Private MCP | Automad

In order to let an AI agent manage the content of your site, an MCP client has to authenticate with an access token. Authenticated clients can use all tools of the MCP server. They can read drafts and private pages, inspect templates, snippets and components, and create, edit, publish, move and delete pages.

Setup

Before a client can connect, it needs an access token. The following sections show how to create and revoke tokens.

Creating an Access Token

Access tokens are managed in the Authentication area of the MCP Server section in the System Settings. Follow these steps to create a new token:

Click Add token.
Enter a name and optionally a short description that helps you to identify the client that uses the token later.
Click Create token.
Copy the token right away. For security reasons, it is only displayed once and can't be retrieved afterwards.

Tokens start with am_ and don't expire. Automad only stores a hash of each token together with its name, its description, its first characters and the creation date. The list of existing tokens only shows that preview in order to identify a token.

Revoking a Token

Click the trash icon (Revoke) next to a token in the list and confirm the dialog in order to delete it. Any client that uses a revoked token immediately loses access to the private tools of your site.

Connecting a Client

The token has to be sent as a bearer token in the Authorization header of every request:

Authorization: Bearer <token>

After creating a token, the dashboard displays ready-to-use configuration snippets that already contain the URL of your site and the new token. For Claude Code, a site can be added by running the following command:

claude mcp add --transport http \
  mysite \
  https://yoursite.com/mcp \
  --header "Authorization: Bearer <token>"

Alternatively, the server can also be added to the .mcp.json file of a project:

{
  "mcpServers": {
    "mysite": {
      "type": "http",
      "url": "https://yoursite.com/mcp",
      "headers": {
        "Authorization": "Bearer <token>"
      }
    }
  }
}

Other MCP clients work similarly. Any client that supports remote servers using the Streamable HTTP transport together with a custom Authorization header can connect to Automad. OAuth is not supported.

Available Tools

Besides all public tools, authenticated clients can use the following tools:

Tool	Description
`component_list`	Lists all available components.
`page_template_list`	Lists the installed themes and templates including their content fields.
`pagelist_template_list`	Lists the templates for pagelist blocks including their source code.
`filelist_template_list`	Lists the templates for filelist blocks including their source code.
`snippet_list`	Lists the snippet files including their source code.
`page_create`	Creates a new page. New pages are saved as drafts.
`page_update`	Updates the title, settings, tags and content of a page. Changes are saved as drafts.
`page_publish`	Publishes the draft of a page.
`page_duplicate`	Duplicates a single page without its subpages.
`page_move`	Moves a page to a new parent page.
`page_reorder_children`	Changes the order of the subpages of a page.
`page_delete`	Moves a page including all of its subpages to the trash after a confirmation.
`file_import`	Downloads a file from a URL and attaches it to a page or to the shared files.

All block types of the block editor can be used when creating or updating pages. Imported files must match the list of allowed file types of your installation and files with the same name are overwritten. Before connecting an agent, make sure to read about the safety considerations.