MCP Server

jekcms ships a built-in Model Context Protocol server at /api/mcp/. AI agents that speak MCP — Claude Code, Claude Desktop, Cursor, Windsurf and others — can list, read, draft, update and publish your posts, inspect the content refresh queue and read the AI visibility summary, all with the same permissions your REST API key has.

There is nothing to install on the server. The endpoint is part of the core and uses the API keys you already manage under Admin → API Keys.

Connect

Create an API key in Admin → API Keys, then register the server with your client. The transport is Streamable HTTP (JSON responses; no SSE stream is required).

Claude Code

claude mcp add --transport http jekcms https://example.com/api/mcp/ \
  --header "Authorization: Bearer YOUR_API_KEY"

Claude Desktop / Cursor / Windsurf (JSON config)

{
  "mcpServers": {
    "jekcms": {
      "type": "http",
      "url": "https://example.com/api/mcp/",
      "headers": { "Authorization": "Bearer YOUR_API_KEY" }
    }
  }
}

Sub-directory installs work the same way: https://example.com/blog/api/mcp/.

Tools

| Tool | What it does | |------|--------------| | site_info | Site name, URL, language, version, content counts, llms.txt address | | list_posts | List posts by status, type, search text or category; paginated | | get_post | One post with content, categories, tags and SEO fields (focus keyword, meta description, short answer, FAQs) | | create_post | Create a post as draft (or scheduled). Markdown or HTML body; categories, tags, SEO fields and the GEO short answer in one call | | update_post | Change any subset of fields on an existing post | | publish_post | Publish a draft through the site's quality gate; returns the blocking reasons if it is refused | | trash_post | Move a post to trash (restorable from the admin panel) | | list_categories, list_tags | Taxonomies with post counts | | get_refresh_queue | The content refresh queue: posts losing traffic, with broken links, stale, with an old year in the title, or missing a short answer — with reasons and a priority score | | get_ai_visibility | AI bot crawl activity per bot and top crawled pages; visits arriving from AI assistants when analytics is on |

Every tool returns readable text plus structuredContent for programmatic use.

Permissions and safety

• The key's role decides what is allowed, exactly as in the REST API: authors touch only their own posts, editors and admins everything; categories can be created only by editors and admins.
• New posts are drafts unless you schedule them. Nothing goes live without publish_post, and publish_post runs the same quality gate as the admin panel (thin content, missing cover, duplicate title and the rest). A refused publish returns the reasons so the agent can fix them with update_post and try again.
• Post bodies are treated as an untrusted channel: Markdown is converted to HTML, scripts and event handlers are stripped.
• Requests without a valid key get HTTP 401 with a JSON-RPC error. Keys can be revoked at any time from Admin → API Keys; the last-used time is recorded per key.

Protocol notes

• JSON-RPC 2.0 over POST /api/mcp/. Supported protocol versions: 2025-06-18, 2025-03-26, 2024-11-05.
• initialize, notifications/initialized, ping, tools/list, tools/call, resources/list (exposes llms.txt) are implemented. GET returns 405 with a short explanation.
• Batches (arrays of requests) are accepted.