MCP agent
A site token instead of server root: this is how you delegate a website to an AI without handing it your infrastructure. Every site can give an agent — any MCP client — a remote control: the /mcp endpoint speaks the Model Context Protocol over HTTP. A site token carries an ADMINISTRATOR’s reach over its own site — content, media, settings, and the templates the admin panel itself is built from — and stops exactly there: never a neighbouring site, never the server. The server stores only the token’s hash; the raw token is shown once, at issue time.
Two consequences worth knowing before you issue one. Revoking closes the door but does not undo what the agent already wrote — a rollback is your backups. And an agent that can edit hbs/ can change the admin interface you sign in to, so the token is worth exactly as much as the admin password: rotate it on suspicion, and hand it only to an agent you trust that far.
| action | where |
|---|---|
| issue / rotate | the admin’s MCP agent page (shows status, issue date, agent last seen) — or cms mcp token --site example.com |
| revoke | the same page or cms mcp revoke --site example.com — closes the /mcp zone for that scope immediately |
| IP allowlist | the same page: exact addresses or CIDR subnets, applied instantly; empty = any IP. The page suggests your current IP — one click adds it (the agent may connect from a different address) |
| connect | the client sends Authorization: Bearer <token> to https://example.com/mcp — the site’s own domain; the endpoint answers only its exact Host — a token never opens a neighbour site |
Server scope — a different order of trust. The first-run summary also prints a SERVER token, and it is not “a site token that works everywhere”: it IS the node. It creates sites and takes them off the map, wires domains and TLS, and calls every site tool on ANY site by naming it. Give it to an agent only when you mean “run my whole server”; when you mean “run this one website”, issue that site’s own token in its /cms and keep the server key to yourself. cms mcp token / cms mcp revoke without --site manage it. An agent with the server token can create a site, then fill it over that site’s own MCP — see Sites & domains.
Sizes. A file the agent reads or writes travels whole through memory — as JSON text, or as base64 for binaries. The site’s mcp block sets the ceilings: max_file_size (default 100m) is the largest file the fs tools will read, edit, write or scan during a search, and max_search_matches (default 100) is how many hits one search returns. Writing also passes through the request limit, mcp.max_body_size in the ROOT block — base64 adds a third, so a 10m file wants roughly 14m of body, and cms check tells you when the two disagree.
Every /mcp call lands in the request log like any other request, and the admin page shows when the agent was last seen.