← Back to search

@unpunnyfuns/swatchbook-mcp

GitHub Actions Scanned 23d ago

Model Context Protocol server for swatchbook — exposes a DTCG project's tokens, axes, and diagnostics to AI agents without running Storybook.

C
62.2 / 100

Versions

No versions found.

PermissionsTool SafetyAuthAnnotationsCode QualityStabilitySpecVuln HistoryAuthorTransparencyCommunity

Tools 14

describe_project
annotations: none low

High-level summary of the project — total token count per theme, axes (with contexts) and how they compose, preset list, diagnostic counts by severity, css-var prefix, and the DTCG `$type`s present. Good first call for an agent that needs an orientation before querying specifics.

emit_css
annotations: none low

Return the full project CSS — a `:root` baseline + per-axis singleton cells (`[data-<prefix>-<axis>="<context>"]`) + compound joint-override blocks for tokens whose value at a multi-axis combination diverges from cascade composition + a trailing chrome alias block. Same output the addon injects into Storybook and the docs-site chrome pipeline writes to disk. Useful when an agent needs to inline the stylesheet into a generated artifact.

list_tokens
annotations: none low

List token paths in the project, optionally filtered by path glob (`color.*`, `color.palette.**`) and/or DTCG `$type` (color, dimension, typography, …). Returns path + $type + stringified value from the default theme. Use this first to discover what tokens exist; follow with get_token for details.

get_token
annotations: none low

Get full details for a single token: resolved value in every theme, DTCG `$type`, `$description`, `$deprecated` (message or `true` when the token is deprecated), an axis-variance summary (`kind` + the axes it flips across, present only when it varies — see `get_axis_variance` for the per-axis breakdown), alias chain, aliased-by list, and CSS var reference. Use after `list_tokens` to inspect a specific path.

path string
list_axes
annotations: none low

List the project axes — each axis has a name, its contexts (discrete values like `Light` / `Dark`), a default, and a source (`resolver` for DTCG-resolver-driven, `layered` for authored layered axes, `synthetic` for single-theme projects). Also returns the named themes (one per default tuple + per-axis non-default singleton + preset) and any presets defined in the project config.

get_alias_chain
annotations: none low

Forward alias chain for a token — the sequence of paths it resolves through on the way to a primitive value (e.g. `color.accent.bg → color.brand.blue.700 → color.palette.blue.700`). Returns the chain per theme because aliases can resolve through different paths per axis context. Empty chain when the token is a primitive (no aliases) or missing.

path string
get_aliased_by
annotations: none low

Backward alias tree for a token — every token that resolves through this path at any depth. Breadth-first walk with cycle protection; `maxDepth` caps recursion (default 6). Empty when nothing aliases the token.

path string
get_color_formats
annotations: none low

For a color token, return its value rendered in every format the addon toolbar exposes — `hex`, `rgb`, `hsl`, `oklch`, and the raw JSON. Each entry carries an `outOfGamut` flag when the chosen colorspace can't losslessly represent the token (wide-gamut tokens rendered in sRGB, for example). Skips non-color tokens.

path string
get_color_contrast
annotations: none low

Compute the contrast between two color tokens for a given theme. The score is returned under `value`: WCAG 2.1 returns the ratio (1–21) plus AA/AAA pass flags for normal + large text; APCA returns the signed Lc value plus body / large-text / non-text pass flags (absolute-value thresholds 75 / 60 / 45). Use this when reasoning about text legibility, focus-ring visibility, border contrast, etc., without having to reimplement the luminance math in the agent. Per-theme so the same pair can be checked against Light, Dark, High-contrast, etc.

theme string
get_axis_variance
annotations: none low

Classify how a token's resolved value depends on the project's axes. Returns `kind` — `constant` (same across every tuple), `single` (varies with exactly one axis, e.g. mode only), or `multi` (varies across two or more axes). Also returns `varyingAxes` / `constantAcrossAxes` plus a `perAxis` breakdown with each context's stringified value (holding other axes at their defaults). Use when reasoning about whether a token is theme-independent, whether a refactor changed an axis dependency, or to confirm that (say) a role token only varies with `contrast`.

path string
search_tokens
annotations: none low

Fuzzy search across token paths, `$description`, and stringified values. Case-insensitive, tolerates a single-character typo per term, and accepts out-of-order terms (`"blue palette"` finds `color.palette.blue.500`). Returns matches ranked by relevance with a short snippet pointing at where the match hit. Use when you know what you want but not the exact path. Scopes to a single theme (default: project default).

limit number query string
resolve_theme
annotations: none low

Resolve the full token map for a given axis tuple. Agent passes a partial tuple (`{ mode: "Dark", brand: "Brand A" }`); any axis omitted — or the whole `tuple` argument itself — falls back to that axis\'s default, so calling with no `tuple` resolves the project default theme. Returns the matching theme name, the complete tuple after filling defaults, and the resolved `{ path: { value, type, aliasOf?, aliasChain? } }` map — effectively "what do all tokens look like if I pin this combination".

type string filter string
get_css_usage
annotations: none low

CSS var reference + resolved value + HTML data-attribute activation for a token under an optional axis tuple. Tells an agent everything it needs to write a stylesheet or JSX snippet that pins a particular theme combination — `selector` is the compound CSS selector that matches the tuple on `<html>`, `attrs` is the same information as HTML attributes, `cssVar` is the `var(--…)` reference. Tuple defaults to the project default when omitted.

path string
get_diagnostics
annotations: none low

List parser / resolver / validation diagnostics for the project. Each entry carries a severity (`error`, `warn`, `info`), group, message, and optional filename / line / column for locating the issue.

Permissions 2

network medium
Server uses network capabilities via: fetch()
env_vars low
Server uses env_vars capabilities via: process.env

Scan Findings 45

low
Tool 'search_tokens' has no annotations annotation_checker · 100%
low
Tool 'describe_project' has no annotations annotation_checker · 100%
low
Tool 'emit_css' has no annotations annotation_checker · 100%
low
Tool 'list_tokens' has no annotations annotation_checker · 100%
low
Tool 'get_token' has no annotations annotation_checker · 100%
low
Tool 'list_axes' has no annotations annotation_checker · 100%
low
Tool 'get_alias_chain' has no annotations annotation_checker · 100%
low
Tool 'get_aliased_by' has no annotations annotation_checker · 100%
low
Tool 'get_color_formats' has no annotations annotation_checker · 100%
low
Tool 'get_color_contrast' has no annotations annotation_checker · 100%
low
Tool 'get_axis_variance' has no annotations annotation_checker · 100%
low
Tool 'resolve_theme' has no annotations annotation_checker · 100%
low
Tool 'get_css_usage' has no annotations annotation_checker · 100%
low
Tool 'get_diagnostics' has no annotations annotation_checker · 100%
medium
OAuth implementation without PKCE auth_checker · 75%
info
Sandbox failed to start for behavioral verification behavioral_verifier · 100%
medium
Suspicious package name: react-dom dependency_analyzer · 60%
medium
Vulnerable dependency: vite@8.0.4 (GHSA-4w7w-66w2-5vf9) dependency_analyzer · 95%
medium
Vulnerable dependency: vite@8.0.4 (GHSA-fx2h-pf6j-xcff) dependency_analyzer · 95%
medium
Vulnerable dependency: vite@8.0.4 (GHSA-p9ff-h696-f583) dependency_analyzer · 95%
medium
Vulnerable dependency: vite@8.0.4 (GHSA-v2wj-q39q-566r) dependency_analyzer · 95%
medium
Vulnerable dependency: vite@8.0.4 (GHSA-v6wh-96g9-6wx3) dependency_analyzer · 95%
info
package.json metadata manifest_parser · 100%
info
Tool: describe_project manifest_parser · 85%
info
Tool: emit_css manifest_parser · 85%
info
Tool: list_tokens manifest_parser · 85%
info
Tool: get_token manifest_parser · 85%
info
Tool: list_axes manifest_parser · 85%
info
Tool: get_alias_chain manifest_parser · 85%
info
Tool: get_aliased_by manifest_parser · 85%
info
Tool: get_color_formats manifest_parser · 85%
info
Tool: get_color_contrast manifest_parser · 85%
info
Tool: get_axis_variance manifest_parser · 85%
info
Tool: search_tokens manifest_parser · 85%
info
Tool: resolve_theme manifest_parser · 85%
info
Tool: get_css_usage manifest_parser · 85%
info
Tool: get_diagnostics manifest_parser · 85%
info
Transport: stdio manifest_parser · 90%
info
Required env vars (1) manifest_parser · 80%
info
Sandbox failed to start for output poisoning scan output_poisoning · 100%
medium
Permission: network access detected permission_analyzer · 70%
low
Permission: env_vars access detected permission_analyzer · 90%
critical
Tool poisoning in 'describe_project': Cross-tool prerequisite: 'first call/use' poisoning · 85%
info
SBOM generated: 64 components sbom_generator · 100%
medium
No build provenance detected (SLSA L0) slsa_assessor · 90%