# Microweber MCP

An [MCP](https://modelcontextprotocol.io) server for [Microweber](https://microweber.com)
sites. It wraps Microweber's existing HTTP API — no plugin or module is installed on
the site, only admin credentials are needed.

## Tools

| Tool | What it does |
|------|--------------|
| `mw_list_content` | List pages/posts/products (optional parent id + keyword) |
| `mw_get_content` | Get one content item by id (full HTML body) |
| `mw_save_content` | Create (omit id) or update (with id) content |
| `mw_delete_content` | Delete a content item by id |
| `mw_upload_media` | Upload a local file to the media library |

## Setup

```bash
npm install
cp .env.example .env   # fill in your site + admin login
npm start              # or: node server.js
```

`.env`:

```
MW_BASE_URL=https://your-site.com
MW_USERNAME=admin
MW_PASSWORD=secret
```

Credentials can also come from real environment variables (they win over `.env`).

## Wire into Claude Code / Desktop

```json
{
  "mcpServers": {
    "microweber": {
      "command": "node",
      "args": ["/absolute/path/to/server.js"]
    }
  }
}
```

(Env can be set here too via an `"env"` block instead of `.env`.)

## How auth works

Microweber v2 uses session + CSRF, so the server:

1. `POST /api/user_login` with username/password → `laravel_session` cookie (CSRF-exempt).
2. `GET /admin` → reads `window.livewire_token` (the CSRF token).
3. Every admin API call is `POST /api/<endpoint>` with the cookie + `X-CSRF-TOKEN` header.

Sessions are cached in memory and re-established automatically on a 403.

## Smoke test

```bash
node test-smoke.js   # lists tools and reads content through the server
```