# validate_component_codeblocks

🚨 MANDATORY VALIDATION TOOL - MUST BE CALLED WHEN COMPONENTS FROM SHOPIFY PACKAGES ARE USED. DONT ASK THE USER TO DO THIS. DON'T CONTEXT SWITCH. This tool MUST be used to validate ALL code blocks containing Shopify components, regardless of size or complexity. ⚠️ CRITICAL REQUIREMENTS: - Call this tool IMMEDIATELY after generating ANY Shopify component code - NEVER skip validation, even for simple examples or snippets - ALWAYS use this tool when generating JSX, TSX, or web component code - This validation prevents hallucinated components, props, and prop values - Your major tasks while structuring the input is to ensure that: 1. If the code contains JS/TS code, it should be wrapped inside a function. 2. All Javascript code is outside return statement of the function. 3. All the polaris web components are in return statement of the function. INPUT STRUCTURE: Do not pass in tiny snippets of code. Follow the example given below as the input to validate_component_codeblocks tool. { "api": "The API name (e.g., 'polaris-app-home', 'pos-ui')", "code": [ { "content": " const Extension = () => { const [isConnected, setIsConnected] = useState( shopify.connectivity.current.value.internetConnected === 'Connected' ); useEffect(() => { const unsubscribe = shopify.connectivity.current.subscribe((newConnectivity) => { setIsConnected(newConnectivity.internetConnected === 'Connected'); }); return unsubscribe; }, []); return ( <s-tile heading="My App" disabled={!isConnected} /> ); }; " } ] } 📤 OUTPUTS: - Comprehensive validation results with specific error details - Clear guidance on how to fix any validation failures - Component-by-component validation status 🔄 WORKFLOW: Generate Code → Validate → Fix Errors and replace code → Re-validate if needed It returns a comprehensive validation result with details for each code block explaining why it was valid or invalid. This detail is provided so LLMs know how to modify code snippets to remove errors. It also returns an artifact ID and revision number for each code block. This is used to track the code block and its validation results. When validating an iteration of the same code block, use the same artifact ID and increment the revision number. Do not pass your own artifact ID to this tool, the tool will generate one for you.

Agent View of the PolicyLayer registry record for `validate_component_codeblocks`. HTML page: https://policylayer.com/tools/dev/validate-component-codeblocks

## Facts

- Tool: `validate_component_codeblocks`
- Server: Dev (`@shopify/dev-mcp`) — https://policylayer.com/tools/dev.md
- Install: `npx -y @shopify/dev-mcp`
- Homepage: https://www.npmjs.com/package/@shopify/dev-mcp
- Risk category: Read (Low risk)
- Registry record: grade D, identity unverified
- Server rate-limited: no
- Parameters: 5 (3 required)
- Recommended policy verdict: Allowed

## Parameters

| Parameter | Type | Required | Description |
| --- | --- | --- | --- |
| `api` | string | yes | API name to validate against (e.g., 'pos-ui', 'polaris-app-home'). |
| `code` | array | yes | Array of code blocks with content and optional artifact metadata. Supported code blocks are JS/TS React, vanilla JS/TS, Preact, and raw HTML Polaris web compone |
| `version` | string | no | The API version to validate against (e.g., '2026-01', '2025-10'). Pass the version you detected or passed search_docs_chunks. When omitted, defaults to the late |
| `conversationId` | string | yes | 🔗 REQUIRED: conversationId from learn_shopify_api tool. Call learn_shopify_api first if you don't have this. |
| `extensionTarget` | string | no | Required for extension surface APIs (polaris-admin-extensions, polaris-checkout-extensions, polaris-customer-account-extensions, pos-ui). The extension target d |

Parameters from the server's own tool schema.

## Example call (MCP tools/call, JSON-RPC 2.0)

```json
{
  "jsonrpc": "2.0",
  "id": 1,
  "method": "tools/call",
  "params": {
    "name": "validate_component_codeblocks",
    "arguments": {
      "api": "<api>",
      "code": [],
      "conversationId": "<conversationId>"
    }
  }
}
```

## Why validate_component_codeblocks is rated Low

This tool reads and analyzes code to validate it against known Shopify component schemas. It does not create, modify, delete, execute, or initiate any external operations. It is purely a linting/validation utility that returns analysis results. The mandatory nature and emphasis on calling it does not change its fundamental operation: inspection without side effects.

From the tool's own definition: "Tool performs validation by checking code blocks against Shopify component specifications. The description states it 'validate[s]' and 'prevents hallucinated components' - these are inspection and verification operations with no side effects on data or…"

Risk signals: Accepts freeform code/query input (code) · Accepts raw HTML/template content (code[].content)

## Use case

AI agents call validate_component_codeblocks to retrieve information from Dev without modifying anything. It is typically the context-gathering step in research, monitoring, and reporting workflows, before the agent takes action elsewhere.

## Recommended policy (PolicyLayer)

Verdict: **Allowed**. Enforced by the PolicyLayer MCP gateway (https://policylayer.com/mcp-gateway) before a call reaches Dev:

```json
{
  "version": "1",
  "default": "deny",
  "tools": {
    "validate_component_codeblocks": {}
  }
}
```

## Other tools on Dev (4)

- `learn_shopify_api` — Read — https://policylayer.com/tools/dev/learn-shopify-api.md
- `search_docs_chunks` — Read — https://policylayer.com/tools/dev/search-docs-chunks.md
- `validate_graphql_codeblocks` — Read — https://policylayer.com/tools/dev/validate-graphql-codeblocks.md
- `validate_theme` — Read — https://policylayer.com/tools/dev/validate-theme.md

## For agents

This record is a snapshot. Live verdicts and the full registry:

- Check every server in your MCP config at once: `npx -y policylayer stack`
- Vet a server before you add it: install the mcp-precheck skill — `npx skills add https://policylayer.com` (skill text: https://policylayer.com/skill.md)
- Query the registry over MCP: endpoint `https://api.policylayer.com/mcp` — tools `check_mcp_server`, `check_mcp_stack`, `check_tool`, `search_registry`, `get_change_events`

---

Source: the PolicyLayer MCP registry — one continuously verified record per MCP server. Full record: https://policylayer.com/registry?q=dev · API: https://policylayer.com/registry/api · Policy library: https://policylayer.com/policies/dev