Skip to content
verify mcp Beta VerifyMCP is currently in beta. If you notice any issues, get in touch and we’ll put it right.

Raven

NPM · RAVEN-MCP · 2 COMPONENTS

Design intelligence for coding agents: audits, design systems, and a taste profile agents consult.

+1 this week 88 Trust /100

Last scanned (54 minutes ago)

Scores higher than 92% of npm servers

Category Design and Media

Trust breakdown (7 categories)

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →

Supply Chain Security74
  • No malware found by supply-chain analysis.Pass
  • CVE check failed: a known high-severity CVE affects zod 3.25.76, a direct dependency. A fixed version is available. View diagnostics → Fail
  • Declares code that runs automatically (postinstall) and that we could not recognise. It may be perfectly ordinary, but we have not established what it does. View diagnostics → Partial
  • 37 of 109 dependencies flagged as unhealthy. View diagnostics → Partial
Provenance & Transparency100
  • Source repository is publicly reachable at the declared URL. View diagnostics → Pass
  • Cryptographically verified build provenance (signed, bound to rhinocap/raven-mcp). View diagnostics → Pass
  • Clear OSI-approved license (Apache-2.0).Pass
  • Actively maintained (last published 1 days ago).Pass
  • Publishes a security disclosure policy (SECURITY.md).Pass
Schema Quality & AI Usability78
  • 100% of prompts and resources have a non-trivial description (not blank, and not just the item's name).Pass
  • AI-judged instruction clarity (excellent).Pass
  • Context-footprint check failed: tool/resource definitions use about 23850 tokens (~207/item across 115 items; 115 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
  • Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management100
  • No destabilizing schema changes in the last 30 days.Pass
Tool Coverage98
  • 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
  • 93% of tool parameters carry a description.Partial
Tool Safety100
  • No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
  • All 1 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation.Pass
  • An AI judge read all 116 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
  • Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
Changelog

Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.

  • 5 Nov 26 +15
    • Malware scan: unverified → pass ▲ security
  • 4 Nov 26 −15
    • Malware scan: pass → unverified ▼ security
    • Package version: 2.6.0 → 3.0.0 functional
  • 31 Oct 26 0
    • Stability: 0.97 → pass security
  • 30 Oct 26 +1

    No change was recorded against any check on this day. Stability & Change Management went from 93 to 97. That category is still filling its 30-day observation window: 28 days of observed history at the previous scan, 29 at this one. The score rises as the window fills, whether or not the server changes.

  • 29 Oct 26 −1
    • Stability: pass → 0.93 functional
  • 24 Oct 26 −6
    • CVE-2023-54404 affects this package: high ▼ security
    • Known CVEs: pass → fail ▼ security
  • 19 Oct 26 +1
    • Stability: 0.97 → pass security
  • 18 Oct 26 +1
    • Security disclosure: unverified → pass ▲ functional
Diagnostics

Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.

Captured 5 Nov 2026 · Analysed npm/raven-mcp@3.0.0

Provenance Verified

A signed build attestation was found and verified, binding this exact artifact to the source repository it claims to come from.

Result Verified
Ecosystem npm
Reason Verified
Discovered via Registry attestation endpoint
Source repo rhinocap/raven-mcp
Certificate issuer https://token.actions.githubusercontent.com
Certificate SAN https://github.com/rhinocap/raven-mcp/.github/workflows/release.yml@refs/heads/main
Rekor log index 3686598732
Predicate type SLSA build provenance https://slsa.dev/provenance/v1
Subject digest sha512:846d0dda64f5253ac9f4f262e3a94fac44ceeca9c3a77cf1a23a0b1b88b480eeac5f7549ce73e9a4d5b153bd51d0d17cc838631fd8e99c33934b056d2

Background: How many MCP packages publish verified provenance →

Install scripts 1 script
Hook Tier Command
postinstall unreviewed node scripts/postinstall.cjs || true

Background: Why install scripts are a supply-chain risk →

Vulnerabilities 1 finding
ID CVE Severity Vector Fix available
GHSA-mrhx-c7xc-m3w5 CVE-2023-54404 high CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H yes

Background: What a vulnerability scan can and cannot prove →

Dependencies 109 packages
Packages resolved 109
Stale 37
Tree resolution Complete

Background: SBOMs and build attestations, explained →

MCP tools · 115 exposed · ~22,086 tokens

The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →

Tool Tokens
record_taste_decision ~390

The Taste Engine's learning loop — record a taste, direction, or design decision the MOMENT it is made during real work (an accent chosen, a nav pattern rejected, a name direction picked, a type pairing approved), not just at interview time. Each record carries the project, a short dimension name (a standard one like color/navigation or a new category like iconography/sound), what was chosen in the user's words, the alternatives rejected, why, and a source: 'user-directed' (the user asked for it), 'user-approved' (the user accepted a proposal), or 'user-corrected' (the user overrode a generated choice — the highest-signal record). Recorded decisions evolve every future get_taste_interview kickoff: recurring choices return as suggested defaults on their dimension's question, and decision categories no standard question covers become NEW interview questions. Record liberally — every committed decision is calibration data.

NameTypeReqDescription
decisionstringyesWhat was chosen, in the user's words — e.g. 'amber-phosphor accent, period-accurate not decorative'.
dimensionstringyesShort lowercase dimension name — a standard one (typography, spacing, color, layout, motion, imagery, entrance, loading, navigation, aesthetic, libraries) or a new category the standard set doesn't c…
profilestringyesTaste profile name (see list_taste_profiles).
projectstringyesProject the decision was made on.
rejectedarray–Alternatives considered and passed over.
sourcestring–How the decision was made — defaults to 'user-directed'. 'user-corrected' (user overrode a generated choice) is the highest-signal record.
whystring–The stated reason, if the user gave one.

No output schema declared.

No examples provided.

register_creative_asset ~110

Register a local or remote creative asset for Raven jobs. This is the local-first analog of upload: Raven stores metadata and a URI/path, not the file bytes.

NameTypeReqDescription
descriptionstring–What this asset should be used for.
metadataobject–Optional non-secret metadata.
namestring–Human-readable name.
tagsarray–Search tags.
typestringyesAsset type.
uristringyesLocal path or URL to the asset.

No output schema declared.

No examples provided.

review_diff ~263

Review added UI-code lines in a unified diff against the project's own DESIGN.md tokens and active recorded design decisions. Returns a structured CI verdict with file/line findings and nearest-token suggestions. Agents should call this on every PR or diff that touches UI code before merge.

NameTypeReqDescription
design_mdstring–Inline DESIGN.md content. Overrides project file lookup when supplied.
diffstringyesUnified diff to review (maximum 400KB).
fail_onarray–Rule names to escalate to a failing CI verdict. Valid values: important, bare-hex-color, hardcoded-font-size, hardcoded-font-family, hardcoded-spacing. Diff-scoped: only newly added lines can fail. D…
fail_on_governedboolean–When true, findings a recorded decision governs become fail-eligible (severity error → verdict fail). Governance is a lexical scope+category association, NOT a verified contradiction of the decision…
projectstring–Project directory used to resolve DESIGN.md and match decision scopes. Omit when design_md is supplied and no project hint is needed.

No output schema declared.

No examples provided.

score_creative ~113

Score a creative prompt, script, or ad concept for hook strength, benefit clarity, product signal, call-to-action, channel fit, audience fit, and brand fit. This is a transparent heuristic, not a proprietary prediction model.

NameTypeReqDescription
audiencestring–Target audience if not in a brand profile.
brand_profile_idstring–Local Raven brand profile ID.
channelstring–Target channel.
creative_textstringyesPrompt, script, ad copy, or creative concept to score.

No output schema declared.

No examples provided.

score_page ~241

Score an HTML/CSS page across 7 design categories (Structure, Typography, Color & palette, Spacing & rhythm, Accessibility, Responsive layout, Design tokens), each rated 0–10. Scores are derived deterministically from the same checks as audit_page — no browser required. Pass html directly, or pass url to have Raven launch headless chromium, render the page, and score the RENDERED DOM. Also returns the same overall 0–100 score and A–D grade audit_page produces, the weakest category, and the three categories Raven does not mechanically assess (brand, conversion, motion) with guidance on which tools to use for those.

NameTypeReqDescription
containerMaxWidthnumber–Your design system's canonical content-container width in px (e.g. 1152). Forwarded to the responsive/max-width check.
htmlstring–The full HTML content of the page to score.
strictboolean–Strict mode — count warnings as failures in the overall score. Default: false.
urlstring–If set, Raven launches headless chromium, renders the page, and scores the RENDERED DOM.

No output schema declared.

No examples provided.

search_knowledge ~85

Search across all design principles, UI patterns, and business strategies. Use when you need to find specific guidance or don't know which category to look in.

NameTypeReqDescription
layerstring–Which layer to search: principles, patterns, business, or all (default)
querystringyesSearch term (e.g. 'touch targets', 'pricing psychology', 'color contrast')

No output schema declared.

No examples provided.

search_references ~490

Find patterns previously kept with capture_reference — call it before rebuilding something already grabbed, or to recall 'that hero from Linear'. host, owner, and tags filters compose with AND; the free-text query expands recognized pattern intent through Raven's controlled vocabulary, then matches case-insensitively against note, app, tags, bound taxonomy ids, and selector. Every result carries a score and a 'why' naming the matched fields and any alias that connected the query to the record. Ordering is deterministic. Returns stored JSON records. Every result carries a `display` object holding the credit line, the source URL, and `image_path` — the PNG on disk for records captured with html, so results can be shown as pictures rather than style maps (the tool returns the path, never the bytes). **Browsing does not hand back the other site's markup.** A result reports `html_available` and `html_truncated` but omits the html itself; pass include_html:true to receive it, which is a deliberate step because that markup is the site's own authored expression rather than a measurement of it. Everything needed to LOOK at a pattern and to translate it onto this project's tokens — the picture, the selector, the rect, the computed styles — is in the default result. **Show the credit whenever you show the pattern**: this corpus holds other people's design work, Raven does not own it, and a third-party result also carries a notice saying so. Use these as references to build your own implementation, not as work to republish. Corrupt records are named in skipped[] instead of failing the call. It does not rank against live code and does not fetch the source site.

NameTypeReqDescription
hoststring–Only references grabbed from this host, e.g. 'linear.app'
include_htmlboolean–Return each record's captured markup verbatim. Off by default: browsing a corpus of other people's work should not hand back their markup as a side effect of looking at it. Ask for it when you are ac…
ownerstring–Only the user's own product, or only third-party sites
querystring–Free text expanded through the pattern taxonomy and matched against note, app, tags, bound taxonomy ids, and selector; omit to list everything passing the filters
tagsarray–Only references carrying ALL of these tags

No output schema declared.

No examples provided.

set_template_slot ~89

Persist an array of page-scoped template slots in one batched DESIGN.md update. fixed/flexible roles and allowedTokens are cooperative advisory metadata: display labels only, not enforced.

NameTypeReqDescription
pagestringyesPage pathname, matching location.pathname
slotsarrayyesAll template slots to persist in this batched call
template_idstring–Template identifier; defaults to default

No output schema declared.

No examples provided.

start_grab_session ~278

Start a capability-keyed Raven grab bridge on loopback. Proxy mode is the preferred zero-paste path: it serves a running local app with the overlay injected into HTML; the manual script tag remains available when needed. When proxying the designer's own local dev server, Grab's Motion tab finds motion for the page and builds playgrounds itself; pass profile and project when the project has a taste binding so those suggestions follow the designer's notes and earlier motion decisions.

NameTypeReqDescription
pathstring–Path to DESIGN.md to expose over /tokens. Optional when proxy_target is set — a minimal temp DESIGN.md is created automatically. Required (and must exist) when proxy_target is omitted.
portinteger–Optional port; defaults to an ephemeral loopback port
profilestring–Taste profile for the Motion tab's suggestions. Pass with project, or omit both.
projectstring–Bound project for the Motion tab's suggestions. Pass with profile, or omit both.
proxy_targetstring–URL of a running local dev server; the bridge will serve that app with the grab overlay auto-injected into every HTML page — user opens the bridge URL, zero setup
rolestring–Overlay role; consumer preserves the component-request flow, maintainer enables direct design-system component creation

No output schema declared.

No examples provided.

stop_grab_session ~21

Stop the current grab bridge and clear its queued selections.

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

suggest_contrast_fix ~163

Given failing WCAG color pairs, return the MINIMAL color change that clears the target ratio. For each {fg,bg} pair, computes the smallest foreground adjustment (and an alternative background adjustment) that reaches AA/AAA — with the achieved ratio and direction. Feeds directly from audit_contrast's failing pairs: pass them here to get concrete passing values instead of brute-forcing colors by hand. Pure offline math.

NameTypeReqDescription
levelstring–WCAG level when targetRatio is not given per-pair. Default AA.
pairsarray–Color pairs to remediate. Each: { selector?, fg, bg, fontPx?, bold?, targetRatio? }. fontPx/bold pick the large-text threshold; targetRatio overrides the level.

No output schema declared.

No examples provided.

suggest_motion ~465

Find the places on a page where motion would help, and build a playground for each from the page's own content. Captures the page at url, picks moments (hero entrance, button hover, card hover, section reveal, navigation hover, image reveal), and for each writes a playground the designer can tune, built from the captured text, styles, images and fonts. Also writes a map: a picture of the page with a numbered spot on each suggestion and a list of why each was picked. Pass profile and project so the suggestions follow the designer's motion notes, customer note and earlier decisions; a 'none-instant' or 'no motion' note returns no suggestions. Anything the playground cannot show exactly, such as a gradient or a shadow, is listed in approximations. Then call open_motion_playground with map_path and hand the designer the url. When the designer names one element in chat ("add motion to the pricing cards"), find its CSS selector in the code or from get_grabbed_elements and pass selector (and trigger if they said when it should move): that builds one playground for that element from the same capture, with no map, and returns preview_url to give the designer. Captures only http and https pages; a local or private address is allowed only when url itself is one.

NameTypeReqDescription
maxinteger–Most suggestions to return, 1-8. Default 5.
profilestring–Taste profile name (see list_taste_profiles). Pass with project, or omit both.
projectstring–Bound project name. Pass with profile, or omit both.
selectorstring–A CSS selector for one element to build a playground for. Sets max to 1 and builds no map.
triggerstring–With selector: when the element moves. entrance = when the page opens, hover = on hover, scroll = when it scrolls into view. Omit to choose from the element.
urlstringyesThe page to look at: a local dev server (http://localhost:3000/) or a published site (https://…).
viewportstring–Page width to capture at: desktop (1440 px, default) or mobile (390 px).

No output schema declared.

No examples provided.

talon_rules ~64

Enumerate Raven's Talon detector rule corpus — id, category, severity, taste scope, and the src/data/principles/*.json entry each rule cites. No scan required; use this to show a client 'why' before or instead of running talon_scan.

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

talon_scan ~383

Run Raven's deterministic detector engine over a page — no LLM, pure measurement. Covers color-system discipline (palette budget, near-duplicate hex, hue diversity), spacing-grid conformance (base-unit, scale count), type-scale/rhythm (size count, body line-height, measure, font-family budget), heading/landmark structure, motion-duration/easing sanity (flashing-animation risk, prefers-reduced-motion coverage), and orphan-stretch/horizontal-overflow geometry. Pass html, url (rendered headless), or pre-measured elements+viewport (the same DevTools-snippet shape audit_layout takes — required for the two geometry rules). Every finding cites the src/data/principles/*.json entry it derives from. Pass project (and profile) to resolve a saved taste surface binding (see bind_taste_surface) — a finding the binding silences via an 'off' override is still returned, flagged waived_by_taste:true, never dropped.

NameTypeReqDescription
elementsarray–Pre-measured element rects (DevTools-snippet shape from audit_layout) — enables the geometry rules (orphan-stretch, horizontal-overflow).
htmlstring–Full HTML/CSS of the page to scan.
profilestring–Taste profile name to resolve project's binding against (see list_taste_profiles). Only used when project or url is also given.
projectstring–Project identifier — resolves a saved surface binding (see bind_taste_surface) whose overrides can waive specific TAL-### rules. Requires profile.
surfacestring–What surface is being scanned — activates/skips scope-tagged rules by token match. Omit if unsure.
urlstring–Live URL — rendered headless with scroll-settle.
viewportobject–Viewport used for the horizontal-overflow geometry check.

No output schema declared.

No examples provided.

update_design_md ~54

Update one DESIGN.md token surgically while preserving the Markdown body.

NameTypeReqDescription
pathstringyesPath to DESIGN.md
removeobject––
renameobject––
setobject––

No output schema declared.

No examples provided.

Install

How do I install the Raven MCP server?

Raven runs locally as an npm package, launched with npx -y raven-mcp. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.

npm · raven-mcp

# add to Claude Code
claude mcp add ai-ravenmcp-raven-mcp -- npx -y raven-mcp
Common questions

What is the Raven MCP server?

Raven is an MCP server listed in the public MCP registry as ai.ravenmcp/raven-mcp. Design intelligence for coding agents: audits, design systems, and a taste profile agents consult. This page covers its npm package (raven-mcp).

Is the Raven MCP server safe to use?

Raven scores 88 out of 100 on VerifyMCP. We recorded 1 known advisory against it as of 5 November 2026. Its build provenance is signed and verified. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

What tools does the Raven MCP server expose?

Raven exposes 115 tools: get_principles, get_pattern, get_business_strategy, evaluate_design, search_knowledge, and 110 more. Their descriptions and schemas cost roughly 22,086 tokens of context every time the server is loaded.

Is the Raven MCP server still maintained?

Raven is still listed as active in the MCP registry. We last reached this channel on 5 November 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.

What licence is the Raven MCP server under?

Raven declares the Apache-2.0 licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.