@brandsystem/mcp v0.18.0 MIT · open source

Use your brand guidelines with AI

@brandsystem/mcp turns the brand material you already have — a website, PDF guide, Figma library, or local files — into a portable .brand/ runtime with design tokens, voice rules, provenance, and compliance checks. Local-first. No account required.

$ npx @brandsystem/mcp install --client claude-code --write
Runs locally over stdio. Works in any MCP client — pick yours below.
npm · v0.18.0, Trusted Publishing + provenance GitHub · MIT, source MCP Registry · io.github.Brandcode-Studio/brandsystem-mcp ✓ 1004/1004 tests · CodeQL · npm audit gate
01
Install

One command. Your client.

{{ jsonConfig }}
# {{ activeLabel }}
$ {{ activeCmd }}
install without --write is a dry run. Default is the 12-tool Core profile; add "--profile=full" for the full 40+ tool authoring surface.
No MCP? Generate brand-report.html and upload it to any AI chat.
02
Then ask
How do I use my brand guidelines with AI?
Install, then ask your agent this. It takes it from there.
Use my existing brand guidelines with AI. Start from this website/PDF/Figma library and show me what needs human confirmation.
Already have material? Start here instead.
03
How it works

Start from what you already have.

{{ ex.source }}
{{ ex.prompt }}
{{ ex.result }}
{{ ex.note }}
{{ s.num }}
{{ s.title }}
Four progressive sessions. Stop anywhere — every session leaves a usable runtime.
.brand/
brand-runtime.json — the portable runtime
tokens.json — DTCG design tokens
DESIGN.md — human-readable system
design-synthesis.json — radius, shadow, spacing, motion
interaction-policy.json — behavior rules
brand-report.html — shareable, uploadable anywhere
Two MCPs, one brand

The .brand/ runtime is the product.

The two MCPs author and serve it.

Build this package · open source
@brandsystem/mcp

Extracts, compiles, and audits your .brand/ runtime — locally, on your machine. One artifact. Every surface on brand.

Use pre-release
@brandcode/mcp

Serves a hosted runtime at mcp.brandcode.studio/{slug} — for remote clients and teams. Your brand, live in every AI tool.

04
Why trust it

Evidence, not claims.

{{ tr.title }}
{{ tr.body }}
05
Security & trust

Check our work.

Verifiable releases
Every release is published from GitHub Actions with npm provenance (SLSA v1). Verify your install with npm audit signatures. Since 0.18.0, each GitHub release also attaches a CycloneDX SBOM and SHA-256 checksums of the published package.
Data flows
Local-first. The package only contacts the sources you point it at, plus connector and feedback calls you opt into. DATA-FLOWS.md documents each one.
Report a vulnerability
Report privately through GitHub private vulnerability reporting. We aim to acknowledge new reports within two business days.
Advisory history
GHSA-j3rv-rv99-hg74: SSRF guard bypass via IPv4-mapped IPv6 addresses. Fixed in 0.17.0.
Approval provenance
Production approval is conferred only by Brandcode Studio and bound to the exact package it approved.
FAQ
{{ q.q }}
{{ q.a }}

First output is on-brand.

Present at creation, not policing it after.

Get Started