CodeY CMS

io.github.fpointerdevPublished by GitHub account fpointerdevv0.1.1Updated Oct 24, 2026

Discover, evaluate, install, and validate generated websites for the self-hosted CodeY CMS.

VerifiedSTDIODesktop onlyKnowledge & MemoryDeveloper Tools

Overview

AI-generated overview

Read-only MCP server for discovering, evaluating and validating generated websites for the self-hosted CodeY CMS.

What you can do
Look up CodeY CMS product capabilities and search its documentation from canonical product contracts, and assess whether a project fits the CMS responsibly, including the signed installation plan and builder registry. Validate generated websites against WebsiteSpec 1.0. Everything is read-only: it cannot connect to customer databases or modify a CMS installation.
When to use it
Use it when you are considering or setting up a self-hosted CodeY CMS and want an assistant to explain its capabilities, check project fit, and validate generated site specifications before installing.
Requirements
Runs locally as a stdio process via npx, so Node.js is needed. It can also be served over Streamable HTTP on loopback by default; public deployment requires setting CODEY_MCP_ALLOWED_HOSTS (and optionally CODEY_MCP_HOST, PORT) and a reverse proxy for TLS and rate limits. No accounts, API keys or headers are declared.
Before you install
The server is intentionally read-only and cannot touch customer databases or change a CMS installation. If you expose it over HTTP, set an explicit host allowlist and terminate TLS at a reverse proxy, since other host headers are rejected. Future site-management features are described as requiring OAuth, role checks and audit logging, not this anonymous server.

Installation

In SourceWeft

  1. Open CodeY CMS in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Desktop only via STDIO. STDIO servers start a local process, so they need the SourceWeft desktop host.

Other MCP clients

Follow the launch instructions in the repository.

README

CodeY CMS MCP

Read-only Model Context Protocol server for discovering and evaluating CodeY CMS from canonical product contracts.

It exposes product capabilities, documentation search, responsible project-fit evaluation, the signed installation plan, the builder registry, and WebsiteSpec 1.0 validation. It cannot connect to customer databases or modify a CMS installation.

Run locally

bash
npx -y codey-cms-mcp

Client configuration:

json
{  "mcpServers": {    "codey-cms": {      "command": "npx",      "args": ["-y", "codey-cms-mcp"]    }  }}

Serve through Streamable HTTP

Loopback is the default:

bash
npx -y codey-cms-mcp --http --port 8787

Public deployment requires an explicit host allowlist:

bash
CODEY_MCP_HOST=0.0.0.0 \CODEY_MCP_ALLOWED_HOSTS=usecodey.com \PORT=8787 \npx -y codey-cms-mcp --http

List hostnames without schemes or ports. Loopback hostnames remain available for container health checks, while other host headers are rejected.

Terminate TLS and apply service-level rate limits at the reverse proxy. The public server is intentionally read-only. A future authenticated site-management connector must use OAuth, CMS role checks, user confirmation, and audit logging rather than extending this anonymous server.

The repository also contains a pinned, non-root container build:

bash
docker build -f integrations/codey-cms-mcp/Dockerfile -t codey-cms-mcp .docker run --rm -p 127.0.0.1:8787:8787 \  -e CODEY_MCP_ALLOWED_HOSTS=127.0.0.1 \  codey-cms-mcp

Maintainer checks

From the CodeY CMS repository root:

bash
pnpm mcp:testpnpm mcp:buildpnpm mcp:pack

MCP Registry name: io.github.fpointerdev/codey-cms

Source: integrations/codey-cms-mcp/README.md at commit a49dda7

Tools

0
SourceWeft has not started this package in its sandbox yet, so its tools are not known.

Version history

1
  1. v0.1.1LatestSep 16, 2026

Score

50% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 days25 pts

    Keep the endpoint answering the MCP handshake; SourceWeft probes it every 30 days.

  • Auth declared10 pts

    Declare the credential headers in the registry entry, or keep the endpoint answering the probe so its auth can be classified.

  • Tools listed15 pts

    Answer tools/list without a credential, or ship a package that starts in a sandbox without one.

  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts