Agility CMS
by Agility CMS
Model content, author pages and publish to a live website from an AI agent. Agility documents 32 tools; Anthropic's directory lists 27 and omits every publish and unpublish tool. OAuth 2.0, no application scopes.
Verified connector
Listed by Anthropic as a partner connector in its Connectors Directory.
Connection checked by Agentman on .
Anthropic states this reflects the level of review a connector received, not a security audit.
Connect Agility CMS via MCP
https://mcp.agilitycms.com/api/mcpWorks in any MCP-compatible client. In Agentman Studio it is one click — no config file to edit.
Agility CMS Tools & Capabilities (27)
Tool names from Anthropic's directory listing. This server requires sign-in, so we could not read tool descriptions or parameter schemas.
Limits
- Anthropic's listing is five tools short, and the gap is the publish path. The directory's 27 names are a strict subset of the 32 Agility documents. Do not audit this connector from the directory entry alone — it contains no publish verb, and the connector publishes.
- No application scopes exist. The authorization server at
https://mcp.agilitycms.comadvertises exactly one scope,offline_access, which governs refresh-token lifetime rather than access. The RFC 9728 resource descriptor declares noscopes_supportedat all. There is no way to grant reading without also granting publishing and deleting. - The only real boundary is which Agility user you sign in as. Agility says so directly: your account permissions are the ceiling and the Management API refuses what that user cannot do. A broadly-privileged account grants a broadly-privileged agent.
- The confirmation gate depends on your MCP client, not on the server. Where a client does not support MCP elicitation, Agility states the action runs and the response merely records
humanConfirmed: false. Choosing "always allow" in any client also opts out, and Agility notes the server cannot override that. - The approval workflow is not an oversight gate against an agent. Agility documents
approve,declineandrequest-approvalas "not gated (low risk)", so an agent can request and grant approval on the same item. - The two vendor sources disagree about which tool publishes. The documentation page attributes publishing to
manage_content_workflow; the live catalog attributes it topublish_contentand says the workflow tool does not publish. The catalog and README are newer and agree. - We could not read tool schemas or safety annotations. The endpoint returned 401 to an anonymous request, so the
destructiveHintclaims are Agility's, not our observation. - The source is not published. The repository contains documentation only, so the permission and confirmation behaviour cannot be verified by reading code — unlike a connector whose dispatch path can be inspected.
- The documentation page cites a repository that does not exist. It links source to
github.com/agility/agility-mcp-server, which returned 404 on 2026-08-23. The real repository isgithub.com/agility/mcp-server. The same page'snpxinstall foragility-mcp-serveralso 404s on the npm registry, so the documented local install cannot work as written. - Content is untrusted input and Agility says so. Its security policy names prompt injection via content items and field descriptions as structural to MCP.
- The hosted server logs truncated payloads. Agility states request and response payloads are recorded to Application Insights in truncated form, capped at 2 KB by default, so small content values can appear in those logs, with no client-side opt-out on the hosted server.
- No rate limits are published. Neither Agility's documentation page nor its README states a rate limit, quota or throttling behaviour for the MCP server. Treat throughput as unspecified.
Frequently asked questions
Yes, and that is the tool's stated purpose. Agility's live tool catalog documents publish_content as taking content items live and publish_page as taking pages live, both read on 2026-08-23. Anything published becomes visible to real visitors on your website. Neither tool appears in Anthropic's directory listing of 27 tools.
The directory entry is a snapshot of version 2.0.0 taken when the connector was added on 2026-06-19. Agility's README and live tool catalog both document 32 tools. The five missing names are publish_content, unpublish_content, publish_page, unpublish_page and save_page_model, so the omission falls entirely on the publishing surface.
Yes. Three tools delete: delete_content_item, delete_page and delete_media. Agility describes each as permanently removing the record, moving it to a Deleted state. Deleting a page removes it from the sitemap, and Agility advises unpublishing a live page first. All three carry destructiveHint so interactive clients prompt before running them.
No, and Agility is explicit about it. Its documentation states that save_content_items always saves to the instance's default workflow state, typically Staging, and that a state value passed on save is not honored. Taking content live requires a separate publish call, so an ordinary save cannot reach your visitors by itself.
Yes. manage_content_workflow and manage_page_workflow perform approve, decline and request-approval actions, and Agility's documentation states approve and decline are not gated because they are low risk. An agent holding a permitted account can therefore request approval and then approve the same item without a person intervening.
Only offline_access, which controls refresh-token lifetime rather than access. Agility's authorization server advertised that single scope on 2026-08-23 and the RFC 9728 resource descriptor names no scopes at all. Nothing at the consent screen separates reading a content item from deleting one or publishing it.
Sign in as a restricted Agility user. Agility states your account permissions are the ceiling, that every call runs as you, and that the Management API refuses anything you personally cannot do. Because no OAuth scope narrows anything, the Agility user account you authenticate with is the only real boundary available.
No. The public repository at github.com/agility/mcp-server contains only documentation, a licence and a security policy. Its README states the server's source is maintained by Agility CMS and is not currently published. So the confirmation and permission behaviour described in the docs cannot be verified by reading code.
Sources
- Agility CMS MCP Server documentation (retrieved 2026-08-23). The page's prose is not in its HTML; it is embedded in the
__NEXT_DATA__JSON payload of the same response, and a text extractor reports it as near-empty. · retrieved 2026-08-23 - Agility CMS live tool catalog, all 32 tools with per-tool descriptions (retrieved 2026-08-23) · retrieved 2026-08-23
- Agility CMS MCP Server repository README, tool list and "Data and security" (retrieved 2026-08-23, README commit dated 2026-08-20) · retrieved 2026-08-23
- Agility CMS MCP Server security policy (retrieved 2026-08-23) · retrieved 2026-08-23
- Agility CMS setup instructions (retrieved 2026-08-23) · retrieved 2026-08-23
- Agility CMS documentation index,
llms.txt(retrieved 2026-08-23) · retrieved 2026-08-23 - Live OAuth posture check: anonymous initialize to
https://mcp.agilitycms.com/api/mcpreturned 401 with awww-authenticatechallenge naming the resource metadata; RFC 9728 descriptor athttps://mcp.agilitycms.com/.well-known/oauth-protected-resource; authorization server metadata athttps://mcp.agilitycms.com/.well-known/oauth-authorization-server(2026-08-23). Three control paths on the same host returned 404 with an identical body hash, so both 200s are genuine. · retrieved 2026-08-23 - Anthropic Connectors Directory entry — , read from our directory snapshot dated 2026-08-23 · retrieved 2026-08-23
- Agility CMS support — <mailto:support@agilitycms.com> · Privacy
Use in Agentman
Connect once and your agents call these tools on their own — on a schedule, in a workflow, with nobody at the keyboard.
Open in Agentman StudioServer Info
- Category
- Productivity
- Developer
- Agility CMS
- Tools
- 27
- Domain
- mcp.agilitycms.com
Using Claude Desktop or another MCP client? Setup docs — the connection URL above works anywhere.