get_install_command

This is the tool that makes the whole MCP setup pay off. The agent calls it, gets back a fully-formed shadcn add command (URL includes your token), emits it in the chat, and runs it in your shell. shadcn add hits /r/{name}.json?token=... directly — no further MCP roundtrip, no token-prompting, no copy-paste.

When to use

• The agent has picked a component and is ready to install.
• The user asks "install X" or "add X to my project".
• You want the agent to end a reasoning chain with an actionable shell command.

How it works

Pure formatter. The tool handler:

1. Reads the authenticated user's registryToken out of AsyncLocalStorage via requireContext().
2. URL-encodes the component name and token.
3. Builds https://www.shadcn.io/r/{name}.json?token={token}.
4. Prefixes the package-runner command for the requested client (npx, bun, pnpm, or yarn).
5. Returns the primary command + all four client variants so the agent can pick what's best for the user's project.

There's no registry lookup, no validation that the slug exists — that's deliberate. The agent should have already resolved the slug via get_item. This tool is pure text-assembly.

Source: lib/mcp/tools.ts#get_install_command + lib/mcp/install-command.ts.

The actual shadcn add execution hits /r/{name}.json on the server, which:

1. Rate-limits the request (registry limiter, 100/min/IP).
2. Validates the token against the DB (Redis-cached 5 min).
3. For premium items, checks effective Pro access (direct or workspace-owner inherited).
4. Returns the registry JSON with source inlined.
5. Fires a trackCodeAccess analytics event (fire-and-forget).

Arguments

Response

{
  "name": "pricing-grouped-comparison-table",
  "client": "npx",
  "command": "npx shadcn@latest add \"https://www.shadcn.io/r/pricing-grouped-comparison-table.json?token=<your-token>\"",
  "allClients": {
    "npx":  "npx shadcn@latest add \"https://www.shadcn.io/r/pricing-grouped-comparison-table.json?token=<your-token>\"",
    "bun":  "bunx --bun shadcn@latest add \"https://www.shadcn.io/r/pricing-grouped-comparison-table.json?token=<your-token>\"",
    "pnpm": "pnpm dlx shadcn@latest add \"https://www.shadcn.io/r/pricing-grouped-comparison-table.json?token=<your-token>\"",
    "yarn": "yarn dlx shadcn@latest add \"https://www.shadcn.io/r/pricing-grouped-comparison-table.json?token=<your-token>\""
  }
}

allClients is included on every response so the agent can pick based on a package-lock.json / bun.lock / pnpm-lock.yaml / yarn.lock it sees in your repo — no second tool call needed.

Example prompts

use shadcnio and install pricing-grouped-comparison-table into my project

use shadcnio to install hero-announcement using bun

use shadcnio to install every block I picked in the last step, one by one

Manual invocation

curl -s -X POST "https://www.shadcn.io/api/mcp?token=YOUR_TOKEN" \
  -H "content-type: application/json" \
  -d '{
    "jsonrpc": "2.0",
    "id": 1,
    "method": "tools/call",
    "params": {
      "name": "get_install_command",
      "arguments": {
        "name": "pricing-grouped-comparison-table",
        "client": "bun"
      }
    }
  }' | jq '.result.content[0].text | fromjson | .command' -r

Pipe into your shell:

$(curl -s ... | jq -r '.result.content[0].text | fromjson | .command')

Tips + gotchas

• The token in the URL IS your secret. Don't paste install commands into public chats, PR descriptions, or issue threads. If you do, rotate it: DB User.registryToken is free-form — replace it via Prisma and any cached Redis entry expires in 5 min (or flip isPro to force a webhook cache-bust).
• No slug validation. If the agent hallucinates a slug, this tool happily returns a command that will 404 at install time. Chain with get_item for validation if you care.
• Premium items require Pro at install time, not at MCP time. A non-Pro user (hypothetical — MCP is Pro-only so this shouldn't happen) getting a command for a premium item would see 403 from /r/* when running it. The URL itself is always returned.
• Package-manager choice hints. Claude Code often reads lockfiles to pick the client; you can also tell it explicitly ("use pnpm").
• The returned URL uses the public origin (https://www.shadcn.io/r/...). For self-hosted dev, you'd need to rewrite the origin manually — this is by design; the tool is meant to be run against the production registry.