Aem Mcp Server — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited Aem Mcp Server (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
AEM MCP Server is a full-featured Model Context Protocol (MCP) server for Adobe Experience Manager (AEM). It provides a simple integration with any AI Agent. This project is designed for non-technical persons who want to manage AEM via natural language.
npx (recommended, zero install) and streamable HTTPNo installation needed — the AI agent downloads and spawns the process automatically via npx.
Add to your project's MCP config (.mcp.json, .vscode/mcp.json, .cursor/mcp.json, etc.):
{
"mcpServers": {
"AEM": {
"command": "npx",
"args": ["-y", "aem-mcp-server", "-t", "stdio", "-H", "http://localhost:4502", "-u", "admin", "-p", "admin"]
}
}
}Secrets: Since MCP config files are typically committed to the repo, avoid hardcoding credentials. Use your client's env var syntax instead:
>
| Client | Syntax | |---|---| | Claude Code (.mcp.json) |${AEM_PASSWORD}or${AEM_PASSWORD:-admin}| | VS Code / Copilot |${input:aem-password}(prompts securely) orenvFile| | Cursor |${env:AEM_PASSWORD}|
>
Example with env var references (Claude Code): ``json { "mcpServers": { "AEM": { "command": "npx", "args": ["-y", "aem-mcp-server", "-t", "stdio", "-H", "${AEM_HOST:-http://localhost:4502}", "-u", "${AEM_USER:-admin}", "-p", "${AEM_PASSWORD:-admin}"] } } } ``For scenarios where you need a persistent server (shared team server, multiple clients connecting simultaneously, etc.), install globally and start the server manually:
npm install aem-mcp-server -g
aem-mcp -H=http://localhost:4502 -u=admin -p=adminThen point your AI agent to the URL:
{
"mcpServers": {
"AEM": {
"url": "http://127.0.0.1:8502/mcp"
}
}
}Options:
--version Show version number [boolean]
-H, --host [string] [default: "http://localhost:4502"]
-u, --user [string] [default: "admin"]
-p, --pass [string] [default: "admin"]
-i, --id clientId [string] [default: ""]
-s, --secret clientSecret [string] [default: ""]
-m, --mcpPort [number] [default: 8502]
-t, --transport Transport mode: http (default) or stdio
[string] [choices: "http", "stdio"] [default: "http"]
-I, --instances Named AEM instances: "local:http://localhost:4502:admin:admin
,qa:https://qa.example.com:user:pass" [string] [default: ""]
-h, --help Show help [boolean]Authentication:
clientId and clientSecret for OAuth S2S authentication. More info.user/pass. Default credentials are admin:admin.Multi-instance: Connect to multiple AEM instances simultaneously:
aem-mcp --instances "author:http://localhost:4502:admin:admin,publish:http://localhost:4503:admin:admin"All tools will get an instance parameter to target a specific instance.
resources/list, eliminating discovery roundtripsgroup, readOnly, and complexity so agents can make smarter tool selection decisionsverbosity parameter (summary/standard/full) on content-reading tools strips JCR internals and truncates long textsuggestion and alternatives fields for self-healing agent workflowsmanageContentFragment action mergeJsonField) for CFs that store a whole key→value map inside one JSON-encoded fieldOnce configured in your AI IDE, just ask in natural language:
List all components on MyPageSome Content Fragments store an entire key→value map inside a single field as a JSON-encoded string. To upsert a few keys without round-tripping the whole blob, use the mergeJsonField action — the read-merge-write happens server-side:
{
"action": "mergeJsonField",
"fragmentPath": "/content/dam/<site>/.../labels",
"field": "CFMValue", // the field holding the JSON string
"jsonPointer": "/0/content/0/value", // RFC-6901 pointer to the object to merge into ("" = field root)
"merge": { "search": "Search", "clear_search": "Clear search" },
"variation": "master" // default: master
}New keys are added, existing keys overwritten (deep-merge), and untouched keys preserved. The response reports the keys added/overwritten and the before/after key count at the pointer.
The server exposes read-only MCP resources so agents can discover AEM catalogs without tool calls:
| Resource URI | Description |
|---|---|
aem://{instance}/components | All components (name, resourceType, title, group) |
aem://{instance}/sites | Site roots and language structure under /content |
aem://{instance}/templates | Available page templates (path, title) |
aem://{instance}/workflow-models | Workflow models (ID, title, description) |
Resources return summary data only. In multi-instance mode, each instance gets its own set of resource URIs.
For detailed API documentation, please refer to the API Docs.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.