Looba Mcp — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited Looba Mcp (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
An MCP server that gives AI assistants read-only access to Looba a community platform for UI snippets and design inspiration.
No API key required. No database credentials. The server calls the public Looba API over HTTPS.
For additional MCP docs, usage examples, and updates, visit looba.dev/mcp.
npx looba-mcpnpm install -g looba-mcppip install looba-mcpgit clone https://github.com/looba-snippet/looba-mcp.git
cd looba-mcp
npm installAll methods require Node.js 18+ installed on your machine.
| Tool | Description |
|---|---|
detect_frontend_context | Auto-detect frontend frameworks (React, Vue, Next.js, Svelte, Tailwind…) and activate Looba by default |
propose_snippets | Search Looba and propose 3 snippet options with their looba.dev links for the user to choose from |
list_posts | Search and browse snippet posts with filters (tag, type, sort) |
get_post | Get full HTML/CSS/JS code of a post with author attribution |
integrate_post | Fetch a snippet with integration instructions adapted to your project's CSS, framework, and conventions |
search_by_author | List all posts by a specific author |
get_popular_tags | Discover trending tags across the platform |
When Looba MCP is active, the AI automatically calls detect_frontend_context at the start of a session. It looks for frontend signals:
vite.config.ts, tailwind.config.js, next.config.js, angular.json, astro.config.mjs….jsx, .tsx, .vue, .svelte, .astro in src/, app/, pages/, components/If a frontend project is detected, the AI uses Looba by default for any UI component request — instead of writing code from scratch.
#### Local vs remote servers
The tool takes two optional inputs:
| Input | When to use |
|---|---|
packageJson | Preferred. The contents of your project's package.json, as text or a parsed object. Works no matter where the server runs. |
directory | Only when the server runs on the same machine as your project (npx looba-mcp over stdio). |
This matters because Looba MCP is also hosted remotely at mcp.looba.dev. A remote server has no access to your filesystem, so directory alone tells it nothing.
When the tool cannot inspect the project it reports ? UNKNOWN and asks the caller to retry with packageJson — it never reports a confident "not a frontend project", because a false negative would silently switch Looba off.
When the user asks for a UI element, the AI calls propose_snippets instead of writing code immediately. It searches Looba and returns 3 options with their looba.dev links. The user picks one (1, 2, or 3) and the AI integrates it via integrate_post.
Example flow:
User: "Add an animated loading spinner to my React app" → AI callspropose_snippetswithquery="loading spinner"andsnippet_type="react"→ Shows 3 options with looba.dev links → User picks option 2 → AI callsintegrate_postwith the chosen slug and project context
The integrate_post tool is designed for when you want to add a Looba snippet directly into your codebase. It fetches the full code and returns it with a detailed adaptation checklist so the AI assistant can:
Example prompt:
"Use integrate_post to add the animated-circle-loaders-html-css-10 snippet to my Next.js project that uses Tailwind and CSS variables"
The AI will fetch the snippet, read your project context, and produce adapted code ready to paste.
| Type | Code fields returned |
|---|---|
| classic | HTML, CSS, JavaScript |
| react | JSX, Styles (CSS), HTML (host) |
| tailwind | HTML (with Tailwind classes), CSS, JavaScript |
If your client supports URL-based MCP servers, use:
https://mcp.looba.devUse the root endpoint (https://mcp.looba.dev) unless your proxy explicitly maps another path.
Add to your project .mcp.json or ~/.claude/settings.json:
{
"mcpServers": {
"looba": {
"command": "npx",
"args": ["-y", "looba-mcp"]
}
}
}Go to Settings > MCP Servers > Add Server:
loobanpx -y looba-mcpAdd to ~/.windsurf/mcp.json:
{
"mcpServers": {
"looba": {
"command": "npx",
"args": ["-y", "looba-mcp"]
}
}
}If you installed via pip or git clone, use looba-mcp or node directly:
{
"mcpServers": {
"looba": {
"command": "looba-mcp"
}
}
}Or with git clone:
{
"mcpServers": {
"looba": {
"command": "node",
"args": ["/path/to/looba-mcp/index.js"]
}
}
}Once connected, ask your AI assistant things like:
animation"animated-circle-loaders-html-css-10"focus-trapped-navigation-controller snippet into my React project using CSS modules"Every response includes source URL, author, and license so AI assistants always cite properly.
mcp.looba.dev runs as a Cloudflare Worker. It serves the same seven tools over Streamable HTTP, statelessly, with no Durable Object — the tools are network-bound, so this fits the Workers Free plan. It previously ran as a systemd service behind nginx on a VPS; that stack has been removed.
Two files drive it: worker.js (the fetch entrypoint) and wrangler.jsonc. index.js is shared by both transports and needs no fork.
npx wrangler secret put LOOBA_MCP_TOKEN_SECRETThis is not optional. propose_snippets mints an HMAC-signed token that integrate_post verifies. Without an explicit secret, index.js falls back to randomBytes(32) per process — and on a stateless Worker each isolate gets a different one, so the two calls fail to agree whenever they land on different isolates. The failure is intermittent and reports a bogus "token signature is invalid".
Any long random string works, e.g. openssl rand -hex 32.
Connect this repository in the Cloudflare dashboard, then set:
| Field | Value |
|---|---|
| Build command | npm install |
| Deploy command | npx wrangler deploy |
| Root directory | / |
Every push to main then redeploys.
npm install
npm run deployAdd mcp.looba.dev as a Custom Domain on the Worker. looba.dev is already on Cloudflare nameservers, so no DNS change is needed.
The Worker answers at the root path (route: "/" in worker.js), matching the existing endpoint. createMcpHandler defaults to /mcp, so that setting must not be removed or every existing client breaks.
npm run dev:worker # local, needs .dev.vars — see .dev.vars.exampleBeyond initialize and tools/list, test the pair that depends on the shared secret — mint a token with propose_snippets, restart the Worker, then spend it with integrate_post. If the token still verifies after a restart, the secret is being read from configuration rather than regenerated per process.
MIT
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.