Changelog: VIStudio management MCP

Version history of the management MCP (https://app.vistudio.ro/mcp) from the newest to the oldest. The current version is 1.15.0, dated 28.10.2026; you can also see it in the version field returned by whoami. The versioning rules (semver) and the deprecation policy of at least 30 days are on the developer page.

After an update, reconnect your client: the list of tools and their parameters is negotiated during connection.

1.15.0 — 28.10.2026

ChatGPT can reconnect via CIMD: a client metadata document that declares none among authentication methods (the token_endpoint_auth_methods_supported list in SEP-3149 or the legacy field token_endpoint_auth_method) is accepted as a public client with PKCE, even if its preferred method is private_key_jwt. A document without none, or with a method using a shared secret (client_secret_basic, client_secret_post, client_secret_jwt), will still be rejected with invalid_client. The server metadata remains unchanged;
OAuth: any request to /oauth/token or /oauth/revoke with client_assertion or client_assertion_type is explicitly rejected with invalid_client ('client_assertion is not supported by this server: use token_endpoint_auth_method none'), instead of being silently treated as a public client;
session key: each connection has a stable key, the same for all hourly token renewals. whoami returns the new field session.key (near session.id, which remains the current token's row and changes when renewed) and the new field clientId, the application ID: the UUID of the dynamic registration or the CIMD document address. For the API key, both are null;
agent_sessions_list returns one entry per session (login), not per token, with the new fields sessionKey, clientId and generations; createdAt is from the first generation, while lastUsedAt, refreshExpiresAt, revokedAt and active are from the latest. The list is no longer limited to 200 rows;
the agents log in the admin panel records, for each new action, the session and application ID: two agents working with the same user (for example, ChatGPT and Claude, or two conversations of the same application) are distinguished;
the limit of 120 calls per minute is counted per session and no longer resets when the token is renewed;
no new tools. The updated descriptions of whoami and agent_sessions_list are visible after the client reconnects.

1.14.0 — 25.10.2026

new tool page_table_edit: changes cells or rows in a block table without resending the block. Operations (setCell, hideRow, showRow, insertRow, removeRow, moveRow) are applied in order, with indexes starting from 0 that also count hidden rows; an index outside the table rejects the entire call (invalid), with nothing written; an unknown key or operation is rejected before the tool, as a parameter validation error. It works on a single language (locale required) and has dry_run; the response returns the resulting table (table: { columns, rows, hidden });
new page block table: title and/or caption, style default or board, 1 to 8 columns (with alignment), rows with one cell per column, hidden rows, highlighted row and optional link per row. Appears in blocks_schema and block_template; the rule 'each row has exactly as many cells as the header' is checked in block_validate, page_block_insert, page_block_update, page_blocks_set, pages_create and pages_create_many, and the message specifies the row. Hidden rows are omitted from llms-full.txt and from the page Markdown, where the table appears as a Markdown table;
new argument accent in pages_create, pages_create_many and pages_update (none, blue, green, yellow, orange, red, purple, teal, pink): a color cue for the page, which the site theme can use; pages_get and pages_tree return it (none when missing), and pages_update with dry_run shows it in changes. pages_create_many also receives hideTitle, like pages_create;
the block image-gallery (the lightbox gallery) can now be placed on pages too, not just in articles.
settings_update supports tiktok in social networks, while settings_get returns it.
the new module search (site search) can appear in modules from region_info and regions_list; this is enabled by the platform administrator on each site. Does not add MCP tools.
new descriptions and parameters are visible after the client reconnects.

1.13.0 — 24.10.2026

sitemap: task_link now rejects with conflict an active task claimed by another agent, such as task_update; plan_apply_structure rejects with conflict, before any write and also on dry_run, when a task it would cancel (or E9.0, whose text it rewrites) is held by another agent, and the message lists the keys and who holds them. The site administrator can override.
the claim rule now applies in all cases: any change from the web admin or the REST API on a task actively claimed by another agent gets a 409 plan_task_claimed, with nothing written; the client label on the claim only changes for a new claim or release.
a deadlock in the database when writing a page (for example, if a page is published at the same time its parent is renamed) no longer returns internal: Failed query: …, but instead conflict: [page_busy] …, with nothing written: retry after a few seconds. Applies to page tools and translate_document / translation_unlock when the document is a page. The race condition no longer occurs: renaming the parent waits for the child to be published.
OAuth: POST /oauth/revoke on a session where all approved sites have been deleted, the response is 200 (previously, 500); the session is revoked and renewing it returns invalid_grant;
with no new tools and no changes in tool parameters. The updated description of plan_apply_structure is visible after the client reconnects.

1.12.0 — 23.10.2026

new field theme.release in design_schema, design_get and design_validate: { tag, version, schema }, the theme release the site is running and the schema used for design validation ("release" = schema for that release; "current" = the current theme schema when the release does not have its own schema);
a site pinned to an older theme release retains its options: design_validate, design_draft_set, design_restore, design_submit and design_publish now validate against the schema of that release (previously, against the current theme schema), and the themeVersion of the saved version is the version of the release;
a decimal value matching the option step (for example 0.3 at the step 0.1) is no longer rejected due to rounding errors; 0.35 at the step 0.1 is still rejected;
when changing the site's theme, options that the new theme does not have or does not allow revert to their default values, in a new active version with the note “Theme change …”, visible in design_versions and design_get;
with no new tools. The updated description of design_schema is visible after the client reconnects.

1.11.4 — 22.10.2026

plan_delete: a subtask moved to another plan leaves along with its parent task and is counted in tasks from reject, from dry_run and from deleted (previously, it remained in the other plan as a top-level task);
frontend_update, frontend_set_page_role, frontend_set_homepage and frontend_set_blog_page no longer fails with 'invalid selections' when the homepage, blog page or a page with a role (about, contact, privacy, terms, pricing) is in the basket: the existing link passes, but a new link to a page in the basket is rejected with [link_target_trashed];
posts_delete and posts_unpublish (also with dry_run) return linkedFrom and linkedFromNote: what links to the article (blocks and text in pages and articles, redirects, menus);
the warning warning of the tools settings_menu_* now states that links to the basket have become text and no longer block other saves;
OAuth: a client_id containing control characters or longer than 512 characters receives invalid_client (at /oauth/authorize directly, with no redirect; 401 at /oauth/token and /oauth/revoke), not 500 server_error;
OAuth: the automatic redirect on errors from /oauth/authorize and the 'known application' label on the consent page are only applied for the application's callback address (https://claude.ai/api/mcp/auth_callback, https://claude.com/api/mcp/auth_callback, https://chatgpt.com/connector/oauth/<id>), in its canonical form; loopback addresses remain trusted on any path and port. For a different address on these hosts, the admin displays the error without following it;
consent page: buttons become active only after the first interaction on the page (mouse movement, key press) or 1 s after the window receives focus; a decision sent less than 1 s after the page is displayed is rejected (400), and a consent page opened before the update responds 'Invalid or expired form': connection resumes from the app;
no new tools and no changes in tool parameters.

1.11.3 — 22.10.2026

automatic translation starts from the published version of the main language, not from the latest draft: a draft saved immediately after publication will no longer be promoted to translated languages ahead of the main language, it will become available with its publication; a document withdrawn before translation runs will no longer be translated and republished. Description translate_document and autoTranslate.note from translation_status I say it;
design_preview_url: the requested path is checked on each segment and after decoding; empty segments, . and .. (and encoded, for example %2e or %252e), %2f, %5c, ~, control characters and invalid encodings are rejected with invalid, and the message names them;
design_schema: the example uses colors in the normalized server format (#rrggbb, lowercase), so design_validate it returns based on this conversions: [];
the “Did you mean …?” suggestions also recognize synonyms for card shadow (shadows, card shadow, card elevation and others);
posts_create and posts_update return an error when the article author cannot be saved, instead of a false success;
no new tools and no changes in tool parameters.

1.11.2 — 22.10.2026

a block read with pages_get can be sent back unchanged to page_blocks_set, page_block_insert, page_block_update, pages_create, pages_create_many and block_validate: fields added at read time (href and publicHref from links, in both formats) are removed before validation; previously, any block with a link was rejected with link: must NOT have additional properties. Any other unknown key is still rejected;
a link (CTA, card, redirect block, link in text, redirect) saved in a draft with the id of a page, article or media file from another site will no longer return the path or address of that target: href it is null (in pages_get with format: json and in preview); links from the same site are not modified;
pages_delete and pages_unpublish on a published dynamic page (a listing, including the blog page) I return in gone its paths, by language (previously, gone: []); when moving such a page, the platform also creates the 301 redirect automatically, and redirects_list and redirects_test I see its path;
OAuth: POST /oauth/token (refreshing the token or exchanging the code) on a session whose approved sites were all deleted returns 400 invalid_grant, not 500; nothing is revoked, and the client repeats authorization. A failed refresh leaves the old refresh token valid, so the client can retry;
the reconnection steps after a new scope are in the skills administer-site and design-site and in the connection guide: in Claude Code, /mcp → connector → Clear authentication, then Authenticate; in claude.ai, Disconnect, then Connect (Re-authenticate keeps old scopes);
region_clone_check (mode=plan) no longer counts among unpaired references the links that never had a source reference;
no new tools and no changes in tool parameters.

1.11.1 — 22.10.2026

two simultaneous saves or publishes of the same page now proceed one after the other, so a menu selection made in admin is no longer lost; if the page is busy for more than 10 seconds, the tools respond conflict: [page_busy] …, with nothing written: retry after a few seconds;
a save of a parent page stopped by the simultaneous saving of a subpage responds with conflict: [child_resave_busy] … (previously, internal: [child_resave_failed]), with nothing written: retry;
automatic translation no longer keeps the page busy during translation, only while writing the translated languages;
no new tools and no changes in tool parameters.

1.11.0 — 22.10.2026

the CSS layer of the design: on sites where the platform administrator has enabled it, a design version can also have its own CSS, filtered and limited to the page content (it cannot cover the header, footer or cookie banner). New optional argument css for design_validate and design_draft_set; design_get returns cssLayer and css, design_validate, design_draft_set and design_restore return css, and design_schema has limits.cssLayer. New rejections: design_css_disabled (the layer is stopped on site) and design_css_invalid (with the filter codes, css_*);
forms: what it returns forms_get can be sent back unchanged to forms_update. The hidden field reference is accepted (only name and required): its value is the title of the document chosen as the source in the form block, empty if there is no source, so required: true only makes sense if each block has the source set; fields[].label and submitButtonLabel supports null (submitButtonLabel: null removes the button label);
the agents log shows the correct document for each tool (articles, tags, locations, media, forms, settings, plan, tasks); task_link also returns id, and plan_apply_structure returns planId;
site cloning: the warning for a link without a source reference says that the type and reference were never set;
no new tools. The descriptions of affected tools are visible after reconnecting the client.

1.10.0 — 21.10.2026

links to a page that is moved to trash or deleted no longer block saving: an existing link in the same field remains and a new link to a page in trash is rejected with [link_target_trashed] (or [link_target_deleted] for a deleted page);
pages_delete (also with dry_run) returns linkedFrom and linkedFromNote: what refers to the page (blocks, text, redirects, menus, front-end roles), to let you change them before or after;
redirects_list marks with broken redirects to a target in trash or deleted (with brokenTotal and note), while redirects_coverage returns brokenRedirects; redirects_update for a redirect without a target, it requests a new target;
settings_update returns convertedMenuLinks and convertedNote when a menu item that lost its target becomes plain text;
pages_delete and pages_undelete works in the site's main language: a page available only in Romanian no longer receives a blank row in English;
no new tools. The descriptions of affected tools are visible after reconnecting the client.

1.9.0 — 21.10.2026

automatic redirects: when the public path of a page or published article changes (slug, parent, translated slug), the platform automatically creates a 301 redirect from the old address, in every language, and for published subpages (and, for the blog page, for articles); no redirect chains or loops;
pages_publish, posts_publish, and pages_update / posts_update when publishing directly, returns redirects: { created, updated, deleted }; pages_unpublish, pages_delete, posts_unpublish and posts_delete return gone, the paths that no longer respond;
redirects_list also displays redirects to articles (to.type: 'post', postId), while redirects_test tracks them, on the published path of the article;
moving the blog page restarts the site so the new routing can apply; pages_publish mentions it in note;
forms_delete with confirm: true deletes the form and its submissions in a single operation (previously, a failed deletion could cause submission loss); refusal without confirm shows how many submissions the form has;
plan_delete with confirm: true deletes the plan, its tasks and all their comments (including comments from other users) in one operation; the response includes deleted.comments, and refusal without confirmation; confirm also counts the comments;
two scheduled publications of the same document (pages_publish / posts_publish with at) no longer run at the same time; permanently deleting a page or article removes its schedules;
terms like 'in all languages', 'and in English' or 'multilingual' are no longer treated as manual translation requests: the agent only writes in the main language, and the platform translates the rest (server instructions, policy from whoami and writing tool descriptions);
no new tools. The descriptions of affected tools are visible after reconnecting the client.

1.8.0 — 21.10.2026

new field mcpOnly in the response whoami: session regions where the account works only via MCP and a note for the agent; null when not present. The 'MCP Only' checkbox is set by the platform administrator on the agent account, for each site. On these sites, the account can function only through MCP (OAuth or API key); in the web admin and REST API it has no more rights than an anonymous visitor, so the agent works only with MCP tools;
the recommended work rule: each agent should have their own account, separate from the person they work for;
no new tools and no changes in tool parameters.

1.7.1 — 20.10.2026

changing the blog page (frontend_set_blog_page) and the site languages (region_languages_update) the site now restarts for the new routing to apply; previously, an otherwise unchanged site would remain up with the old routing;
the description and the field note from his response frontend_set_blog_page state that the restart takes 1 to 2 minutes and how to check: until /api/health of the site shows a startedAt that is new, the list of articles still responds on the old path;
region_languages_update say the same thing in the description and in note, alongside the note about removed language content;
text only: no new tools and no changes in tool parameters.

1.7.0 — 20.10.2026

posts_get returns the article content as Markdown in the new field markdown;
content from posts_get is deprecated: it is an identical copy of markdown and is removed after 19.11.2026 (version 2.0.0); read markdown;
in ChatGPT, posts_get was enough that {}, because the ChatGPT chain loses the result of a tool that has a field content at the first level; the ChatGPT client no longer receives it content, so it gets the full article;
no new tools and no changes in tool parameters.

1.6.0 — 20.10.2026

New Agent Skill get-started (https://app.vistudio.ro/.well-known/agent-skills/get-started/SKILL.md): the prompt you copy into your agent's chat to start it. The agent connects to the MCP, finds out the site with whoami, generates a read-only status report and continues with you according to the server's rules. The Romanian prompt is on the page Start an AI agent on your site;
connection guide (https://app.vistudio.ro/mcp/guide) has the section 'Start a new agent', with the same prompt;
no new tools and no changes in tool parameters.

1.5.0 — 20.10.2026

the explicitly provided slug remains the document's: a slug sent to pages_create, pages_create_many, pages_update, posts_create, posts_update or tags_create, different from the one derived from the title, is no longer rewritten based on the title when the document is opened in admin;
new field slugLocked (by language): true = the slug follows the title, false = remains as given; in pages_get, posts_get, posts_list, pages_tree and in responses to writings;
pages_update and posts_update receive slugLocked, which locks or unlocks the slug without changing it;
pages_get and posts_get return note for a language with no own content (translated by the platform at publication or absent): empty fields are not an error.

1.4.0 — 19.10.2026

dry_run for tools that delete (pages_delete, posts_delete, media_delete, forms_delete, redirects_delete, offices_delete, plan_delete): write nothing, not even confirm: true;
a parameter not present in the tool schema rejects the call with invalid and “Did you mean ...?” (previously ignored); region for a tool that does not have it and confirm are further ignored, with the note ignored;
titles with control characters are rejected.

1.3.0 — 18.10.2026

new tools for site design: design_schema, design_get, design_validate, design_preview_url, design_versions, design_draft_set, design_restore, design_submit, design_publish; new scope mcp:design. A design is never published directly: design_publish requires admin role, mcp:publish and confirm: true.

1.2.0 — 12.10.2026

frontend_update receives whenToUse, the “When to use” section text from llms.txt (per language, up to 1000 characters); settings_get returns it in site.whenToUse;
pages_publish, and scheduled publication adds the page to the selected menus in admin, in the “Menu” section of the page;
moving a page to trash (pages_delete) and deleting it permanently remove it from menus;
the tools settings_menu_* report converted when converting a menu item to text for a page in trash or non-existent;
restoring a version from admin runs in the main language of the site (pages_restore was already running that way).

1.1.0 — 12.10.2026

new tools: pages_schedule_cancel and posts_schedule_cancel (cancels active schedules for a page or a post without altering the document);
pages_publish and posts_publish receive at, scheduled publishing: an ISO 8601 date and time in the future, up to 365 days ahead. No time zone; the time is Romania's. As with any publishing, the agent first asks for user confirmation;
pages_get and posts_get return schedules, active schedules;
connection: CIMD. client_id can be the https address of the client's metadata document; dynamic registration remains;
a page save that cannot update a subpage's path returns the error child_resave_failed and writes nothing (previously reported success without writing);
creating a page whose path cannot be written returns the error page_breadcrumbs_failed and creates nothing (previously returned the page even though it did not exist).

1.0.0 — 12.10.2026

The first version with versioning and deprecation policy. Compared to the previous version:

new tools: frontend_set_page_role (page roles: about, contact, privacy, terms, pricing), region_clone_check and region_clone (super-admin only);
main language: pages, posts and tags are only written in the main language. The platform translates to other languages on publishing (region_info.autoTranslate, pendingAutoTranslation in pages_tree and content_status). translation_unlock unlocks a language only at the user's explicit request;
region_languages_update receives autoTranslateNewDocuments;
translation_status has manualLanguages;
translate_document also translates forms, on request (collection: forms);
connection: scope= in WWW-Authenticate, resource_documentation in the resource metadata, listChanged: false in capabilities;
limits: retry after N s in rate_limited and Retry-After on OAuth 429;
whoami returns version.