Concrete CMS MCP server

hissy · December 26, 2025, 6:07am

Hello community!

Want to publish blog posts to Concrete CMS directly from Claude?
Want to let an AI agent suggest improvements to the content on your Concrete CMS site?

If you’ve ever thought “It would be great if AI could just talk to my CMS” –
that’s exactly what an MCP server for Concrete CMS is for.

I’ve built one and released it as open source under the MIT License
Feel free to try it out, experiment, and see what kinds of workflows you can unlock.

Feedback, ideas, and contributions are more than welcome.
Hope it’s helpful to make your life easier!

Japanese blog post:

katalysis · March 25, 2026, 2:11pm

I used this for the first time this week.

It enabled Claude to quickly provide a long list of .htaccess redirects for an updated site when compared to the indexed pages from Google Search Console.

Lots of time saved – what a useful tool! Looking forward to exploring it further - thank you @hissy

hissy · March 26, 2026, 11:36am

Wow, what an impressive use case!

bcorner2026 · June 15, 2026, 9:28am

Hey there @hissy — I’ve been trying out the concretecms-mcp-server and hit a wall on the build (`npm run build` fails with 17 TypeScript errors out of the box). I dug in, and it came down to a few small things, so I’ve put up two PRs against MacareuxDigital/concretecms-mcp-server:

#6 — Fix dependency vulnerabilities and resync lockfile: the committed `package-lock.json` is out of sync (so `npm ci` fails), and `npm audit` flagged 10 vulnerabilities (6 high, 4 moderate). This resyncs the lockfile and clears all of them — no changes to the declared dependencies.

#7 — Fix TypeScript build (17 errors) + add CI: adds the missing `@types/node`, fixes a `toolMode` → `toolsMode` config typo, tightens the env-var typing, and adds a GitHub Actions build (Node 20 / 22 / 24) so this kind of breakage gets caught automatically.

After both, `npm ci && npm run build` are green, and `npm audit` is clean.

Credit where due — @mlocati had already spotted the stale lockfile (#1) and proposed the `node:` import prefixes (#4) back in March; my PRs build on those findings. Would love a maintainer’s eyes on these when there’s a chance. Happy to

adjust anything.

bcorner2026 · June 15, 2026, 11:00am

thanks for the fast response! Now onto testing!

hissy · July 11, 2026, 9:53am

Great news!

The Concrete CMS MCP Server now supports Streamable HTTP transport in addition to the original stdio transport.

This is an important milestone because it means the MCP server is no longer limited to local development. With Streamable HTTP, it can now be deployed as a network service, making it suitable for production environments and remote AI clients.

If you’re interested in building AI assistants, AI-powered content workflows, or MCP integrations for Concrete CMS, now is a great time to give it a try.

As always, feedback, issues, and pull requests are very welcome!

c5dragon · July 15, 2026, 1:29pm

Should have checked Trivago…

Maybe read the docs once in a while.
AI didn’t get me the right answer.

github.com/MacareuxDigital/concretecms-mcp-server

docs/remote-server.md

main

# Remote MCP Server Guide

Use remote mode when a remote MCP client needs to connect over HTTP instead of spawning a local stdio process. This is useful for hosted AI agents, CMS dashboards, and custom MCP clients.

You can also run HTTP mode on your local machine to test an AI agent before deploying — see **[Test HTTP mode locally](#test-http-mode-locally)**.

The server exposes a [Streamable HTTP](https://modelcontextprotocol.io/specification/2025-03-26/basic/transports) MCP endpoint and persistent OAuth routes.

For local stdio mode (Claude Desktop spawning the process), see the [main README](../README.md).

For building MCP clients and AI agents that call this server, see the **[MCP Client Developer Guide](mcp-client-guide.md)**.

## Client integration

Remote clients authenticate with `Authorization: Bearer <MCP_API_KEY>` and identify the CMS user with `X-Concrete-User-Id` on every `/mcp` request.

| Integration | Description |
|-------------|-------------|
| **Backend agent** | Your service calls `/mcp` and OAuth admin routes |
| **Web app proxy** | Your API forwards to `/mcp`; API key stays server-side |

This file has been truncated. show original

hissy · July 16, 2026, 12:15am

@c5dragon

If you want to use it from your local Claude Desktop, you can follow the “Connect your LLM to the local Concrete CMS MCP Server” section in the README.

github.com/MacareuxDigital/concretecms-mcp-server

README.md

main

# Concrete CMS MCP Server

A [Model Context Protocol (MCP)](https://modelcontextprotocol.io/) server for [Concrete CMS](https://www.concretecms.org) built with TypeScript.

## Installation

```bash
git clone https://github.com/MacareuxDigital/concretecms-mcp-server.git
cd concretecms-mcp-server
npm ci && npm run build
```

## Usage

### Enable API in Concrete CMS

Since the MCP server uses the Concrete CMS API, you need to enable it in your Concrete CMS installation first.
Please refer to the [Concrete CMS documentation](https://documentation.concretecms.org/9-x/developers/rest-api/introduction) for more information.

### Connect your LLM to the local Concrete CMS MCP Server

This file has been truncated. show original

c5dragon · July 16, 2026, 11:46am

Works with (mcp local + claude desktop + remote website)
Added the following in Redirect URI on the API page.

http://localhost:3000/callback

Redacted screenshot info

c5dragon · July 22, 2026, 10:40am

I’m trying to figure out how to upload files through (this) MCP.

Made (Codex made) a separate part which connects through the API directly.
Connects as user which is allowed to upload.

hissy · July 23, 2026, 4:16am

It seems your previous problem was related to the permission issue.

c5dragon · July 23, 2026, 7:11am

The error was misleading, and got in the wrong rabbit hole.

For future reference:
The REST controller executes this check:

if (!$fp->canAddFileType(
    $cf->getExtension($uploadedFile->getClientOriginalName())
)) {
    return $this->error(
        Importer::getErrorMessage(Importer::E_FILE_INVALID_EXTENSION),
        403
    );
}

Therefore, 403: “Invalid file extension” actually means:

The current API user is not permitted to add a .jpg file to this folder.

For this MCP the scope: files:add files:update is not enough.
It needs a user to verify against. + the actual file. Claude corrupts the file.

Maybe somethings to add later in this MCP / Or allow the api to do this without the user?

hissy · July 23, 2026, 8:57am

Good point, but that is a topic on the REST API side. I believe we have an issue to discuss about this, but I forgot the URL…