This release includes 1 breaking change for platform teams planning a safe upgrade.
✓ No known CVEs patched in this version
Topics
+5 more
Affected surfaces
Summary
AI summaryAuth is no longer required in the critical path; device code authentication enables optional Studio activation.
Full changelog
The big change
Auth is no longer in the critical path. Extraction, preview, brand_check, and all local tools work without authentication. The first 10 minutes are zero-friction. Studio activation is the optional upgrade.
Added
- Device code authentication.
brand_brandcode_auth mode="activate"displays a short code (e.g.BRAND-7K4X) for the user to enter atbrandcode.studio/activate. The agent polls for completion. No JWT copy-paste. No leaving the session to hunt for tokens. Two tool calls, fully agent-driven.
Changed
- Auth deferred from happy path. Tool descriptions, prompts, recovery guidance, and status messages stop pushing Studio auth until the brand is extracted and the user wants persistence.
brand_brandcode_authnow leads withactivatemode and explicitly states auth is NOT needed for extraction or checking.
39 tools. 4 prompts. 2 resources. 395 tests.
Breaking Changes
- Removed requirement for authentication in the critical path of extraction, preview, brand_check, and all local tools.
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
About Brand-System/brandsystem-mcp
Make your brand machine-readable. Extract brand identity (colors, fonts, logo, voice, visual rules) from any website via static CSS + rendered-page extraction, compile into DTCG tokens, brand runtime contracts, and interaction policies. 34 tools across 4 progressive sessions. Subscribable `brand://runtime` and `brand://policy` MCP resources. Content compliance scoring (0-100), pass/fail gate, and HTML/CSS preflight. Brandcode Studio connector for hosted brand sync.
Beta — feedback welcome: [email protected]