Changes and updates
New endpoints, smarter extraction, MCP server updates and fixes. Everything we ship for the API, in the order we shipped it.
- New
Dedicated privacy policy and terms for the API
The API and MCP server now have their own privacy policy and terms of service, covering how the URLs you submit are fetched and processed, what request data is logged, result caching, and acceptable use. Linked from the API footer.
API privacy policy - Security
Hardened API metering, rate limiting, and URL fetching
Credit metering is now atomic, so concurrent calls on a key are counted exactly - no more, no less. Rate limits derive the client IP from the trusted platform edge instead of a spoofable header. And every server-side fetch of a user-supplied URL now pins its connection to the address it validated, closing a DNS-rebinding gap, with tighter content-type and size limits on the media proxies.
- Improved
Brand extraction v2: the site's own design system decides
/v1/brand and the extract_brand MCP tool now read color roles from the signals a site declares about itself: brand-named CSS variables, its theme-color, and its SVG logo, before falling back to usage counts. The response also gained a dark/light theme field and a typography split (primary + monospace face), and near-duplicate shades are merged so the palette slots count. Third-party embeds can no longer hijack a palette - extracting linear.app now returns Linear's indigo, not the colors of an embedded tweet.
Brand endpoint docs - Fixed
extract_code understands Tailwind v4 sites
/v1/code now resolves Tailwind v4 gradient syntax, CSS masks, the page's real font, and relative asset URLs - so components extracted from modern Tailwind sites arrive complete instead of missing their backgrounds.
Code endpoint docs - Improved
MCP tools follow the latest spec
Every tool now ships a human-friendly title and read-only annotations per the 2025-06-18 MCP spec, so clients list them clearly and soften their permission prompts. Responses were also slimmed for chat clients, and the miromiro-mcp npm package synced to 0.2.0.
MCP setup guide - New
Hosted MCP server: one URL connects any AI client
The extraction API is now a remote MCP server at miromiro.app/mcp (Streamable HTTP, no install). Add the URL in Claude, Cursor, ChatGPT developer mode or Codex and your assistant gets all seven extraction tools. Works keyless in demo mode; attach your key for full access. The connect page has one-click installs for Claude and Cursor, and the dashboard shows your MCP connections.
Connect your client - Improved
Code examples in your language
Every endpoint on the landing and throughout the docs now shows examples in JavaScript, TypeScript, Python, Go, PHP, Ruby and cURL - copy-paste ready in whatever stack you're integrating from.
Quickstart - New
The API developer blog
Ten launch guides covering practical extraction work: pulling design tokens in Python, detecting fonts programmatically, bulk brand-asset extraction, connecting the MCP server, and honest tool comparisons. The developer console also got a full restyle in the same push.
Read the blog - Security
Hardened URL fetching
Every user-supplied URL the API fetches now passes a DNS-resolving SSRF guard that re-validates each redirect hop, and extracted SVGs are sanitized before they're returned. Defense-in-depth for an API whose whole job is fetching the web.
- New
The MiroMiro Extraction API launches
The extraction engine trusted by 20,000+ extension users, exposed as a REST API: code, brand, design tokens, images, SVGs, fonts and Lottie endpoints under one namespace, with credit-based pricing, a no-key playground, and a free tier of 100 credits per month with no card required.
Explore the API
Building with the API? Read the docs or grab a free key - 100 credits a month, no card.