MCP agent
A site token instead of server root: this is how you delegate a website to an AI without handing it your infrastructure. Every site can give an agent — any MCP client — a remote control: the /mcp endpoint speaks the Model Context Protocol over HTTP. A site token carries an ADMINISTRATOR’s reach over its own site — content, media, settings, and the templates the admin panel itself is built from — and stops exactly there: never a neighbouring site, never the server. The server stores only the token’s hash; the raw token is shown once, at issue time.
Two consequences worth knowing before you issue one. Revoking closes the door but does not undo what the agent already wrote — a rollback is your backups. And an agent that can edit hbs/ can change the admin interface you sign in to, so the token is worth exactly as much as the admin password: rotate it on suspicion, and hand it only to an agent you trust that far.
| action | where |
|---|---|
| issue / rotate | the admin’s MCP agent page (shows status, issue date, agent last seen) — or cmsnap mcp token --site example.com |
| revoke | the same page or cmsnap mcp revoke --site example.com — closes the /mcp zone for that scope immediately |
| IP allowlist | the same page: exact addresses or CIDR subnets, applied instantly; empty = any IP. The page suggests your current IP — one click adds it (the agent may connect from a different address) |
| connect | the client sends Authorization: Bearer <token> to https://example.com/mcp — the site’s own domain; the endpoint answers only its exact Host — a token never opens a neighbour site. The domain has to BE in the root site{} map, as the site’s main domain or a clone alias: page serving falls back to the default site for an unknown Host, /mcp does not, so a domain the map does not know answers 404 even with a valid token |
Server scope — a different order of trust. The first-run summary also prints a SERVER token, and it is not “a site token that works everywhere”: it IS the node. It creates sites and takes them off the map, wires domains and TLS, and calls every site tool on ANY site by naming it. Give it to an agent only when you mean “run my whole server”; when you mean “run this one website”, issue that site’s own token in its /cms and keep the server key to yourself. cmsnap mcp token / cmsnap mcp revoke without --site manage it. An agent with the server token can create a site, then fill it over that site’s own MCP — see Sites & domains.
Sizes. A file the agent reads or writes whole travels through memory — as JSON text, or as base64 for binaries. The site’s mcp block sets the ceilings: max_file_size (default 100m) is the largest file the fs tools will read, edit or write whole, max_search_matches (default 100) is how many hits one search returns. Writing also passes through the request limit, mcp.max_body_size in the ROOT block — base64 adds a third, so a 10m file wants roughly 14m of body, and cmsnap check tells you when the two disagree.
Files of any size. fs_read_text takes offset and limit — a line window streamed from disk, so only the window (not the file) is bounded by max_file_size, and every reply carries total_lines. fs_search takes context (up to 10 lines around each match) and path (search one file), and scans files over max_file_size in 64 KB chunks instead of skipping them; an ambiguous fs_edit is refused with the matching line numbers. Together they make the big-file loop: search finds the line, a read window around it supplies the exact text, the edit lands — the file never travels whole.
Every /mcp call lands in the request log like any other request, and the admin page shows when the agent was last seen.