Everythingwe’re shipping.

The Grab overlay accepts image attachments dropped or pasted into the composer: PNG, JPEG, WebP, GIF, SVG, and AVIF files up to 25 MiB each, with up to four per send. It also accepts an absolute image path. The bridge stores attachments under ~/.raven/grab-inbox (RAVEN_GRAB_INBOX overrides the location) and prunes inboxes older than seven days when a session starts. Each selection carries an imageTarget block with its kind (img, picture, background, svg, or video-poster), currentSrc, srcset, sources, natural and rendered size, and object-fit. get_grabbed_elements returns attachments[] with absolute paths and imageTarget; agent_protocol tells the agent how to apply a replacement. The bridge adds POST /attachment for multipart uploads or a JSON path. Attachments are available through the bridge only; hosted endpoints refuse them.

Path attachments receive thumbnail previews through GET /attachment; background imageTarget values report backgroundHasUrl to distinguish gradients from URL-backed images.

The attachment path route reads without following a symlink at the final path component.

Attachment records preserve the supplied original filename in record.name, including non-ASCII characters.

Pasted attachment paths accept matching surrounding quotes, shell-escaped characters, and a leading ~/.

An attachment-only draft on the same page resumes in the composer after a reload, with its thumbnails fetched again from the bridge.

GET /attachment streams the file from an open descriptor instead of buffering it; the overlay fetches each thumbnail once into a blob: URL, and the pending-changes memo in sessionStorage no longer holds the bridge capability key, inbox paths, source paths or hashes.

Identical attachment bytes dedupe to one inbox file only when the stored filename also matches.

The attachment path route resolves the parent directory before opening the file, so a symlinked parent is refused before any read.

Every tool now states all four MCP annotation hints explicitly — readOnlyHint, destructiveHint, idempotentHint and openWorldHint — with no value left to a spec default. A consumer that reads annotations as a flat capability record sees an omitted hint as unanswered rather than as the documented default, so each one is answered outright and each answer is derived from what the handler actually does.

Two of those answers are new statements rather than restatements. idempotentHint is a per-tool table whose default is false: a tool that mints an id, appends to a log, drains a queue, or applies a relative change is not idempotent, while one that writes a value the caller supplied or removes something by name is. Under-claiming costs a client a retry it chose not to make; over-claiming is an annotation that does not match behaviour, which is the thing this table exists to prevent. And openWorldHint is now derived per build instead of read from one fixed list — audit_page, score_page and audit_typography reach the open web only through a url argument, and the hosted endpoint rejects that argument before the handler runs, so on mcp.ravenmcp.ai they are published closed-world because they are closed-world there. The remote answer reads the guard table itself rather than being written out a second time, so lifting a guard moves the annotation in the same edit.

audit_url is published as neither read-only nor idempotent. It accepts a caller-supplied interaction list and drives a real browser against a third-party page; Playwright's hover and focus dispatch genuine events, so the page runs its own handlers and can change state on a host the caller does not own. destructiveHint follows from the same fact that makes readOnlyHint false.

On the hosted endpoint, click interactions are refused outright — a click can submit a form, place an order, or delete a record on somebody else's site, which is a blast radius worth refusing on an endpoint anyone can call anonymously. Hover and focus still run, because the hover white-wash detection the tool exists for is built on them. The hosted tool description says so. Local stdio is unchanged: a local caller drives their own pages deliberately.

audit_url reports coverage, not just a count. A viewport × theme combination that fails to render is dropped with a warning, so the number of captures alone never told a caller how much of what they asked for actually happened. The result now carries coverage: { requested, succeeded, complete }, and a partial run leads its summary with PARTIAL COVERAGE naming both numbers. Compact mode keeps the field — dropping it there would reinstate the exact claim it exists to correct.

Empty input is refused instead of scored. Thirteen tools computed a grade from a denominator that is zero when the input is empty, which manufactured affirmative results about work nobody did — 100/A on an empty accessibility snapshot, 77/C on blank markup, 70/C on blank creative copy. compose_system, audit_page, audit_ios_a11y, audit_contrast, audit_screen, audit_ios_screen, audit_swiftui, audit_rn, score_creative, generate_service_blueprint, generate_design_system, audit_video_playback and audit_tap_targets now return an error naming what was missing and what to pass instead. Whitespace counts as empty: a source field holding only spaces and newlines was measured at 100/A. A schema can say a field is present; it cannot say there is anything in it.

base_system with a token group that matches nothing now fails instead of returning an empty system. The $-prefixed metadata keys always pass through, so an unmatched group previously produced an object holding only $name and $description — a wrong result reported as correct. The rule lives in the one function both call sites share.

audit_contrast no longer reports browser backpressure as a missing browser. When the hosted concurrency slot times out, the underlying "capacity busy — retry shortly" is passed through unchanged rather than being rewritten into "Playwright chromium not available". That message was false on a host where chromium is present and working, unactionable, and — because it appeared only under load — read as an intermittent wrong result rather than as something to retry.

The list_creative_models documentation described a runner-routing behaviour the tool does not have; it now describes what the tool returns.

design_gauntlet puts your page next to a reference and measures the gap. It scores both on the same dimensions and returns the differences a side-by-side glance produces but cannot name: type scale sprawl, family budget, accent overuse, radius vocabulary, elevation strategy, rhythm and tracking.

It reports where you sit against the reference, not against an absolute. A dimension only fires when the reference does something your page does not, so a deliberately plain page is not marked down for being plain.

Sub-pixel borders are read from the authored CSS rather than the render. The engine rounds any non-zero border width up to 1px at every device scale, so a page authored with 0.5px hairlines would otherwise report a vocabulary it does not have. Where the authored value cannot be resolved, the report says so instead of guessing.

Borders are read on all four edges, and device_scale_factor is validated rather than clamped, so a measurement is never quietly taken at a scale you did not ask for.

Add to queue now sits beside the instruction microphone. It banks the current style and instruction draft before an in-page slide, tab or route change can remove the selected element, including drafts already snapshotted from a detached element.

The confirmation appears once, remains visibly painted, and moves to a reachable live region when a panel is collapsed. Removing queued work clears the confirmation only when that work is actually gone.

Fresh generated design systems start with one H1 and three descending text styles: 32px/700, 20px/600, 16px/500 and 14px/400. The pairs carry through DTCG, HTML, Figma variables and saved systems; an inherited base system keeps its own typography.

Restored queue entries use a separate key namespace so they cannot collide with the first live draft after reload. Generated typography HTML also escapes font-family values before placing them in style attributes.

The homepage now uses Untitled Sans throughout, keeps responsive H2 section titles as its only bold subordinate tier, removes eyebrow treatments and tool-category numbers, gives all twelve design-system tiles one resting color without changing their hover response, and enumerates the full 110-tool package in the homepage and docs catalog.

capture_reference stores a pattern you grabbed from a page — its markup, its computed styles, and where it came from — and renders a thumbnail with every outbound request blocked, so it never calls back to the site it was taken from. A style map is the right thing to store and the wrong thing to show a person. The picture is best effort and is rendered after the record is saved: a machine without a browser costs you the thumbnail, never the capture.

search_references finds a stored pattern by what it does, not what it was called. Markup is left out of a browse and returned only when you ask for it: looking through the corpus is looking, not copying.

map_reference_to_tokens translates a stored pattern’s values into your own design system — the token name, its value, and the CSS custom property, so what comes back is buildable rather than a list of names.

forget_references removes what you captured, by site or by id. The preview is computed by the same rule the removal uses; pass expected_ref_ids to pin the exact set you were shown, and anything captured between the preview and the removal is reported rather than swept up. A sweep that cannot resolve a site says so, and anything it could not remove is reported instead of reported clean.

generate_mood_board composes your notes, your references and your own images into one self-contained board, plus a PNG of it where one can be rendered. It names the next step and stops there rather than running it.

generate_design_system can now save what it generates. The id then works anywhere a bundled id works — base_system, get_design_system, list_design_systems, init_design_md.

A Grab session proxying localhost, 127.0.0.1 or [::1] keeps authoring; any other site stays capture-only, and the overlay now says which it is. Typing in a Grab panel no longer reaches the page underneath it, a pending draft survives moving between slides, tabs or routes without a page load, and the panel’s text fields take dictation.

The stdio surface goes from 105 tools to 110. The anonymous hosted endpoint still serves the same 45.

Point Raven at a project’s DESIGN.md and diff it against the canonical baseline: what is missing, what has drifted, what is local-only. configure_design_system_source names the file once, inventory_design_system reads its components and tokens, list_design_system_components shows the baseline, and diff_design_system does the comparison.

decision_contest stops an active decision from governing immediately, without deleting it or naming a replacement. Retiring a decision previously meant either superseding it — which demands a replacement you may not have yet — or deleting it and losing the history.

audit_tap_targets now names the standard it graded against. On a non-mobile render, 44px is the WCAG 2.5.5 AAA enhanced target while the AA minimum is 24px, so the audit states the split instead of leaving you to guess which one a finding failed. No finding changes pass or fail.

The stdio surface goes from 100 tools to 105. The anonymous hosted endpoint still serves the same 45.

Annotations now state read-only, destructive, and open-world on every tool instead of omitting the one the spec calls inapplicable. Nothing about what a tool does changed — clients and directories that read annotations as a flat record no longer see a blank where an answer belongs.

The registry description was 175 characters against a 100-character cap, which failed validation before a publish could begin. It is now a 98-character summary.

The .mcpb bundle is built into the apex as well as site/, so the public download at ravenmcp.ai no longer lags a release.

No tool changes — the 100-tool surface is unchanged.

All 100 tools carry MCP annotations — a readable title plus read-only, destructive, and open-world hints. 70 read, 30 write local or hosted state, and 11 drive a browser or fetch against a URL you supply, so a client can show the consequence before the call.

An audit against an unreachable host, a wrong port, or an auth wall used to return “0 findings” — indistinguishable from a clean page. It now says the audit did not run.

The registry’s remote URL pointed at a path that 404s; it is mcp.ravenmcp.ai/api/mcp. The bundle manifest also declares the correct license and links the privacy policy.

No tool changes — the 100-tool stdio surface is unchanged.

Clicking a decorative video or icon image on the canvas now expands its ancestors and highlights its row in the Layers tree — previously aria-hidden media had no layers row at all, so selection looked like it silently failed.

Zero-size aria-hidden nodes (accessibility plumbing) stay out of the tree; only media that actually renders gets a row.

No tool changes — the 100-tool stdio surface is unchanged.

Clicking an element on the page selects its row in the Raven Design layers tree and expands every parent above it.

The tree used to stop building at the first branch nested deeper than twelve levels, so most of a real page was missing from it and a click below that point had nothing to reveal. Deep branches are now trimmed on their own.

Dragging a layer next to a non-visual sibling — a <template>, <noscript>, JSON-LD script, or empty aria-hidden node — no longer produces a move the bridge rejects.

No tool changes — the 100-tool surface is unchanged.

Capturing a page that animates continuously and never goes network-idle could wait forever with no error — it now aborts after 90 seconds and says why.

Affects anything that renders a live URL: audit_url, audit_taste in url mode, and the reference sites captured by bind_taste_surface.

Pass overall_timeout_ms to raise the ceiling for a page worth waiting on.

No tool changes — the 100-tool surface is unchanged.

Serving your dev server through the bridge's proxy mode no longer breaks it — WebSocket upgrades are passed straight through, so hot reload keeps working.

On Next.js 16 the dropped socket also stopped the page hydrating, leaving the proxied app blank with no error to go on. That case is fixed.

No tool changes — the 100-tool surface is unchanged.

Drag a row in the layers tree and the real element moves on the page immediately, the way browser devtools does — no waiting on the agent to see the result.

The move is still a pending change: the tray carries the intent and your agent's source edit remains what ships.

Discarding a move restores the page exactly, including scripts and styles that sat between the siblings you moved.

Moving the same element twice before sending measures from the real pre-move state, and a page that re-renders underneath a pending move is left alone.

Queue edits across several pages and each is restored as a pending change on the next page — send a whole batch to your agent at once instead of losing them on a page load.

Send stays available while a batch is applying; a press queues the next batch to send automatically when the current one finishes.

Single-click Send now works with any field focused, not just inline copy edits.

Inline copy editing: change an element's text right on the page and send it to your agent alongside style and token edits.

Instructions and copy edits now persist as you move between elements, so you can stack many changes and send them in one batch.

Sending an inline copy edit takes a single click.

Raven is now licensed under the Apache License, Version 2.0 — still permissive and free, with an added explicit patent grant and trademark clause.

Nothing changes for how you use Raven. Versions published before this stay under MIT; this and later releases are Apache 2.0.

New `audit` tool: point it at a web page, iOS screen, React Native source, a code diff, or a video, and it runs the audits that fit and returns a single merged report.

You no longer need to know which of the individual audit tools applies — the granular tools are still there when you want a targeted run.

review_diff gains an opt-in fail_on policy: name the rules that should block a merge — important, bare-hex-color, hardcoded-font-size, hardcoded-font-family, hardcoded-spacing — and matching violations on newly added lines turn the verdict to fail.

It combines with fail_on_governed (escalate findings a recorded decision governs); both echo back under one severity_policy so CI can see exactly what was enforced.

Advisory by default — leave the policy off and review_diff behaves exactly as before. No tool changes; 99 tools total.

The Stroke control now edits borders per side — an All/Top/Right/Bottom/Left selector that multi-selects, so you can set a border on just the left, or the left and right together, not only all four at once.

A one-sided border reads correctly again: a bare border-left shows its real width, style, color, and side instead of "None".

The pending-changes panel collapses and expands from its header, so it stays out of the way on narrow and mobile viewports.

Editing a stacked multi-layer box-shadow no longer drops the extra layers, and bare semantic elements (a classless h2, blockquote, or li) can be scoped to their siblings again.

Overlay-only changes — the 99-tool stdio surface is unchanged.

Raven Design — click any element on your dev server and an overlay opens next to it: a Structure panel with a layers tree drilled to that node, and a Design panel showing its computed styles and the DESIGN.md tokens it uses, editable inline with live preview. Page templates and a component pass round it out. Six new tools back it (get_page_template, set_template_slot, list_templates, get_grab_layers, move_grab_layer, get_grab_operation).

Decision Graph — a project keeps a queryable memory of its design decisions, with provenance and evidence on every entry and a cross-process-safe store. decision_import cold-starts the graph from a repo's existing history.

review_diff and polish_diff — CI-shaped design review of a code diff against your DESIGN.md tokens and recorded decisions, and a path that turns those findings into a verified, ready-to-apply patch.

audit_taste can verify a content port kept its copy intact — pass source_text and it runs a deterministic word-token diff of the original against the target's visible text, so a redesign can't silently reword shipped copy.

The packaged .mcpb bundle now advertises exactly the tools it ships, derived from the built server rather than a hand-maintained list.

No breaking changes: every existing tool keeps its name and behavior; this release only adds. 99 tools total.

bind_taste_surface now refuses to bind a surface with no calibration content (no design notes, voice note, references, or overrides) — that empty shape is the fingerprint of a kickoff interview that was skipped. The refusal points the agent back to get_taste_interview and asking the user. An uncalibrated_ack note is the one escape hatch, for a surface a user was interviewed on and chose to leave uncalibrated — recorded on the binding so the skip is auditable.

generate_taste_portrait — renders any bound taste surface as a self-contained, designed HTML page built from its own rules, notes, voice, decisions, and wrong-right corpus. The page obeys the surface it describes, so it never violates the taste it's presenting. Render one binding or every binding plus a gallery index.

anime.js is now a first-class animation library in the Taste Engine, at parity with three.js, GSAP, and lottie — offered in the kickoff interview, assessed against a page's live motion, and returned as a build-hint recipe.

The kickoff interview now asks how typography, spacing, color, layout, motion, and imagery should read on the surface being bound — each question grounded in the profile's own rules for that category. The answers persist on the binding and are echoed in every audit, so a connected agent sees the surface's intent before its first design decision.

audit_taste is fairer to documents about a surface: a taste portrait is judged on the profile's rules without being convicted for not literally being the thing it describes, and a page is never flagged for quoting the rule it's illustrating.

Surface calibration — a short kickoff interview (get_taste_interview) plus per-project bindings (bind_taste_surface), so one taste profile shows up correctly everywhere: full-strength monochrome rules on a portfolio, none of them on a product site, a slightly different voice on each. audit_taste resolves bindings automatically by project name or URL host.

Per-surface rule scoping — taste rules can carry a scope (e.g. portfolio-monochrome); scoped rules run at full severity on a matching surface, are skipped and reported on a non-matching one, and warn rather than block when the surface is unknown.

Server instructions — Raven now briefs connecting agents at initialize time: calibrate taste before the first design work on a new project, when to reach for taste vs. mechanical audits, and how the label_finding learning loop works. Clients that honor MCP server instructions get this with zero setup; a copy-paste snippet for other clients is in the README.

Audits on uncalibrated projects with scoped rules return a calibration_hint, and get_taste_profile lists a profile's surface bindings.

Taste Engine — portable design judgment: build a taste profile from your own rules or a DESIGN.md, audit any page or copy block against it with audit_taste, and grow it with label_finding precedents that suppress approved patterns in future runs. Findings cite a rule and concrete evidence; unmeasurable clauses land in not_assessed instead of being guessed.

New score_page — a per-category 0–10 design score for any page, with the weakest category called out.

New audit_video_playback — observes whether each video actually plays, catching black or stalled clips that frame captures miss.

New audit_consistency — compares two or more pages and flags cross-page drift in container width and heading tier.

audit_page now checks inline SVG icon colors against the token system, and audit_layout flags the lonely stretched last-row card.

New dropdown-menu pattern — keyboard navigation, focus management, and the listbox-vs-menu distinction.

Rebuilt the homepage to an award-grade standard and gave this changelog its own timeline.

Removed the hard seams between sections so the page reads as one continuous surface.

Cleaned dead navigation links out of the header.

New compact response mode for audit_page, evaluate_design, and audit_url — return just scores, violations, and fix priority, dropping embedded screenshots and full principle bodies.

New suggest_contrast_fix tool — hand it a failing WCAG color pair and it returns the minimal color change that clears the AA/AAA target, with the achieved ratio.

audit_contrast now composites text over its full ancestor stack, eliminating false AA failures on dark, layered UIs.

New audit_device_frame — flags content sliced off inside phone and laptop mockups, checking frame geometry, baked-in pan/zoom drift, and edge truncation.

Added color-systems principles — palette discipline of ten or fewer page colors on a role-based token set.

Added spacing-systems principles — an 8px base grid and a tight, limited spacing scale.

New audit_content — per-item verdicts for headings, prose, CTAs, labels, and metrics, each with the principle it matched and a before-to-after rewrite.

New audit_typography — detects your modular scale and flags off-scale sizes, inconsistent line-height, and bloated weight ladders.

New audit_tap_targets — finds every interactive element below the 44px minimum and returns a concrete CSS fix, worst-first.

Blank-video detection now names the real reason and only confirms genuinely broken media.

New audit_url — renders a live URL at every viewport and theme, scroll-settles reveals, plays videos, and fires hover, click, and focus before capturing.

Catches the real-world nits that HTML-only audits miss: cropped images, blank videos, hover white-wash, sliced exports, and content hidden on mobile.

Every finding is tagged confirmed, likely-artifact, or inconclusive and ranked by severity — so you only fix what's real.

New audit_contract and audit_api_contract — verify a wire contract is identical across iOS, proxy, and Android source, and catch live responses that pass shape but are wrong.

New audit_parity — compares an iOS screen to its Android counterpart against named spatial relationships and reports cross-platform drift.

New audit_ios_a11y — scores an iOS snapshot for labels, traits, tap targets, contrast, Dynamic Type clipping, and VoiceOver order.

iOS capture can now fire interactions and freeze animations for pixel-stable shots.

New audit_contrast — exact WCAG 2.1 ratios for every text element, with the delta needed to pass.

New audit_responsive_visibility — renders at multiple breakpoints and flags content shown on desktop but hidden on mobile.

audit_page can now fire hover, click, and focus before the screenshot — so transient defects like a theme-toggle white-wash become visible.

Optional adversarial_verify re-checks each finding a second way and tags it confirmed or likely-artifact.

audit_page's max-width check now flags containers that diverge from your design system's canonical content width, instead of a generic heuristic.

Cross-platform audit_screen routes web, iOS, Android, and React Native through one entry point.

Android screens join the native audit lineup.

The mobile and native audit tools are now surfaced directly on the site.

New iOS and SwiftUI audit suite — audit_swiftui, audit_ios_screen, and audit_ios_privacy.

New React Native and Expo audit — audit_rn plus Expo privacy checks.

Content design systems tightened to four canonical references: Mailchimp, GOV.UK, Shopify Polaris, and Atlassian.

Laws of UX entries now cite their primary academic sources (Fitts 1954, Hick 1952, Miller 1956, and others).

Added a NOTICE file with full third-party attribution, plus CONTRIBUTING, CODE_OF_CONDUCT, and CODEOWNERS.

Added research methods, service-design blueprints, and a brand and visual knowledge layer.

Two-actor, human-in-the-loop service blueprints with persona avatars beside each lane.

Rebranded the site and metadata to RavenMCP.

Added content design systems — voice, writing principles, and copy patterns.

Raven now learns from local usage, insight-only and never leaving your machine, with an optional daily digest.

Shipped Claude Desktop Extension (.mcpb) packaging and end-to-end release automation.