MCP Server

jekcms ships a Model Context Protocol server at /api/mcp/. An agent that supports MCP (Claude Code, Claude Desktop, Cursor, Windsurf) can list, read, draft, update and publish your posts, inspect the content refresh queue and read the AI visibility summary, using the same API key and the same permissions as the REST API.

You do not need to install anything. The endpoint is part of the core, and the keys it accepts are the ones already on Admin → API Keys.

Connecting

Create a key, then register the server with your client. The transport is Streamable HTTP over plain JSON responses; no SSE stream is needed.

claude mcp add --transport http jekcms https://example.com/api/mcp/ \
  --header "Authorization: Bearer YOUR_API_KEY"

For clients configured through JSON:

{
  "mcpServers": {
    "jekcms": {
      "type": "http",
      "url": "https://example.com/api/mcp/",
      "headers": { "Authorization": "Bearer YOUR_API_KEY" }
    }
  }
}

A sub-directory install works the same way: https://example.com/blog/api/mcp/. Opening the URL in a browser returns 405 with a one-line explanation instead of a blank page, so you can quickly check that the address is correct.

Tools

| Tool | What it does | |---|---| | site_info | Site name, URL, language, jekcms version, content counts, the key's own user and role, the llms.txt address | | list_posts | Posts newest first, filtered by status, type, search text or category slug, paged with limit and offset | | get_post | One post by id or slug, with content, categories, tags and SEO fields (focus keyword, meta description, short answer, FAQs) | | create_post | Create a post as a draft, or scheduled if you pass scheduled_at; Markdown or HTML body, with categories, tags and SEO fields in the same call | | update_post | Change any subset of fields on an existing post | | publish_post | Publish a draft through the quality gate, returning the blocking reasons if it is refused | | trash_post | Move a post to trash, restorable from the admin panel | | list_categories | Categories with slug and post count | | list_tags | Tags with slug and post count, top 200 | | get_refresh_queue | The content refresh queue: posts that are losing traffic, have broken links, are out of date, have an old year in the title or lack a short answer, with reasons and a priority score | | get_ai_visibility | AI bot crawl counts per bot and the most-crawled pages, plus visits arriving from AI assistants when analytics is on |

Every tool returns readable text for the model plus structuredContent for anything reading the result programmatically.

Unlike the REST posts endpoint, create_post and update_post accept category names or slugs: an existing category is matched, and an unknown name is created. For this reason, creating categories requires the editor capability and is not allowed for every key.

Permissions and safety

The key's role decides what the agent can do, in the same way as over REST. An author key can change only its own posts; editor and admin keys can change all posts. A key whose role lacks a capability gets an error that names the missing capability.

Nothing an agent writes goes live on its own. create_post always creates a draft, or a scheduled post if you give it a future timestamp; no parameter publishes directly. Going live requires publish_post, and publish_post runs the same quality gate as the admin panel. A refused publish returns its reasons. The agent can read them, fix the post with update_post and try again, so simple problems can be fixed without a person.

Post bodies are treated as an untrusted channel. Markdown is converted to HTML, and the result is sanitised (scripts and event handlers are removed) before it is stored.

A request without a valid key gets HTTP 401 and a JSON-RPC error explaining where to create one. Keys are revoked from Admin → API Keys and take effect on the next call; the last-used time is recorded per key, so you can see whether an agent is still connected.

Protocol notes

JSON-RPC 2.0 over POST /api/mcp/, with 2025-06-18, 2025-03-26 and 2024-11-05 all accepted as protocol versions. Implemented methods are initialize, notifications/initialized, ping, tools/list, tools/call, resources/list (which returns the site's llms.txt) and prompts/list (which is empty). Arrays of requests are handled as batches, and notifications get 202 with no body.