---
title: "Changelog: VIStudio management MCP"
description: "Version history for the VIStudio Administration MCP: new tools, parameters and fields, rejections and fixes, from 1.0.0 to the current version."
canonical: https://www.vistudio.ro/en/developers/changelog
---

# Changelog: VIStudio management MCP

> Version history for the VIStudio Administration MCP: new tools, parameters and fields, rejections and fixes, from 1.0.0 to the current version.

Source: https://www.vistudio.ro/en/developers/changelog

Version history of the management MCP (`https://app.vistudio.ro/mcp`) from the newest to the oldest. The current version is **1.15.0**, dated 28.10.2026; you can also see it in the `version` field returned by `whoami`. The versioning rules (semver) and the deprecation policy of at least 30 days are on the [developer page](https://www.vistudio.ro/en/developers).

After an update, reconnect your client: the list of tools and their parameters is negotiated during connection.

## 1.15.0 — 28.10.2026

- ChatGPT can reconnect via CIMD: a client metadata document that declares `none` among authentication methods (the `token_endpoint_auth_methods_supported` list in SEP-3149 or the legacy field `token_endpoint_auth_method`) is accepted as a public client with PKCE, even if its preferred method is `private_key_jwt`. A document without `none`, or with a method using a shared secret (`client_secret_basic`, `client_secret_post`, `client_secret_jwt`), will still be rejected with `invalid_client`. The server metadata remains unchanged;
- OAuth: any request to `/oauth/token` or `/oauth/revoke` with `client_assertion` or `client_assertion_type` is explicitly rejected with `invalid_client` ('client\_assertion is not supported by this server: use token\_endpoint\_auth\_method none'), instead of being silently treated as a public client;
- session key: each connection has a stable key, the same for all hourly token renewals. `whoami` returns the new field `session.key` (near `session.id`, which remains the current token's row and changes when renewed) and the new field `clientId`, the application ID: the UUID of the dynamic registration or the CIMD document address. For the API key, both are `null`;
- `agent_sessions_list` returns one entry per session (login), not per token, with the new fields `sessionKey`, `clientId` and `generations`; `createdAt` is from the first generation, while `lastUsedAt`, `refreshExpiresAt`, `revokedAt` and `active` are from the latest. The list is no longer limited to 200 rows;
- the agents log in the admin panel records, for each new action, the session and application ID: two agents working with the same user (for example, ChatGPT and Claude, or two conversations of the same application) are distinguished;
- the limit of 120 calls per minute is counted per session and no longer resets when the token is renewed;
- no new tools. The updated descriptions of `whoami` and `agent_sessions_list` are visible after the client reconnects.

## 1.14.0 — 25.10.2026

- new tool `page_table_edit`: changes cells or rows in a block `table` without resending the block. Operations (`setCell`, `hideRow`, `showRow`, `insertRow`, `removeRow`, `moveRow`) are applied in order, with indexes starting from 0 that also count hidden rows; an index outside the table rejects the entire call (`invalid`), with nothing written; an unknown key or operation is rejected before the tool, as a parameter validation error. It works on **a single language** (`locale` required) and has `dry_run`; the response returns the resulting table (`table: { columns, rows, hidden }`);
- new page block `table`: title and/or caption, style `default` or `board`, 1 to 8 columns (with alignment), rows with one cell per column, hidden rows, highlighted row and optional link per row. Appears in `blocks_schema` and `block_template`; the rule 'each row has exactly as many cells as the header' is checked in `block_validate`, `page_block_insert`, `page_block_update`, `page_blocks_set`, `pages_create` and `pages_create_many`, and the message specifies the row. Hidden rows are omitted from `llms-full.txt` and from the page Markdown, where the table appears as a Markdown table;
- new argument `accent` in `pages_create`, `pages_create_many` and `pages_update` (`none`, `blue`, `green`, `yellow`, `orange`, `red`, `purple`, `teal`, `pink`): a color cue for the page, which the site theme can use; `pages_get` and `pages_tree` return it (`none` when missing), and `pages_update` with `dry_run` shows it in `changes`. `pages_create_many` also receives `hideTitle`, like `pages_create`;
- the block `image-gallery` (the lightbox gallery) can now be placed on pages too, not just in articles.
- `settings_update` supports `tiktok` in social networks, while `settings_get` returns it.
- the new module `search` (site search) can appear in `modules` from `region_info` and `regions_list`; this is enabled by the platform administrator on each site. Does not add MCP tools.
- new descriptions and parameters are visible after the client reconnects.

## 1.13.0 — 24.10.2026

- sitemap: `task_link` now rejects with `conflict` an active task claimed by another agent, such as `task_update`; `plan_apply_structure` rejects with `conflict`, before any write and also on `dry_run`, when a task it would cancel (or E9.0, whose text it rewrites) is held by another agent, and the message lists the keys and who holds them. The site administrator can override.
- the claim rule now applies in all cases: any change from the web admin or the REST API on a task actively claimed by another agent gets a 409 `plan_task_claimed`, with nothing written; the client label on the claim only changes for a new claim or release.
- a deadlock in the database when writing a page (for example, if a page is published at the same time its parent is renamed) no longer returns `internal: Failed query: …`, but instead `conflict: [page_busy] …`, with nothing written: retry after a few seconds. Applies to page tools and `translate_document` / `translation_unlock` when the document is a page. The race condition no longer occurs: renaming the parent waits for the child to be published.
- OAuth: `POST /oauth/revoke` on a session where all approved sites have been deleted, the response is 200 (previously, 500); the session is revoked and renewing it returns `invalid_grant`;
- with no new tools and no changes in tool parameters. The updated description of `plan_apply_structure` is visible after the client reconnects.

## 1.12.0 — 23.10.2026

- new field `theme.release` in `design_schema`, `design_get` and `design_validate`: `{ tag, version, schema }`, the theme release the site is running and the schema used for design validation (`"release"` = schema for that release; `"current"` = the current theme schema when the release does not have its own schema);
- a site pinned to an older theme release retains its options: `design_validate`, `design_draft_set`, `design_restore`, `design_submit` and `design_publish` now validate against the schema of that release (previously, against the current theme schema), and the `themeVersion` of the saved version is the version of the release;
- a decimal value matching the option step (for example `0.3` at the step `0.1`) is no longer rejected due to rounding errors; `0.35` at the step `0.1` is still rejected;
- when changing the site's theme, options that the new theme does not have or does not allow revert to their default values, in a new active version with the note “Theme change …”, visible in `design_versions` and `design_get`;
- with no new tools. The updated description of `design_schema` is visible after the client reconnects.

## 1.11.4 — 22.10.2026

- `plan_delete`: a subtask moved to another plan leaves along with its parent task and is counted in `tasks` from reject, from `dry_run` and from `deleted` (previously, it remained in the other plan as a top-level task);
- `frontend_update`, `frontend_set_page_role`, `frontend_set_homepage` and `frontend_set_blog_page` no longer fails with 'invalid selections' when the homepage, blog page or a page with a role (`about`, `contact`, `privacy`, `terms`, `pricing`) is in the basket: the existing link passes, but a new link to a page in the basket is rejected with `[link_target_trashed]`;
- `posts_delete` and `posts_unpublish` (also with `dry_run`) return `linkedFrom` and `linkedFromNote`: what links to the article (blocks and text in pages and articles, redirects, menus);
- the warning `warning` of the tools `settings_menu_*` now states that links to the basket have become text and no longer block other saves;
- OAuth: a `client_id` containing control characters or longer than 512 characters receives `invalid_client` (at `/oauth/authorize` directly, with no redirect; 401 at `/oauth/token` and `/oauth/revoke`), not 500 `server_error`;
- OAuth: the automatic redirect on errors from `/oauth/authorize` and the 'known application' label on the consent page are only applied for the application's callback address (`https://claude.ai/api/mcp/auth_callback`, `https://claude.com/api/mcp/auth_callback`, `https://chatgpt.com/connector/oauth/<id>`), in its canonical form; loopback addresses remain trusted on any path and port. For a different address on these hosts, the admin displays the error without following it;
- consent page: buttons become active only after the first interaction on the page (mouse movement, key press) or 1 s after the window receives focus; a decision sent less than 1 s after the page is displayed is rejected (400), and a consent page opened before the update responds 'Invalid or expired form': connection resumes from the app;
- no new tools and no changes in tool parameters.

## 1.11.3 — 22.10.2026

- automatic translation starts from the published version of the main language, not from the latest draft: a draft saved immediately after publication will no longer be promoted to translated languages ahead of the main language, it will become available with its publication; a document withdrawn before translation runs will no longer be translated and republished. Description `translate_document` and `autoTranslate.note` from `translation_status` I say it;
- `design_preview_url`: the requested path is checked on each segment and after decoding; empty segments, `.` and `..` (and encoded, for example `%2e` or `%252e`), `%2f`, `%5c`, `~`, control characters and invalid encodings are rejected with `invalid`, and the message names them;
- `design_schema`: the example uses colors in the normalized server format (`#rrggbb`, lowercase), so `design_validate` it returns based on this `conversions: []`;
- the “Did you mean …?” suggestions also recognize synonyms for card shadow (`shadows`, `card shadow`, `card elevation` and others);
- `posts_create` and `posts_update` return an error when the article author cannot be saved, instead of a false success;
- no new tools and no changes in tool parameters.

## 1.11.2 — 22.10.2026

- a block read with `pages_get` can be sent back unchanged to `page_blocks_set`, `page_block_insert`, `page_block_update`, `pages_create`, `pages_create_many` and `block_validate`: fields added at read time (`href` and `publicHref` from links, in both formats) are removed before validation; previously, any block with a link was rejected with `link: must NOT have additional properties`. Any other unknown key is still rejected;
- a link (CTA, card, redirect block, link in text, redirect) saved in a draft with the id of a page, article or media file from another site will no longer return the path or address of that target: `href` it is `null` (in `pages_get` with `format: json` and in preview); links from the same site are not modified;
- `pages_delete` and `pages_unpublish` on a published dynamic page (a listing, including the blog page) I return in `gone` its paths, by language (previously, `gone: []`); when moving such a page, the platform also creates the 301 redirect automatically, and `redirects_list` and `redirects_test` I see its path;
- OAuth: `POST /oauth/token` (refreshing the token or exchanging the code) on a session whose approved sites were all deleted returns 400 `invalid_grant`, not 500; nothing is revoked, and the client repeats authorization. A failed refresh leaves the old refresh token valid, so the client can retry;
- the reconnection steps after a new scope are in the skills `administer-site` and `design-site` and in the connection guide: in Claude Code, `/mcp` → connector → Clear authentication, then Authenticate; in claude.ai, Disconnect, then Connect (Re-authenticate keeps old scopes);
- `region_clone_check` (`mode=plan`) no longer counts among unpaired references the links that never had a source reference;
- no new tools and no changes in tool parameters.

## 1.11.1 — 22.10.2026

- two simultaneous saves or publishes of the same page now proceed one after the other, so a menu selection made in admin is no longer lost; if the page is busy for more than 10 seconds, the tools respond `conflict: [page_busy] …`, with nothing written: retry after a few seconds;
- a save of a parent page stopped by the simultaneous saving of a subpage responds with `conflict: [child_resave_busy] …` (previously, `internal: [child_resave_failed]`), with nothing written: retry;
- automatic translation no longer keeps the page busy during translation, only while writing the translated languages;
- no new tools and no changes in tool parameters.

## 1.11.0 — 22.10.2026

- the CSS layer of the design: on sites where the platform administrator has enabled it, a design version can also have its own CSS, filtered and limited to the page content (it cannot cover the header, footer or cookie banner). New optional argument `css` for `design_validate` and `design_draft_set`; `design_get` returns `cssLayer` and `css`, `design_validate`, `design_draft_set` and `design_restore` return `css`, and `design_schema` has `limits.cssLayer`. New rejections: `design_css_disabled` (the layer is stopped on site) and `design_css_invalid` (with the filter codes, `css_*`);
- forms: what it returns `forms_get` can be sent back unchanged to `forms_update`. The hidden field `reference` is accepted (only `name` and `required`): its value is the title of the document chosen as the source in the form block, empty if there is no source, so `required: true` only makes sense if each block has the source set; `fields[].label` and `submitButtonLabel` supports `null` (`submitButtonLabel: null` removes the button label);
- the agents log shows the correct document for each tool (articles, tags, locations, media, forms, settings, plan, tasks); `task_link` also returns `id`, and `plan_apply_structure` returns `planId`;
- site cloning: the warning for a link without a source reference says that the type and reference were never set;
- no new tools. The descriptions of affected tools are visible after reconnecting the client.

## 1.10.0 — 21.10.2026

- links to a page that is moved to trash or deleted no longer block saving: an existing link in the same field remains and a new link to a page in trash is rejected with `[link_target_trashed]` (or `[link_target_deleted]` for a deleted page);
- `pages_delete` (also with `dry_run`) returns `linkedFrom` and `linkedFromNote`: what refers to the page (blocks, text, redirects, menus, front-end roles), to let you change them before or after;
- `redirects_list` marks with `broken` redirects to a target in trash or deleted (with `brokenTotal` and `note`), while `redirects_coverage` returns `brokenRedirects`; `redirects_update` for a redirect without a target, it requests a new target;
- `settings_update` returns `convertedMenuLinks` and `convertedNote` when a menu item that lost its target becomes plain text;
- `pages_delete` and `pages_undelete` works in the site's main language: a page available only in Romanian no longer receives a blank row in English;
- no new tools. The descriptions of affected tools are visible after reconnecting the client.

## 1.9.0 — 21.10.2026

- automatic redirects: when the public path of a page or published article changes (slug, parent, translated slug), the platform automatically creates a 301 redirect from the old address, in every language, and for published subpages (and, for the blog page, for articles); no redirect chains or loops;
- `pages_publish`, `posts_publish`, and `pages_update` / `posts_update` when publishing directly, returns `redirects: { created, updated, deleted }`; `pages_unpublish`, `pages_delete`, `posts_unpublish` and `posts_delete` return `gone`, the paths that no longer respond;
- `redirects_list` also displays redirects to articles (`to.type: 'post'`, `postId`), while `redirects_test` tracks them, on the published path of the article;
- moving the blog page restarts the site so the new routing can apply; `pages_publish` mentions it in `note`;
- `forms_delete` with `confirm: true` deletes the form and its submissions in a single operation (previously, a failed deletion could cause submission loss); refusal without `confirm` shows how many submissions the form has;
- `plan_delete` with `confirm: true` deletes the plan, its tasks and all their comments (including comments from other users) in one operation; the response includes `deleted.comments`, and refusal without confirmation; `confirm` also counts the comments;
- two scheduled publications of the same document (`pages_publish` / `posts_publish` with `at`) no longer run at the same time; permanently deleting a page or article removes its schedules;
- terms like 'in all languages', 'and in English' or 'multilingual' are no longer treated as manual translation requests: the agent only writes in the main language, and the platform translates the rest (server instructions, `policy` from `whoami` and writing tool descriptions);
- no new tools. The descriptions of affected tools are visible after reconnecting the client.

## 1.8.0 — 21.10.2026

- new field `mcpOnly` in the response `whoami`: session regions where the account works only via MCP and a note for the agent; `null` when not present. The 'MCP Only' checkbox is set by the platform administrator on the agent account, for each site. On these sites, the account can function only through MCP (OAuth or API key); in the web admin and REST API it has no more rights than an anonymous visitor, so the agent works only with MCP tools;
- the recommended work rule: each agent should have their own account, separate from the person they work for;
- no new tools and no changes in tool parameters.

## 1.7.1 — 20.10.2026

- changing the blog page (`frontend_set_blog_page`) and the site languages (`region_languages_update`) the site now restarts for the new routing to apply; previously, an otherwise unchanged site would remain up with the old routing;
- the description and the field `note` from his response `frontend_set_blog_page` state that the restart takes 1 to 2 minutes and how to check: until `/api/health` of the site shows a `startedAt` that is new, the list of articles still responds on the old path;
- `region_languages_update` say the same thing in the description and in `note`, alongside the note about removed language content;
- text only: no new tools and no changes in tool parameters.

## 1.7.0 — 20.10.2026

- `posts_get` returns the article content as Markdown in the new field `markdown`;
- `content` from `posts_get` is deprecated: it is an identical copy of `markdown` and is removed after 19.11.2026 (version 2.0.0); read `markdown`;
- in ChatGPT, `posts_get` was enough that `{}`, because the ChatGPT chain loses the result of a tool that has a field `content` at the first level; the ChatGPT client no longer receives it `content`, so it gets the full article;
- no new tools and no changes in tool parameters.

## 1.6.0 — 20.10.2026

- New Agent Skill `get-started` (`https://app.vistudio.ro/.well-known/agent-skills/get-started/SKILL.md`): the prompt you copy into your agent's chat to start it. The agent connects to the MCP, finds out the site with `whoami`, generates a read-only status report and continues with you according to the server's rules. The Romanian prompt is on the page [Start an AI agent on your site](https://www.vistudio.ro/en/developers/launch-agent);
- connection guide (`https://app.vistudio.ro/mcp/guide`) has the section 'Start a new agent', with the same prompt;
- no new tools and no changes in tool parameters.

## 1.5.0 — 20.10.2026

- the explicitly provided slug remains the document's: a slug sent to `pages_create`, `pages_create_many`, `pages_update`, `posts_create`, `posts_update` or `tags_create`, different from the one derived from the title, is no longer rewritten based on the title when the document is opened in admin;
- new field `slugLocked` (by language): `true` = the slug follows the title, `false` = remains as given; in `pages_get`, `posts_get`, `posts_list`, `pages_tree` and in responses to writings;
- `pages_update` and `posts_update` receive `slugLocked`, which locks or unlocks the slug without changing it;
- `pages_get` and `posts_get` return `note` for a language with no own content (translated by the platform at publication or absent): empty fields are not an error.

## 1.4.0 — 19.10.2026

- `dry_run` for tools that delete (`pages_delete`, `posts_delete`, `media_delete`, `forms_delete`, `redirects_delete`, `offices_delete`, `plan_delete`): write nothing, not even `confirm: true`;
- a parameter not present in the tool schema rejects the call with `invalid` and “Did you mean ...?” (previously ignored); `region` for a tool that does not have it and `confirm` are further ignored, with the note `ignored`;
- titles with control characters are rejected.

## 1.3.0 — 18.10.2026

- new tools for site design: `design_schema`, `design_get`, `design_validate`, `design_preview_url`, `design_versions`, `design_draft_set`, `design_restore`, `design_submit`, `design_publish`; new scope `mcp:design`. A design is never published directly: `design_publish` requires admin role, `mcp:publish` and `confirm: true`.

## 1.2.0 — 12.10.2026

- `frontend_update` receives `whenToUse`, the “When to use” section text from `llms.txt` (per language, up to 1000 characters); `settings_get` returns it in `site.whenToUse`;
- `pages_publish`, and scheduled publication adds the page to the selected menus in admin, in the “Menu” section of the page;
- moving a page to trash (`pages_delete`) and deleting it permanently remove it from menus;
- the tools `settings_menu_*` report `converted` when converting a menu item to text for a page in trash or non-existent;
- restoring a version from admin runs in the main language of the site (`pages_restore` was already running that way).

## 1.1.0 — 12.10.2026

- new tools: `pages_schedule_cancel` and `posts_schedule_cancel` (cancels active schedules for a page or a post without altering the document);
- `pages_publish` and `posts_publish` receive `at`, scheduled publishing: an ISO 8601 date and time in the future, up to 365 days ahead. No time zone; the time is Romania's. As with any publishing, the agent first asks for user confirmation;
- `pages_get` and `posts_get` return `schedules`, active schedules;
- connection: CIMD. `client_id` can be the https address of the client's metadata document; dynamic registration remains;
- a page save that cannot update a subpage's path returns the error `child_resave_failed` and writes nothing (previously reported success without writing);
- creating a page whose path cannot be written returns the error `page_breadcrumbs_failed` and creates nothing (previously returned the page even though it did not exist).

## 1.0.0 — 12.10.2026

The first version with versioning and deprecation policy. Compared to the previous version:

- new tools: `frontend_set_page_role` (page roles: about, contact, privacy, terms, pricing), `region_clone_check` and `region_clone` (super-admin only);
- main language: pages, posts and tags are only written in the main language. The platform translates to other languages on publishing (`region_info.autoTranslate`, `pendingAutoTranslation` in `pages_tree` and `content_status`). `translation_unlock` unlocks a language only at the user's explicit request;
- `region_languages_update` receives `autoTranslateNewDocuments`;
- `translation_status` has `manualLanguages`;
- `translate_document` also translates forms, on request (`collection: forms`);
- connection: `scope=` in `WWW-Authenticate`, `resource_documentation` in the resource metadata, `listChanged: false` in capabilities;
- limits: `retry after N s` in `rate_limited` and `Retry-After` on OAuth 429;
- `whoami` returns `version`.