Is @storybook/addon-mcp safe?

The component reads files from disk.

let previewStoryAppScript = await fs.readFile(

Why it matters: Usually legitimate, but worth confirming it can't be steered into reading sensitive files.

Fix: Confirm which files are read and that paths cannot be influenced by untrusted input to reach sensitive locations.

The component makes outbound network requests.

let response = await fetch(url2, { headers });

let response = await fetch(`${refUrl}/manifests/components.json`, {

let response = await fetch(`${refUrl}/mcp`, {

return (await fetch(`${origin2}/mcp`, {

let resourceMetadataUrl = match[1], resourceResponse = await fetch(resourceMetadataUrl);

let serverMetadataUrl = `${resourceResult.output.authorization_servers[0]}/.well-known/oauth-authorization-server`, serverResponse = await fetch(serverMetadataUrl);

let response = await fetch(

Why it matters: Usually legitimate, but confirm the destinations are expected and no sensitive data leaves.

Fix: Confirm the destination hosts are expected and that no sensitive data is sent off-host.

An OAuth 2.0 / OpenID Connect delegated-authentication flow was detected (authorization-code / refresh-token / token-exchange grant, an OIDC authorize/discovery endpoint or id_token, or a delegation library). Tools authenticate with the end user's delegated, scoped credentials rather than a long-lived embedded service credential.

authorization_endpoint: v2.string(),

Fix: Delegated auth is a lower-blast-radius execution context than an embedded static credential. Confirm the requested scopes are minimal and that tokens are never logged or forwarded off-host.

An MCP tool surface (manifest or tool definitions) was found.

return server = new McpServer(

Why it matters: Just context — review which tools it offers and their permissions.

Fix: Review the declared MCP tools and their permissions.