mcp-tool-naming — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited mcp-tool-naming (Rules) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
[![NPM Version][npm-shield]][npm-url] [![Contributors][contributors-shield]][contributors-url] [![Forks][forks-shield]][forks-url] [![Stargazers][stars-shield]][stars-url] [![Issues][issues-shield]][issues-url] [![MIT License][license-shield]][license-url] [![Discord][discord-shield]][discord-url]
Transform your content operations with AI-powered tools for Kontent.ai. Create, manage, and explore your structured content through natural language conversations in your favorite AI-enabled editor.
Kontent.ai MCP Server implements the Model Context Protocol to connect your Kontent.ai projects with AI tools like Claude, Cursor, and VS Code. It enables AI models to understand your content structure and perform operations through natural language instructions.
Before you can use the MCP server, you need:
You can run the Kontent.ai MCP Server with npx:
#### STDIO Transport
npx @kontent-ai/mcp-server@latest stdio#### Streamable HTTP Transport
npx @kontent-ai/mcp-server@latest shttpThe server supports two modes, each tied to its transport:
| Transport | Mode | Authentication | Use Case |
|---|---|---|---|
| STDIO | Single-tenant | Environment variables | Local communication with a single Kontent.ai environment |
| Streamable HTTP | Multi-tenant | Bearer token per request | Remote/shared server handling multiple environments |
Configure credentials via environment variables:
| Variable | Description | Required |
|---|---|---|
| KONTENT_API_KEY | Your Kontent.ai key | ✅ |
| KONTENT_ENVIRONMENT_ID | Your environment ID | ✅ |
| appInsightsConnectionString | Application Insights connection string for telemetry | ❌ |
| projectLocation | Project location identifier for telemetry tracking | ❌ |
| manageApiUrl | Custom base URL (for preview environments) | ❌ |
For the Streamable HTTP transport, credentials are provided per request:
/{environmentId}/mcpAuthorization: Bearer <api-key>This allows a single server instance to handle requests for multiple Kontent.ai environments without requiring credential environment variables.
| Variable | Description | Required |
|---|---|---|
| PORT | Port for HTTP transport (defaults to 3001) | ❌ |
| appInsightsConnectionString | Application Insights connection string for telemetry | ❌ |
| projectLocation | Project location identifier for telemetry tracking | ❌ |
| manageApiUrl | Custom base URL (for preview environments) | ❌ |
Content returned by this server (for example, an element written by an editor) can contain text that a connected LLM interprets as instructions — indirect prompt injection. A hijacked agent could be steered into destructive tool calls (delete / unpublish / overwrite) or into leaking unpublished drafts. This is an industry-wide, unsolved problem that the server cannot reliably fix by transforming the content it returns, so defense is layered:
readOnlyHint, create-only tools are additive, and tools that overwrite or remove data are destructiveHint — which compliant clients use to auto-approve reads and prompt before destructive calls. Run the server with such a client and avoid headless auto-approve setups against a write-capable key.These are hints, not guarantees. Report security issues privately to [email protected].
To run the server with STDIO transport, configure your MCP client with:
{
"kontent-ai-stdio": {
"command": "npx",
"args": ["@kontent-ai/mcp-server@latest", "stdio"],
"env": {
"KONTENT_API_KEY": "<management-api-key>",
"KONTENT_ENVIRONMENT_ID": "<environment-id>"
}
}
}Streamable HTTP transport serves multiple Kontent.ai environments from a single server instance. Each request provides credentials via URL path parameters and Bearer authentication.
First start the server:
npx @kontent-ai/mcp-server@latest shttp<details> <summary><strong>VS Code</strong></summary>
Create a .vscode/mcp.json file in your workspace:
{
"servers": {
"kontent-ai-multi": {
"uri": "http://localhost:3001/<environment-id>/mcp",
"headers": {
"Authorization": "Bearer <management-api-key>"
}
}
}
}For secure configuration with input prompts:
{
"inputs": [
{
"id": "apiKey",
"type": "password",
"description": "Kontent.ai API Key"
},
{
"id": "environmentId",
"type": "text",
"description": "Environment ID"
}
],
"servers": {
"kontent-ai-multi": {
"uri": "http://localhost:3001/${inputs.environmentId}/mcp",
"headers": {
"Authorization": "Bearer ${inputs.apiKey}"
}
}
}
}</details>
<details> <summary><strong>Claude Desktop</strong></summary>
Update your Claude Desktop configuration file:
~/Library/Application Support/Claude/claude_desktop_config.json%APPDATA%\Claude\claude_desktop_config.json~/.config/Claude/claude_desktop_config.jsonUse mcp-remote as a proxy to add authentication headers:
{
"mcpServers": {
"kontent-ai-multi": {
"command": "npx",
"args": [
"mcp-remote",
"http://localhost:3001/<environment-id>/mcp",
"--header",
"Authorization: Bearer <management-api-key>"
]
}
}
}</details>
<details> <summary><strong>Claude Code</strong></summary>
Add the server using the CLI:
claude mcp add --transport http kontent-ai-multi \
"http://localhost:3001/<environment-id>/mcp" \
--header "Authorization: Bearer <management-api-key>"Note: You can also configure this in your Claude Code settings JSON with theurlandheadersproperties.
</details>
[!IMPORTANT] Replace<environment-id>with your Kontent.ai environment ID (GUID) and<management-api-key>with your key.
# Clone the repository
git clone https://github.com/kontent-ai/mcp-server.git
cd mcp-server
# Install dependencies
npm ci
# Build the project
npm run build
# Start the server
npm run start:stdio # For STDIO transport
npm run start:shttp # For Streamable HTTP transport
# Start the server with automatic reloading (no need to build first)
npm run dev:stdio # For STDIO transport
npm run dev:shttp # For Streamable HTTP transportsrc/ - Source codetools/ - MCP tool implementationsclients/ - Kontent.ai API client setupschemas/ - Data validation schemasutils/ - Utility functionserrorHandler.ts - Standardized error handling for MCP toolsthrowError.ts - Generic error throwing utilityserver.ts - Main server setup and tool registrationbin.ts - Single entry point that handles both transport typesFor debugging, you can use the MCP inspector:
npx @modelcontextprotocol/inspector -e KONTENT_API_KEY=<key> -e KONTENT_ENVIRONMENT_ID=<env-id> node path/to/build/bin.jsOr use the MCP inspector on a running streamable HTTP server:
npx @modelcontextprotocol/inspectorThis provides a web interface for inspecting and testing the available tools.
To release a new version:
npm version [patch|minor|major] - this updates package.json, package-lock.json, and syncs to server.jsonMIT
[contributors-shield]: https://img.shields.io/github/contributors/kontent-ai/mcp-server.svg?style=for-the-badge [contributors-url]: https://github.com/kontent-ai/mcp-server/graphs/contributors [forks-shield]: https://img.shields.io/github/forks/kontent-ai/mcp-server.svg?style=for-the-badge [forks-url]: https://github.com/kontent-ai/mcp-server/network/members [stars-shield]: https://img.shields.io/github/stars/kontent-ai/mcp-server.svg?style=for-the-badge [stars-url]: https://github.com/kontent-ai/mcp-server/stargazers [issues-shield]: https://img.shields.io/github/issues/kontent-ai/mcp-server.svg?style=for-the-badge [issues-url]: https://github.com/kontent-ai/mcp-server/issues [license-shield]: https://img.shields.io/github/license/kontent-ai/mcp-server.svg?style=for-the-badge [license-url]: https://github.com/kontent-ai/mcp-server/blob/master/LICENSE.md [discord-shield]: https://img.shields.io/discord/821885171984891914?color=%237289DA&label=Kontent.ai%20Discord&logo=discord&style=for-the-badge [discord-url]: https://discord.com/invite/SKCxwPtevJ [npm-url]: https://www.npmjs.com/package/@kontent-ai/mcp-server [npm-shield]: https://img.shields.io/npm/v/%40kontent-ai%2Fmcp-server?style=for-the-badge&logo=npm&color=%23CB0000
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.