
May 15, 2026
0.20.5
May 6, 2026
0.20.4
May 6, 2026
0.20.3
Apr 29, 2026
0.20.2
Apr 28, 2026
0.20.1
Apr 24, 2026
0.20.0
Apr 24, 2026
0.19.9
Apr 24, 2026
0.19.8
Apr 24, 2026
0.19.7
Apr 24, 2026
0.19.5
Apr 24, 2026
0.19.4
Apr 24, 2026
0.19.3
Apr 23, 2026
0.19.2
Apr 23, 2026
0.19.1
Apr 23, 2026
0.19.0
Apr 23, 2026
0.18.0
Apr 23, 2026
0.17.0
Apr 23, 2026
0.16.0
Apr 23, 2026
0.15.0
Apr 23, 2026
0.14.1
Apr 22, 2026
0.14.0
Apr 22, 2026
0.13.1
Apr 22, 2026
0.13.0
Apr 22, 2026
0.12.0
Apr 22, 2026
0.11.6
Apr 21, 2026
0.11.5
Apr 21, 2026
0.11.4
Apr 21, 2026
0.11.3
Apr 21, 2026
0.11.2
Apr 21, 2026
0.11.1
Apr 21, 2026
0.11.0
Apr 21, 2026
0.10.2
Apr 21, 2026
PermissionsTool SafetyAuthAnnotationsCode QualityStabilitySpecVuln HistoryAuthorTransparencyCommunity

Tools 14

describe_project
annotations: none low

High-level summary of the project — total token count per theme, axes (with contexts) and how they compose, preset list, diagnostic counts by severity, css-var prefix, and the DTCG `$type`s present. Good first call for an agent that needs an orientation before querying specifics.

emit_css
annotations: none low

Return the full project CSS — a `:root` baseline + per-axis singleton cells (`[data-<prefix>-<axis>="<context>"]`) + compound joint-override blocks for tokens whose value at a multi-axis combination diverges from cascade composition + a trailing chrome alias block. Same output the addon injects into Storybook and the docs-site chrome pipeline writes to disk. Useful when an agent needs to inline the stylesheet into a generated artifact.

list_tokens
annotations: none low

List token paths in the project, optionally filtered by path glob (`color.*`, `color.palette.**`) and/or DTCG `$type` (color, dimension, typography, …). Returns path + $type + stringified value from the default theme. Use this first to discover what tokens exist; follow with get_token for details.

get_token
annotations: none low

Get full details for a single token: resolved value in every theme, DTCG `$type`, `$description`, `$deprecated` (message or `true` when the token is deprecated), an axis-variance summary (`kind` + the axes it flips across, present only when it varies — see `get_axis_variance` for the per-axis breakdown), alias chain, aliased-by list, and CSS var reference. Use after `list_tokens` to inspect a specific path.

path string
list_axes
annotations: none low

List the project axes — each axis has a name, its contexts (discrete values like `Light` / `Dark`), a default, and a source (`resolver` for DTCG-resolver-driven, `layered` for authored layered axes, `synthetic` for single-theme projects). Also returns the named themes (one per default tuple + per-axis non-default singleton + preset) and any presets defined in the project config.

get_alias_chain
annotations: none low

Forward alias chain for a token — the sequence of paths it resolves through on the way to a primitive value (e.g. `color.accent.bg → color.brand.blue.700 → color.palette.blue.700`). Returns the chain per theme because aliases can resolve through different paths per axis context. Empty chain when the token is a primitive (no aliases) or missing.

path string
get_aliased_by
annotations: none low

Backward alias tree for a token — every token that resolves through this path at any depth. Breadth-first walk with cycle protection; `maxDepth` caps recursion (default 6). Empty when nothing aliases the token.

path string
get_color_formats
annotations: none low

For a color token, return its value rendered in every format the addon toolbar exposes — `hex`, `rgb`, `hsl`, `oklch`, and the raw JSON. Each entry carries an `outOfGamut` flag when the chosen colorspace can't losslessly represent the token (wide-gamut tokens rendered in sRGB, for example). Skips non-color tokens.

path string
get_color_contrast
annotations: none low

Compute the contrast between two color tokens for a given theme. The score is returned under `value`: WCAG 2.1 returns the ratio (1–21) plus AA/AAA pass flags for normal + large text; APCA returns the signed Lc value plus body / large-text / non-text pass flags (absolute-value thresholds 75 / 60 / 45). Use this when reasoning about text legibility, focus-ring visibility, border contrast, etc., without having to reimplement the luminance math in the agent. Per-theme so the same pair can be checked against Light, Dark, High-contrast, etc.

theme string
get_axis_variance
annotations: none low

Classify how a token's resolved value depends on the project's axes. Returns `kind` — `constant` (same across every tuple), `single` (varies with exactly one axis, e.g. mode only), or `multi` (varies across two or more axes). Also returns `varyingAxes` / `constantAcrossAxes` plus a `perAxis` breakdown with each context's stringified value (holding other axes at their defaults). Use when reasoning about whether a token is theme-independent, whether a refactor changed an axis dependency, or to confirm that (say) a role token only varies with `contrast`.

path string
search_tokens
annotations: none low

Fuzzy search across token paths, `$description`, and stringified values. Case-insensitive, tolerates a single-character typo per term, and accepts out-of-order terms (`"blue palette"` finds `color.palette.blue.500`). Returns matches ranked by relevance with a short snippet pointing at where the match hit. Use when you know what you want but not the exact path. Scopes to a single theme (default: project default).

limit number query string
resolve_theme
annotations: none low

Resolve the full token map for a given axis tuple. Agent passes a partial tuple (`{ mode: "Dark", brand: "Brand A" }`); any axis omitted — or the whole `tuple` argument itself — falls back to that axis\'s default, so calling with no `tuple` resolves the project default theme. Returns the matching theme name, the complete tuple after filling defaults, and the resolved `{ path: { value, type, aliasOf?, aliasChain? } }` map — effectively "what do all tokens look like if I pin this combination".

type string filter string
get_css_usage
annotations: none low

CSS var reference + resolved value + HTML data-attribute activation for a token under an optional axis tuple. Tells an agent everything it needs to write a stylesheet or JSX snippet that pins a particular theme combination — `selector` is the compound CSS selector that matches the tuple on `<html>`, `attrs` is the same information as HTML attributes, `cssVar` is the `var(--…)` reference. Tuple defaults to the project default when omitted.

path string
get_diagnostics
annotations: none low

List parser / resolver / validation diagnostics for the project. Each entry carries a severity (`error`, `warn`, `info`), group, message, and optional filename / line / column for locating the issue.

Permissions 2

network medium
Server uses network capabilities via: fetch()
env_vars low
Server uses env_vars capabilities via: process.env

Scan Findings 48

low
Tool 'describe_project' has no annotations annotation_checker · 100%
low
Tool 'emit_css' has no annotations annotation_checker · 100%
low
Tool 'list_tokens' has no annotations annotation_checker · 100%
low
Tool 'get_token' has no annotations annotation_checker · 100%
low
Tool 'list_axes' has no annotations annotation_checker · 100%
low
Tool 'get_alias_chain' has no annotations annotation_checker · 100%
low
Tool 'get_aliased_by' has no annotations annotation_checker · 100%
low
Tool 'get_color_formats' has no annotations annotation_checker · 100%
low
Tool 'get_color_contrast' has no annotations annotation_checker · 100%
low
Tool 'get_axis_variance' has no annotations annotation_checker · 100%
low
Tool 'search_tokens' has no annotations annotation_checker · 100%
low
Tool 'resolve_theme' has no annotations annotation_checker · 100%
low
Tool 'get_css_usage' has no annotations annotation_checker · 100%
low
Tool 'get_diagnostics' has no annotations annotation_checker · 100%
medium
OAuth implementation without PKCE auth_checker · 75%
info
Sandbox failed to start for behavioral verification behavioral_verifier · 100%
medium
Suspicious package name: react-dom dependency_analyzer · 60%
medium
Vulnerable dependency: vitest@4.1.10 (GHSA-82fw-gwwq-j7x9) dependency_analyzer · 95%
medium
Vulnerable dependency: astro@7.1.6 (GHSA-26w7-cxv4-gfx2) dependency_analyzer · 95%
medium
Vulnerable dependency: astro@7.1.6 (GHSA-376h-93r7-7g6f) dependency_analyzer · 95%
medium
Vulnerable dependency: vite@8.0.4 (GHSA-4w7w-66w2-5vf9) dependency_analyzer · 95%
medium
Vulnerable dependency: vite@8.0.4 (GHSA-fx2h-pf6j-xcff) dependency_analyzer · 95%
medium
Vulnerable dependency: vite@8.0.4 (GHSA-p9ff-h696-f583) dependency_analyzer · 95%
medium
Vulnerable dependency: vite@8.0.4 (GHSA-v2wj-q39q-566r) dependency_analyzer · 95%
medium
Vulnerable dependency: vite@8.0.4 (GHSA-v6wh-96g9-6wx3) dependency_analyzer · 95%
info
package.json metadata manifest_parser · 100%
info
Tool: describe_project manifest_parser · 85%
info
Tool: emit_css manifest_parser · 85%
info
Tool: list_tokens manifest_parser · 85%
info
Tool: get_token manifest_parser · 85%
info
Tool: list_axes manifest_parser · 85%
info
Tool: get_alias_chain manifest_parser · 85%
info
Tool: get_aliased_by manifest_parser · 85%
info
Tool: get_color_formats manifest_parser · 85%
info
Tool: get_color_contrast manifest_parser · 85%
info
Tool: get_axis_variance manifest_parser · 85%
info
Tool: search_tokens manifest_parser · 85%
info
Tool: resolve_theme manifest_parser · 85%
info
Tool: get_css_usage manifest_parser · 85%
info
Tool: get_diagnostics manifest_parser · 85%
info
Transport: stdio manifest_parser · 90%
info
Required env vars (1) manifest_parser · 80%
info
Sandbox failed to start for output poisoning scan output_poisoning · 100%
medium
Permission: network access detected permission_analyzer · 70%
low
Permission: env_vars access detected permission_analyzer · 90%
critical
Tool poisoning in 'describe_project': Cross-tool prerequisite: 'first call/use' poisoning · 85%
info
SBOM generated: 64 components sbom_generator · 100%
medium
No build provenance detected (SLSA L0) slsa_assessor · 90%