
Security News
Ruby's Bundler 4.0.18 Extends Cooldown to bundle lock and bundle cache
The supply chain control that delays freshly published gems now covers lockfile generation and gem vendoring in Ruby projects.
@variel/mcp-server
Advanced tools
The Variel MCP server — gives your coding agent live access to your brand: tokens, components, voice, and on-brand validation. It runs over stdio and resolves your brand from the Variel API using your project's API key, so there's nothing to clone and no
The Variel MCP server — gives your coding agent live access to your brand: tokens, components, voice, and on-brand validation. It runs over stdio and resolves your brand from the Variel API using your project's API key, so there's nothing to clone and no database to point at.
Get your BRAND_API_KEY (vrl_…) from your project's Activation page in
the Variel dashboard, then:
# Claude Code
claude mcp add variel -e BRAND_API_KEY=vrl_… -- npx @variel/mcp-server
For Cursor / other agents, add an mcpServers entry:
{
"mcpServers": {
"variel": {
"command": "npx",
"args": ["@variel/mcp-server"],
"env": { "BRAND_API_KEY": "vrl_…" }
}
}
}
get_brand_tokens — the live token set (colors, type, spacing, radius…)list_components / get_component — brand components to use before rolling your ownvalidate_design — deterministic on-brand conformance for changed codevalidate_copy — voice/tone check for copygrade_visual_quality — model-judged visual quality (needs ANTHROPIC_API_KEY)propose_token — propose a new token when nothing fitsResources: brand://voice, brand://moodboard, brand://guidelines.
| Env | Default | Purpose |
|---|---|---|
BRAND_API_KEY | — | Your project key (vrl_…). Required. |
VARIEL_API_URL | https://variel.ai | Override for self-host / staging. |
ANTHROPIC_API_KEY | — | Required only for grade_visual_quality. |
BRAND_SOURCE | (unset) | Set to db to read Postgres directly (DATABASE_URL) instead of the HTTP API — for local dev / self-host. |
Without a valid key the server falls back to a neutral bootstrap brand so your agent still starts.
FAQs
Generate a brand from inside your coding agent, then keep every design token, component, and copy decision on-brand — deterministic on-brand validation served live over MCP.
The npm package @variel/mcp-server receives a total of 18 weekly downloads. As such, @variel/mcp-server popularity was classified as not popular.
We found that @variel/mcp-server demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
The supply chain control that delays freshly published gems now covers lockfile generation and gem vendoring in Ruby projects.

Security News
During a UK cyber test, a Mythos 5 agent used sockpuppets, social engineering, and prompt injection to try to get a maintainer to merge malware.

Company News
Socket is now in the AWS Security Hub Extended plan. Adopt it through AWS, apply committed spend, and block malicious open source packages.