21st-dev — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited 21st-dev (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
21st.dev is the "npm for design engineers" — an open-source community registry (MIT) of high-quality React + Tailwind components, blocks, and hooks. It is shadcn-compatible: every component is installed with the standard npx shadcn@latest add CLI, just pointed at a 21st.dev URL.
npxcomponents.json, src/lib/utils.ts, src/components/ui/button.tsx, and shadcn theme tokens into globals.css)# Initialize shadcn — creates components.json, ui/, lib/utils.ts, theme tokens
cd <project-root>
npx --yes shadcn@latest init -d --force-d uses defaults (Next.js template, base-nova preset). --force overwrites any prior config.
Important — the init step rewrites `--background`, `--foreground`, `--primary`, `--accent` in `globals.css` to neutral oklch values. If your project already has brand colors mapped to those CSS variables (Weblyfe does — emerald + gold + snow), you must restore the brand mappings immediately after init:
:root {
/* Keep brand vars */
--brand-emerald: #247459;
--brand-gold: #DFB771;
--brand-snow: #F6FEFC;
/* ... */
/* Re-map shadcn slots to brand */
--background: var(--brand-snow);
--foreground: var(--brand-green-goblin);
--primary: var(--brand-emerald);
--accent: var(--brand-gold);
/* keep the rest of shadcn's tokens (card, popover, secondary, border, ring, etc.) */
}Also restore --font-sans if you use a custom font variable (shadcn replaces it with var(--font-sans)):
@theme inline {
--font-sans: var(--font-rethink), system-ui, sans-serif;
--font-heading: var(--font-rethink), system-ui, sans-serif;
}Browse https://21st.dev → pick a component → click "Code" / copy the install URL. Then:
npx --yes shadcn@latest add "https://21st.dev/r/<author>/<component>" --yesThe CLI:
src/components/ui/<component>.tsxglobals.css with any required @theme keyframes / variablesImport with the alias:
import { Marquee } from "@/components/ui/marquee";Browse the full registry at https://21st.dev. Here are the picks most relevant to the Appie hero + TIPS structure:
| Use case | Component | Registry path |
|---|---|---|
| Hero with animated avatar + gradient | magicui/animated-hero | https://21st.dev/r/magicui/animated-hero |
| Hero with text shimmer + spotlight | aceternity/spotlight | https://21st.dev/r/aceternity/spotlight |
| Sticky scroll narrative (the TIPS reveal) | aceternity/sticky-scroll-reveal | https://21st.dev/r/aceternity/sticky-scroll-reveal |
| Logo / partner marquee strip | magicui/marquee | https://21st.dev/r/magicui/marquee |
| Customer-case bento grid | aceternity/bento-grid | https://21st.dev/r/aceternity/bento-grid |
| 3D card hover (case-study cards) | aceternity/3d-card | https://21st.dev/r/aceternity/3d-card |
| Pricing tier cards | originui/pricing (search pricing-section) | https://21st.dev/community/components/s/pricing-section |
| Testimonial marquee | magicui/testimonial-marquee | https://21st.dev/r/magicui/testimonials |
| Animated FAQ accordion | kokonutui/faq-accordion | https://21st.dev/community/components/s/faq |
| Animated number counter (KPIs) | magicui/number-ticker | https://21st.dev/r/magicui/number-ticker |
| Globe / world-map (Bangkok ↔ NL trust) | magicui/globe | https://21st.dev/r/magicui/globe |
| Particle / dot background | magicui/particles | https://21st.dev/r/magicui/particles |
| Animated beam (network diagram) | magicui/animated-beam | https://21st.dev/r/magicui/animated-beam |
| Border beam glow effect | magicui/border-beam | https://21st.dev/r/magicui/border-beam |
Many authors publish multiple variants (e.g. magicui has hero-pill, hero-video-dialog, hero-section). Always preview on 21st.dev before installing.
/s/hero, /s/pricing, /s/testimonial)npx shadcn@latest add URLFor semantic search across the registry, the Magic Console (https://21st.dev/magic/console) offers free semantic component search and SVG icon search. Generation features (auto-creating bespoke variants) require the $20/month Pro plan but are not needed for installing existing components.
For prompt-driven component generation inside Claude Code:
npx --yes @21st-dev/cli@latest install claude --api-key <KEY>API keys come from https://21st.dev/magic/console. The MCP exposes /ui for prompt-to-component generation. This is not required — the free npx shadcn add <url> flow gives you every published component on the registry.
@theme inline and @custom-variant dark automatically.shadcn add, scan globals.css for newly-added --background / --primary overrides and re-map to brand vars if needed. The CLI usually only appends @theme rules and keyframes (safe), but init is the one to watch.src/components/ui/*.tsx and import via @/components/ui/* and @/lib/utils. Already set up in tsconfig.json..dark block. We currently do not use dark mode on <project-domain> — leave the block in place but do not toggle the class.Always verify a new install with a throwaway page before integrating into the homepage:
// src/app/labs/<component-name>/page.tsx
import { NewComponent } from "@/components/ui/new-component";
export default function Lab() {
return (
<main className="min-h-screen container py-24">
<NewComponent />
</main>
);
}Then npm run build to confirm it compiles end-to-end. Once verified, port the component into the real homepage section and delete the lab page (or keep /labs/* as a private gallery).
21st.dev itself is MIT. Individual components inherit each author's license — check the component page footer. Most are MIT/Apache and safe for commercial use. Aceternity UI, Magic UI, originui, kokonutui are all MIT.
dependencies block on the 21st.dev component page before installing — the CLI will pull them in silently.cn from @/lib/utils and your project uses a different alias, edit the import after install.~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.