mcp-content-ops
mcp-content-ops
에이전트가 CMS 콘텐츠를 다룰 수 있게 해주는 MCP 서버입니다. 도구 자체는 단순합니다 — 검색, 읽기, 초안 작성, 필드 설정, 게시. 실제로 고민이 필요했던 부분은 그 어떤 도구가 실행되기 전에 일어나는 일입니다.
우리가 살펴본 대부분의 콘텐츠 MCP 서버는 모델에게 API 클라이언트와 통합 계정이 가진 권한(보통 CMS에서는 모든 권한)을 그대로 부여합니다. 데모는 잘 작동합니다. 그러다 누군가 에이전트에게 "제품 페이지를 정리해줘"라고 요청하면, 시스템 어디에도 그렇게 하면 안 된다고 명시된 것이 없기 때문에 에이전트는 초안 40개를 게시해버립니다.
범위 설정
네 가지 게이트가 순서대로 적용되며, 그중 어느 것도 도구 스키마에 존재하지 않습니다:
인자 검증 — 게시된 스키마를 기준으로 수행됩니다. 알 수 없는 속성은 무시되지 않고 거부됩니다. 인자를 임의로 만들어내는 모델은 도구를 오해한 것이며, 조용히 무시하면 그 사실이 숨겨집니다.
기본 거부. 구성에서 활성화하지 않는 한 쓰기는 꺼져 있습니다.
Policy어디에도 허용적 기본값은 없습니다.타입 및 필드 허용 목록. 타입이 읽기 가능하다고 해서 쓰기 가능한 것은 아니며, 쓰기 가능한 타입이라고 해서 그 타입의 모든 필드가 쓰기 가능한 것도 아닙니다.
모든 호출에 대한 구조화된 감사 — 허용 여부와 관계없이, 그 이유와 함께 기록됩니다.
호출이 판단되는 기준이 되는 타입은 인자가 아니라 저장된 항목에서 가져옵니다. 호출자가 자신이 편집하는 대상의 종류를 스스로 주장하게 두는 것은, 호출자가 어떤 정책이 적용될지 선택하게 두는 것과 같습니다.
거부된 호출은 JSON-RPC 오류가 아닌 isError가 설정된 일반 도구 결과로 반환됩니다. 모델은 거부된 이유를 확인하고 적응해야 합니다. 프로토콜 오류는 클라이언트가 고장났다는 뜻이며, 이는 다른 차원의 문제입니다.
Related MCP server: ToolBridge
실행 방법
pip install -e ".[dev]"
python -m content_ops.server policy.example.json
pytest -q그 뒤에 있는 CMS는 cms.py의 인메모리 스텁입니다 — 메서드 네 개뿐이며, 콘텐츠 API로 교체하면 됩니다.
제공하지 않는 것
삭제 도구는 의도적으로 없습니다. 리소스나 프롬프트도 없고 도구만 있습니다. 인증도 없습니다. 이 서버는 stdio 서버이며 신뢰 경계는 이 서버를 실행한 프로세스입니다. 스키마 검증기는 우리 자체 도구 스키마가 사용하는 하위 집합만 다루며 JSON Schema 전체를 다루지는 않습니다.
SDK를 사용하지 않는 이유
MCP Python SDK는 훌륭하며 더 큰 서버라면 그것이 올바른 선택입니다. 이 서버는 stdio 위에서 세 가지 메서드를 구현하며, 와이어 형식이 충분히 작아서 SDK들이 현재 움직이는 속도로 움직이는 의존성이 더 큰 위험이었습니다.
Available Tools
5 toolscreate_contentB
Create a content item as a draft.
| Name | Required | Description | Default |
|---|---|---|---|
| name | Yes | ||
| content_type | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description must fully disclose side effects. It only states 'create as a draft' without mentioning permissions, reversibility, or what happens on success/failure. This is insufficient for a mutation operation.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, clear sentence with no unnecessary words. It is well-structured and appropriately sized for the tool's simplicity.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given that no output schema is provided, the description should at least indicate what the tool returns or how it affects state. It only mentions the draft state, omitting important details like whether an ID or object is returned, or any post-creation steps.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema provides no descriptions for 'name' or 'content_type', and the description does not explain their meaning or usage. With zero parameter coverage, the description fails to compensate, leaving the agent without context for these required fields.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the action (create), the resource (content item), and the state (as a draft), distinguishing it from sibling tools like search, get, update, and publish.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies use for creating a new content item, but does not explicitly state when to use it vs alternatives. It lacks explicit conditions or exclusions, though the intent is clear from the tool name and description.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_contentC
Read one content item.
| Name | Required | Description | Default |
|---|---|---|---|
| id | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
There are no annotations to provide read-only or safety hints. The description 'Read' implies no mutation, but it does not mention how the content is returned, errors, or any special behavior at all. A descr without annotations bears the full disclosure burden, but only provides one cliché sentence.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Exactly one sentence and no filler. It says what it does in minimal words. But its minimalism is excessive and becomes thin.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
No annotations and annotations absent. One input without output. No returns, no error conditions, no content type. The description misses entire behavioral and contextual layers.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 0% and the param is just 'id' with maxLength 40 and type string, which could be an identifier, but the description adds no meaning to what this id actually names or how to use it in content operations. Even a baseline of 0% coverage requires explicit parameter explanation in description, and the description does not provide any.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb 'Read' and the resource 'one content item', which aligns with the id parameter. It distinguishes from siblings that create, update, or publish content, but it does not specify what kind of content item is being read.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No when-to-use guidance or alternatives are given. The single sentence implies direct retrieval by identifier, but the context of usage versus search_content or create_content_field is not addressed.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
publish_contentC
Publish a draft.
| Name | Required | Description | Default |
|---|---|---|---|
| id | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations are absent, so the description carries the burden of behavioral disclosure. 'Publish a draft' implies a state change, but it does not disclose consequences like making the content publicly visible, whether the action is reversible, or if any permission is required. It conveys a mutation but lacks details on side effects.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is extremely concise, with one short sentence. It is front-loaded with the key action and resource. However, its brevity is a trade-off: it lacks valuable context, but it does not waste words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The tool is a mutation with a simple schema (one required parameter) and no output schema or annotations. The description is minimal and does not provide expected context such as prerequisites (draft must exist), success criteria, or failure modes. Given the lack of additional structured information, the description is incomplete from a behavioral standpoint.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must compensate. The description does not elaborate on the 'id' parameter (e.g., the ID of the draft to publish). It adds no meaning beyond the schema's type and required flag, leaving the agent to infer that 'id' refers to the draft ID.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the action ('Publish a draft') and the resource ('draft'), which distinguishes it from sibling tools like get_content or search_content. However, it does not specify what 'publish' entails (e.g., making content publicly visible, changing status) or what resource type it applies to beyond 'draft', but the verb and resource are specific and clear.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage for draft content but provides no guidance on when to use this tool versus update_content_field (which might also change content status) or prerequisites (e.g., the content must be in draft status). No explicit when-not or alternative mentions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
search_contentC
Find content items by a substring of their name.
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | ||
| query | Yes | ||
| content_type | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description must disclose behavioral traits but only mentions the search action. It lacks details on pagination, limit handling, content_type filtering behavior, or what happens when no results match.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, well-structured sentence with no redundancy. It is concise and front-loaded, though the brevity sacrifices essential details.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a tool with 3 parameters and no output schema, the description is severely incomplete. It fails to explain limit and content_type, return format, or usage context, making it inadequate for reliable agent invocation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 0% so the description should compensate. It implicitly explains the query parameter as the name substring but omits limit and content_type semantics, leaving agents without guidance on their purpose or constraints.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool finds content items by a substring of their name, providing a specific verb and resource. It differentiates from siblings like 'create_content' and 'publish_content' but is somewhat similar to 'get_content' without explicit distinction.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies the use case (searching by name substring) but provides no explicit guidance on when to choose this over 'get_content' or other alternatives. It doesn't mention exclusion criteria or prerequisites.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
update_content_fieldC
Set one field on one content item.
| Name | Required | Description | Default |
|---|---|---|---|
| id | Yes | ||
| field | Yes | ||
| value | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description must disclose behavioral traits. It implies mutation ('set') but gives no details on whether other fields are preserved, if the operation is idempotent, what errors occur, or what the return value looks like. There is no mention of authentication or side effects.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
While the description is very short, it is under-specified rather than concise. It essentially restates the tool name with minimal extra meaning. It lacks any structure or useful detail, so it does not 'earn its place' by adding value beyond the tool name.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description is grossly insufficient for a tool with 3 required parameters and no annotations or output schema. It fails to explain parameter semantics, usage context, behavioral implications, or expected return. Sibling tools exist but are not referenced. An agent would be left guessing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, and the description provides no explanation of the parameters id, field, or value. It does not clarify that id is the content item identifier, field is the field name, or that value is the new value. The agent cannot infer parameter usage from the description.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the action: 'Set one field on one content item.' It defines the scope (one field, one item) and distinguishes it from sibling tools like create_content (which creates new items) and publish_content (which publishes). This is a specific verb-resource pairing.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is provided on when to use this tool versus alternatives. It does not mention that this is for updating an existing field, nor does it reference sibling tools like search_content or get_content for locating items beforehand, or create_content for new items. The description offers no exclusions or context.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
5 tool updates
v0.1.0- First observed
create_content - First observed
get_content - First observed
publish_content - First observed
search_content - First observed
update_content_field
TDQS
Scored across 5 tools
The tools are mostly distinct: search, get, create, update, publish. Minor overlap: get_content vs search_content could be confused but descriptions clarify one is for exact retrieval and the other for substring search.
All tool names follow a consistent verb_noun pattern (search_content, get_content, create_content, update_content_field, publish_content). The action verbs are clear and uniform.
5 tools is well-scoped for a content operations server. Each tool covers a distinct lifecycle step: search, read, create, update, publish. No redundancy or excess.
Covers basic search/read/create/update/publish workflow, but missing delete_content (or archive), and possibly list/summary operations. Update is limited to one field at a time, which may be restrictive, but the core workflow is covered.
Maintenance
Related MCP Connectors
- gatewayOAuthai.sealgate
MCP gateway with runtime security policy, tool-call-level control, and audit of agent actions.
An MCP server that provides access to Agility CMS. See https://mcp.agilitycms.com for more details.
- GentkeyOAuthcom.gentkey
One MCP URL for all your connectors — scoped writes, enforced constraints, and a full audit trail.
The MCP server that vets MCP servers: identity, risk grade and per-tool risk before you install.
Related MCP Servers
AlicenseAqualityDmaintenanceMCP server that protects shell, file, database, git, and HTTP operations with per-agent permission rules507 npmMIT- FlicenseNot gradedqualityDmaintenanceA governed MCP server for integrating AI agents with customer data, featuring role-based access control, field redaction, and human-in-the-loop approval for secure support operations.1-
- AlicenseBqualityCmaintenanceOpen-source MCP server that turns any CMS backend into an AI-agent-ready content management system. It provides tools for content CRUD, idea management, and publication tracking, with safety features requiring human approval for publishing.52MIT
- AlicenseNot gradedqualityDmaintenanceAn MCP server that provides AI agents with direct read/write access to Sitecore CMS through 100+ tools across Item Service, GraphQL, and PowerShell APIs.96 npmApache 2.0