Agilitycms

Agility CMS MCP Server

The official MCP server for Agility CMS: a hosted, remote server that gives your AI tools real-time access to the content, models, pages and media in the Agility instances you already have access to — through conversation, not APIs.

[Official Agility CMS server] [Hosted — nothing to install] [Transport: streamable HTTP] [Auth: OAuth 2.0] [33 tools] [License: Apache 2.0]

Connect your client · What you can ask for · Tools · Data and security · Troubleshooting · Support

There is nothing to install. Point your client at https://mcp.agilitycms.com/api/mcp, sign in with your Agility account, and your assistant can work with the instances you already have access to.

• Endpoint: https://mcp.agilitycms.com/api/mcp (streamable HTTP)
• Auth: OAuth 2.0 against your Agility organization — your Agility permissions are the authority
• Tools: 33, covering content, models, components, containers, pages, sitemaps and media
• Setup guide with screenshots: mcp.agilitycms.com/instructions
• Live tool catalog: mcp.agilitycms.com/tools

Connect your client

One click

[Install in VS Code] [Install in VS Code Insiders] [Install in Cursor] [Install in LM Studio]

Every supported client

Full walkthroughs with screenshots are at mcp.agilitycms.com/instructions. To wire anything up by hand, the only value you need is the endpoint. Details per client follow.

Claude Code

claude mcp add --transport http "Agility-CMS" https://mcp.agilitycms.com/api/mcp

Claude (desktop & web)

Agility CMS is an official connector in Claude's directory, so there is nothing to paste.

On your own account — Customize → Connectors → Discover, search for Agility CMS, and hit Connect, then sign in to Agility when prompted. Or go straight to the entry: https://claude.ai/customize/connectors/directory?q=Agility%20CMS

Pick Agility CMS. Agility CMS Knowledgebase is a separate connector for the documentation site and is marked Custom.

Administering a Team or Enterprise workspace — enable the Agility CMS connector for the organization from your admin settings. That makes it available to everyone, but it connects nobody: each member still signs in to Agility themselves, and their own Agility permissions govern every call. There is no shared or service credential.

If the directory entry has not reached you yet, the endpoint still works on its own — Customize → Connectors → Add, then add it as a custom connector:

https://mcp.agilitycms.com/api/mcp

VS Code (GitHub Copilot)

Command Palette → MCP: Add Server → HTTP, then paste the endpoint. Or add to your MCP config:

{  "servers": {    "agility-cms": {      "type": "http",      "url": "https://mcp.agilitycms.com/api/mcp"    }  }}

Cursor

Settings → MCP → Add new MCP server → type HTTP, URL as above. Or in ~/.cursor/mcp.json:

{  "mcpServers": {    "agility-cms": {      "url": "https://mcp.agilitycms.com/api/mcp"    }  }}

LM Studio

Use the one-click badge above, or add the endpoint under Program → Install → Edit mcp.json:

{  "mcpServers": {    "agility-cms": {      "url": "https://mcp.agilitycms.com/api/mcp"    }  }}

Windsurf

Settings → Cascade → MCP servers → add a server with the endpoint above.

Gemini CLI

gemini mcp add --transport http agility-cms https://mcp.agilitycms.com/api/mcp

Or in ~/.gemini/settings.json:

{  "mcpServers": {    "agility-cms": {      "httpUrl": "https://mcp.agilitycms.com/api/mcp"    }  }}

ChatGPT

Settings → Apps & Connectors → Advanced → Developer mode, then add a connector with the endpoint above.

Anything else

Any client that speaks streamable HTTP works. Give it the endpoint and let it run the OAuth flow — there is no API key to paste and nothing to keep in a config file.

If a client only supports local (stdio) servers, bridge to it with mcp-remote:

{  "mcpServers": {    "agility-cms": {      "command": "npx",      "args": ["-y", "mcp-remote", "https://mcp.agilitycms.com/api/mcp"]    }  }}

That bridge is a general-purpose client-side shim, not an Agility package. There is no agility-mcp-server npm package and there won't be one — a hosted HTTP server has nothing to install, so if you find a config telling you to npx something Agility-named, it's wrong.

What you can ask for

Once it's connected, talk to your assistant about your content — it will pick the tools. Most tools take an instanceGuid (which Agility instance) and, for content, a locale; ask it to list your instances first and it will use the right one from then on.

• "List the Agility instances I can access, then show me the content models in the marketing site."
• "Add a Subtitle text field to the Blog Post model, under the existing SEO tab."
• "Build a Team Member model — name, photo, bio, and a link to their posts — and a container for it."
• "Create a blog post in en-us from this outline and give me the editor link."
• "Which pages in the main channel are still unpublished?"
• "Find everything that mentions the spring sale, and open the newest blog post."
• "Publish the three posts I just created."

Data and security

Authentication is OAuth 2.0 against your Agility organization, over HTTPS. There is no API key to paste and nothing to keep in a config file — tokens are held by your MCP client, not by this repo's configuration or any file you edit.

Your Agility permissions are the ceiling. Every call runs as you: the Management API refuses anything you personally can't do, so the server cannot exceed the access you already have. It follows that the practical way to limit what an assistant can reach is to sign in as an Agility user that only has the access you're willing to give it.

Actions that overwrite data or change the live site are marked. The save tools, reorder_page_modules, delete_*, publish_* and unpublish_* carry destructiveHint: true, so interactive clients can ask before running them. Non-interactive clients don't prompt at all — they require each write tool to be allow-listed instead.

Treat content as untrusted input. This is structural to MCP, not specific to Agility: an assistant reads content items, page text and field descriptions, and any of that can contain text that reads like an instruction (prompt injection). A client that acts on it does so with your permissions. Use clients you trust, leave confirmation prompts on for destructive tools, and don't hand a broadly-privileged Agility account to an unattended agent.

What gets logged. The hosted server records operational telemetry to Agility's Application Insights: the tool or API method called, duration, success or failure, the Agility instance GUID and your Agility user ID. Request and response payloads are recorded in truncated form for debugging (capped, 2 KB by default), so small content values can appear in those logs. There is no client-side opt-out on the hosted server; self-host without APP_INSIGHTS_CONNECTION_STRING to collect nothing.

Available MCP Tools

The Agility CMS MCP Server provides 33 powerful tools organized into categories:

🔍 Discovery Tools

• get_available_instances - List all Agility CMS instances you have access to
• get_current_user - Identify the user the current token authenticates as (read-only whoami)
• get_containers - Access content containers organized by category
• search_instance - Search an instance's content, pages, components, assets, models and containers by text or ID

📋 Model Listing Tools

• get_content_models - Retrieve all content models for an instance
• get_component_models - Access page component models, with each component's thumbnail URL when it has one

🔍 Detail Tools

• get_content_model_details - Get detailed field definitions for a content model
• get_component_model_details - Get detailed field definitions for a component model, and its thumbnail (a picture of what the component looks like on a page)

📝 Content Management Tools

• get_locales - Retrieve available locales for multilingual content
• get_content_items - Fetch multiple content items with filtering and pagination
• get_content_item - Retrieve a single content item by ID
• save_content_items - Create or update content items (returns an editor URL per item)
• publish_content - Publish one or more content items
• unpublish_content - Unpublish (take offline) one or more content items (destructive)
• manage_content_workflow - Approve, decline, or request approval for content items
• delete_content_item - Delete content items (destructive)

📄 Page Management Tools

• get_sitemaps - List all digital channels (sitemaps)
• get_sitemap - Retrieve complete page hierarchy for a channel
• get_page - Retrieve a page by ID
• get_page_models - List available page models (templates)
• save_page_model - Create or update a page model (template) and its content zones
• save_page - Create or update a page
• reorder_page_modules - Reorder modules within a page zone
• publish_page - Publish one or more pages
• unpublish_page - Unpublish (take offline) one or more pages (destructive)
• manage_page_workflow - Approve, decline, or request approval for pages
• delete_page - Delete pages (destructive)

🖼️ Media & Asset Tools

• initialize_media_upload - Get signed upload URLs for media files
• list_media - List media library assets (paged)
• delete_media - Delete a media asset by ID (destructive)

⚡ Model Creation & Management Tools

• save_content_model - Create or update content models
• save_component_model - Create or update component models
• save_container - Create and configure content containers

🔒 Destructive actions are marked. The save tools, reorder_page_modules, delete_*, publish_content / publish_page and unpublish_content / unpublish_page carry destructiveHint: true, so interactive MCP clients prompt before running them ("Allow this tool to run?" — choosing "always allow" opts out). Publishing is marked because it replaces what the live site serves. The approval workflow (approve, decline, request approval) changes nothing live and is not flagged destructive. See Data and security for how permissions and prompting work, and the documentation for the per-tool detail.

📚 Full tool documentation and examples: mcp.agilitycms.com/tools

Supported Field Types

The Agility CMS MCP Server supports 20+ field types for building comprehensive content models:

• 📝 Basic Fields: Text, Long Text, HTML, Boolean, Integer, Decimal, Date
• 🎯 Selection Fields: Dropdown List, Link, Search Listbox, Checkboxes
• 🎨 Media Fields: Image Attachment, File Attachment
• 🔗 Content Relationships: Shared Grid/Link, Nested Grid/Link
• 📂 Organization: Tab Field, Custom Section
• ⚡ Advanced: Complex Object Fields, Custom Field Types, Rich Text Editor

📚 Complete field type documentation: mcp.agilitycms.com/tools

Troubleshooting

Still stuck: [email protected] or our Slack community.

Support and feedback

• 🌐 Website: mcp.agilitycms.com
• 📖 Setup Instructions: mcp.agilitycms.com/instructions
• 🛠️ Tool Catalog: mcp.agilitycms.com/tools
• 📚 Agility CMS Docs: agilitycms.com/docs
• 💬 Support: [email protected]
• 👥 Community: Join our Slack

About this repository

This repository is the public home of the Agility CMS MCP Server — the documentation, the licence and the security policy for the hosted service at https://mcp.agilitycms.com — and of the Agility CMS plugin for Claude.

The Claude plugin

plugins/agility-cms bundles the MCP server with skills for writing and editing content, building pages, publishing, content modeling and front-end development. Install it in Claude Code:

claude plugin marketplace add agility/mcp-serverclaude plugin install agility-cms@agility

The server is a hosted, remote MCP server: there is nothing to install and no package to pull, so there is no build to reproduce here. Its source is maintained by Agility CMS and is not currently published. Everything you need in order to use the server is above.

License

The documentation in this repository is licensed under the Apache License 2.0.

Two things that licence deliberately does not cover:

• The hosted service. https://mcp.agilitycms.com is operated by Agility CMS under Agility's own terms of service. Your use of the service, and of the Agility CMS Management API behind it, is governed by those terms and your Agility subscription.
• The Agility name and marks. Apache 2.0 §6 grants no trademark rights. See NOTICE.

Security reports: SECURITY.md.

Built with ❤️ by Agility CMS — The fastest headless CMS for developers and marketers