dembrandt
Extract any website’s design system into tokens in seconds: logo, colors, typography, borders & more. One command.
No outside reports on file
The main risk is that a malicious or compromised website could include hidden instructions or malformed data in its design tokens, tricking the AI into misunderstanding the tokens or executing unintended actions.
Based on public adoption and transparency signals as of Oct 21, 2026. Our opinion, not a code audit or security guarantee.
What it can access
- Local filesReads & writes local foldersREVIEW
- Command executionNo shell command runner notedLOW
- Network reachLocal or standard API callsLOW
- CredentialsRequires API key or tokenREVIEW
- Package sourceGitHub (dembrandt/dembrandt)PUBLIC
Inferred from this listing’s public package details and description. Check the project’s source before installing.
Install
No npm or PyPI package is listed. Install from source: github.com/dembrandt/dembrandt ↗
About Dembrandt
This tool analyzes websites and extracts their design system—colors, fonts, logos, borders, spacing—and converts them into structured tokens. It aims to speed up the process of documenting or reusing a website's visual design rules.
Who it’s for
Designers, developers, and teams who want to quickly pull design tokens from existing websites instead of manually cataloging them. Useful for auditing a site's design consistency or jumpstarting a design system.
Alternatives
- Figma API: Official design tool integration for extracting tokens from Figma projects.
- Storybook: Component library tool that documents design tokens natively.
- Style Dictionary: Open-source tool for managing design tokens across platforms.
- Theo: Salesforce's design token parser for multiple file formats.
Setup
Check these steps against the project’s own instructions before running anything.
Follow the project's README for installation and usage instructions.
Why this grade
Signal-based grade (3/7 points): well starred on GitHub, public source code. This reflects adoption and transparency, not a code review.
Popularity and upkeep
- GitHub stars
- 3.9k
- Listing last refreshed
- 2026-10-28
These are public popularity signals, not a maintenance check. Look at the repository’s commit history and open issues.
Security reports
No reports found for this package in our research (last checked 2026-10-29).
Risks to watch for
- Website access: The tool fetches and analyzes any URL you give it, so it can retrieve content from private sites if you have access.
- AI misinterpretation: Visual elements on a webpage can be misleading—attackers could hide malicious instructions or misleading color values in images or CSS that the tool might extract and pass to an AI model.
- Token injection: Malicious websites could embed code or special characters in design token data (like font names or color hex values) that confuse downstream tools or the AI.
- Local file exposure: If the tool processes local files, an attacker could craft a file that leaks design tokens or metadata from sensitive projects.
- Third-party dependency risk: The tool likely depends on libraries for parsing CSS, images, and web content; vulnerabilities in those libraries could be exploited.
How to lower the risk
Least-privilege permissions
- Only grant the tool access to websites and projects you fully trust.
- Avoid running it on competitor sites or unknown domains.
Network isolation
- Run the tool in an isolated environment if analyzing untrusted websites.
- Log and review all URLs the tool fetches.
Monitoring
- Check extracted tokens for suspicious content before using them.
- Watch for unusual font names, color values, or metadata.
Red flags to watch for
- Websites with altered or obfuscated CSS or inline styles.
- Design tokens containing code-like strings or special characters.
- Unexpected changes in token output from the same website.
Questions
How do I install Dembrandt?
Dembrandt does not publish a standalone npm or PyPI package. Clone or follow the setup instructions in its source repository at github.com/dembrandt/dembrandt.
Are there security reports about Dembrandt?
No reports found for this package in our research (last checked 2026-10-29). Dembrandt currently holds Grade C (Moderate risk signals) based on public adoption and transparency signals. Key risk areas to watch include website access, ai misinterpretation, token injection.
Is Dembrandt actively maintained?
Dembrandt has 3.9k GitHub stars. Our directory data was last refreshed on 2026-10-28. Check recent commit activity, release tags, and open issues at github.com/dembrandt/dembrandt before pinning it in production.
What are alternatives to Dembrandt?
Notable alternatives to Dembrandt include Figma API (Official design tool integration for extracting tokens from Figma projects), Storybook (Component library tool that documents design tokens natively), Style Dictionary (Open-source tool for managing design tokens across platforms), Theo (Salesforce's design token parser for multiple file formats). You can also compare Dembrandt side by side with other MCP servers in the Related tools section on this page.
README badge and team notes
Maintain or use Dembrandt? Show its live grade in your GitHub README, docs site, or run a check from the terminal before you install.
GitHub README Markdown:
[](https://agentarmorhq.com/skills/dembrandt-dembrandt)HTML embed:
<a href="https://agentarmorhq.com/skills/dembrandt-dembrandt"><img src="https://agentarmorhq.com/api/badge/dembrandt-dembrandt" alt="AgentArmorHQ Risk Grade for Dembrandt" height="20" /></a>Terminal check:
curl -fsSL https://agentarmorhq.com/api/cli | node --input-type=module - check "dembrandt-dembrandt"Share with your security lead
Need sign-off to use dembrandt? Copy this note for Slack, a ticket or a pull request.
### AgentArmorHQ Security Review Memo: dembrandt
- **Listing URL:** https://agentarmorhq.com/skills/dembrandt-dembrandt
- **Type:** App connector
- **Risk Grade:** Grade C (Moderate risk signals)
- **Outside Security Advisories on File:** 0
- **Public Adoption:** 3.9k GitHub stars
#### Permission & Blast-Radius Signals
- **Local files:** Reads & writes local folders
- **Command execution:** No shell command runner noted
- **Network reach:** Local or standard API calls
- **Credentials:** Requires API key or token
- **Package source:** GitHub (dembrandt/dembrandt)
#### Recommended Hardened Setup
- **Source Repo:** https://github.com/dembrandt/dembrandt
- **Controls:** Pin an exact version in `.mcp.json`, scope access to a single workspace folder, and use a least-privilege read-only token where supported.
_Based on public adoption and transparency signals as of Oct 21, 2026. Our opinion, not a code audit or security guarantee._Key facts
- Type
- App connector
- Publisher
- dembrandt
- Source code
- github.com/dembrandt/dembrandt
- Est. context load
- ~850 tokens / turn (~5 tool schemas, 0.43% of 200k context)
- Popularity
- 3.9k GitHub stars
- Last updated
- 2026-10-28
- Last graded
- 2026-10-21
Community
Discussions for Dembrandt
Ask questions or share configuration tips. Governed by our Community Rules & Terms.
No posts match this filter yet.
Be the first to ask a question or share a working tip.
Check before you install, in Claude
Your assistant answers Block, Review or No known issues for any package before it installs it.
Get this check inside Claude