Phoenix LiveView component schemas from petal_components, exposed to AI coding assistants.
MCPpedia last refreshed this data
io.github.petalframework/petal-components-mcp is an MCP server that phoenix LiveView component schemas from petal_components, exposed to AI coding assistants. Its tool list has not been published yet, requires no API key, and scores 86/100 on MCPpedia's security, maintenance and efficiency rubric.
Config is the same across clients — only the file and path differ.
{
"mcpServers": {
"io-github-petalframework-petal-components-mcp": {
"args": [
"-y",
"npm"
],
"command": "npx"
}
}
}Are you the author?
Add this badge to your README to show your security score and help users find safe servers.
An MCP server that exposes petal_components — the Shadcn-style component library for Phoenix LiveView — to AI coding assistants (Claude Code, Cursor, Windsurf, etc).
Run this in your terminal to verify the server starts. Then let us know if it worked — your result helps other developers.
npx -y 'npm' 2>&1 | head -1 && echo "✓ Server started successfully"
After testing, let us know if it worked:
Five weighted categories — click any category to see the underlying evidence.
Packing does not respect root-level ignore files in workspaces
### Impact `npm pack` ignores root-level `.gitignore` & `.npmignore` file exclusion directives when run in a workspace or with a workspace flag (ie. `--workspaces`, `--workspace=<name>`). Anyone who has run `npm pack` or `npm publish` with workspaces, as of [v7.9.0](https://github.com/npm/cli/releases/tag/v7.9.0) & [v7.13.0](https://github.com/npm/cli/releases/tag/v7.13.0) respectively, may be affected and have published files into the npm registry they did not intend to include. ### Patch - Up
Incorrect Permission Assignment for Critical Resource in NPM
An issue was discovered in an npm 5.7.0 2018-02-21 pre-release (marked as "next: 5.7.0" and therefore automatically installed by an "npm upgrade -g npm" command, and also announced in the vendor's blog without mention of pre-release status). It might allow local users to bypass intended filesystem access restrictions because ownerships of /etc and /usr directories are being changed unexpectedly, related to a "correctMkdir" issue.
Local Privilege Escalation in npm
Affected versions of `npm` use predictable temporary file names during archive unpacking. If an attacker can create a symbolic link at the location of one of these temporary file names, the attacker can arbitrarily write to any file that the user which owns the `npm` process has permission to write to, potentially resulting in local privilege escalation. ## Recommendation Update to version 1.3.3 or later.
npm CLI exposing sensitive information through logs
Versions of the npm CLI prior to 6.14.6 are vulnerable to an information exposure vulnerability through log files. The CLI supports URLs like `<protocol>://[<user>[:<password>]@]<hostname>[:<port>][:][/]<path>`. The password value is not redacted and is printed to stdout and also to any generated log files.
npm Vulnerable to Global node_modules Binary Overwrite
Versions of the npm CLI prior to 6.13.4 are vulnerable to a Global node_modules Binary Overwrite. It fails to prevent existing globally-installed binaries to be overwritten by other package installations. For example, if a package was installed globally and created a `serve` binary, any subsequent installs of packages that also create a `serve` binary would overwrite the first binary. This will not overwrite system binaries but only binaries put into the global node_modules directory. This b
Click any tool to inspect its schema.
Be the first to review
Have you used this server?
Share your experience — it helps other developers decide.
Sign in to write a review.
Others in other
Compress tool outputs, logs, files, and RAG chunks before they reach the LLM. 60-95% fewer tokens, same answers. Library, proxy, MCP server.
Transport for TMCP using STDIO
The graph based agentic IDE
Buddhist canon tools: search, passages, cross-canon parallels, dictionaries — all URN-cited.
MCP Security Weekly
Get CVE alerts and security updates for io.github.petalframework/petal-components-mcp and similar servers.
Start a conversation
Ask a question, share a tip, or report an issue.
Sign in to join the discussion.
An MCP server that exposes petal_components — the Shadcn-style component library for Phoenix LiveView — to AI coding assistants (Claude Code, Cursor, Windsurf, etc).
Without this, AI agents writing HEEx invent raw Tailwind soup and never reach for pc_* components. With it, the AI gets the full schema for every component on demand — attrs, slots, defaults, allowed values, usage examples — and writes idiomatic petal_components markup by default.
claude mcp add petal --transport http https://mcp.petal.build
Then in any Phoenix project, ask the AI to build something. It'll call list_components and get_component to ground its output in real petal_components schemas.
list_components — every component in the library with a one-line summaryget_component — full schema (attrs, slots, defaults, values, docs) + HEEx usage exampleComing soon: search_components (natural-language match) and generate_pattern (composed blocks like form-in-card, modal-with-form, dashboard skeletons).
The MCP server is a thin TypeScript service that bundles a JSON snapshot of every component in petal_components. The JSON is generated by a Mix task that introspects Phoenix.Component.__components__/0 on every loaded PetalComponents.* module — so the schemas are always in sync with the actual library, no manual duplication.
petal_components (Hex) petal-components-mcp (this repo)
│ │
│ mix run extract_schemas.exs │
│─────────────────────────────────────► src/schemas.json
│
│ tsc
▼
dist/server.js ◄── deployed to Fly
# Regenerate schemas from the latest petal_components on Hex
npm run extract # cd scripts/extract && mix deps.get && mix run extract_schemas.exs
# Build and serve
npm install
npm run build
PORT=8765 npm start
# Health check
curl http://localhost:8765/healthz
The extraction is self-contained — scripts/extract/ is a tiny Mix project that pulls petal_components from Hex, introspects every Phoenix.Component.__components__/0, and writes src/schemas.json. No need for a local petal_components clone.
To use a local server with Claude Code:
claude mcp add petal-local --transport http http://localhost:8765/mcp
The MCP server is hosted at mcp.petal.build on Fly.io as a standalone app.
# 1. Create the app (one-time, requires Fly auth)
fly apps create petal-components-mcp
# 2. Deploy
fly deploy --remote-only
# 3. Add the custom domain
fly certs add mcp.petal.build
After step 3, Fly prints the DNS records you need. Add a CNAME at the petal.build DNS provider:
mcp.petal.build CNAME petal-components-mcp.fly.dev
Then fly certs check mcp.petal.build will go green once propagation hits.
fly deploy --remote-only
# 1. Regenerate schemas from the latest petal_components on Hex
npm run extract
# 2. Eyeball the diff (catches surprises before they ship to AI agents worldwide)
git diff src/schemas.json | head -50
# 3. Commit and deploy
git add src/schemas.json
git commit -m "chore: sync schemas with petal_components vX.Y.Z"
git push
fly deploy --remote-only
The /healthz endpoint reports the bundled version, so you can confirm a deploy went out:
curl https://mcp.petal.build/healthz
# {"ok":true,"petal_components_version":"3.2.0","components":79,...}
This is the artifact for bet 002 — testing whether AI coding assistants become the d