
Security News
CVE Volume Surges Past 48,000 in 2025 as WordPress Plugin Ecosystem Drives Growth
CVE disclosures hit a record 48,185 in 2025, driven largely by vulnerabilities in third-party WordPress plugins.
@dotcms/mcp-server
Advanced tools
Model Context Protocol (MCP) server for dotCMS - enables AI agents to interact with dotCMS content management capabilities
The dotCMS MCP (Model Context Protocol) Server enables AI assistants to interact directly with dotCMS content management capabilities. This powerful integration allows AI tools like Claude, GPT, and others to discover content schemas, create content types, manage content workflows, and perform complex content operations—all through natural language interactions.
For Production Use:
For Testing & Development:
For Local Development:
[!WARNING] This MCP server requires an API token with write permissions for Content Types, Content, and Workflows. Only use tokens with the minimum required permissions and secure them properly.
This integration requires an API Token with content management permissions:
For detailed instructions, please refer to the dotCMS API Documentation.
Before setting up the MCP server, you need these environment variables to connect to your dotCMS instance:
| Variable | Required | Description | Example |
|---|---|---|---|
DOTCMS_URL | ✅ | Your dotCMS instance URL | https://demo.dotcms.com |
AUTH_TOKEN | ✅ | API authentication token (created in setup step) | your-api-token-here |
VERBOSE | ❌ | Enable detailed logging for troubleshooting | true |
RESPONSE_MAX_LENGTH | ❌ | Maximum character limit for response truncation (no truncation if not set) | 5000 |
The MCP server includes intelligent response truncation to manage large data responses and optimize performance. This feature is controlled by the RESPONSE_MAX_LENGTH environment variable:
Behavior:
When truncation occurs:
Truncation format:
Original response content...
[truncated]
Get up and running with the dotCMS MCP Server in minutes:
Add the MCP server to your Claude Desktop configuration file. The configuration file location varies by operating system:
~/Library/Application Support/Claude/claude_desktop_config.json%APPDATA%\Claude\claude_desktop_config.json{
"mcpServers": {
"dotcms": {
"command": "npx",
"args": ["-y", "@dotcms/mcp-server"],
"env": {
"DOTCMS_URL": "https://your-dotcms-instance.com",
"AUTH_TOKEN": "your-auth-token"
}
}
}
}
Add the MCP server to your Cursor configuration. Open Cursor Settings and navigate to "Features" > "Model Context Protocol" or create/edit the configuration file:
{
"mcpServers": {
"dotcms": {
"command": "npx",
"args": ["-y", "@dotcms/mcp-server"],
"env": {
"DOTCMS_URL": "https://your-dotcms-instance.com",
"AUTH_TOKEN": "your-auth-token"
}
}
}
}
Example interactions:
You: "Create a new blog post about AI in content management"
AI: [Automatically learns your content structure and creates the blog post]
You: "Show me all my content types"
AI: [Discovers and displays your content schemas]
You: "Generate a React component for my Product content type"
AI: [Analyzes your Product fields and generates a complete component]
The dotCMS MCP Server provides four core tools that enable comprehensive content management through AI:
Tool: context_initialization
Purpose: Must be called first to discover all available content types, sites, and workflow schemes
You: "Learn about my dotCMS setup"
AI: [Calls context_initialization and learns your complete content schema]
What it provides:
Tools: content_type_list, content_type_create
Purpose: Discover and create content type schemas
You: "Show me all my content types"
AI: [Calls content_type_list to display your content schemas]
You: "Create a new Product content type with name, price, and description fields"
AI: [Calls content_type_create with the appropriate schema]
Capabilities:
Tools: content_save, content_action
Purpose: Create, update, and manage content through workflow actions
You: "Create a new blog post about dotCMS MCP integration"
AI: [Calls content_save to create the content]
You: "Publish the blog post we just created"
AI: [Calls content_action with PUBLISH action]
Supported Actions:
Tool: content_search
Purpose: Query content using Lucene syntax
You: "Find all blog posts published this year that mention 'AI'"
AI: [Calls content_search with appropriate Lucene query]
Search Capabilities:
For developers who want to contribute or modify the MCP server:
# Clone the dotCMS repository
git clone https://github.com/dotCMS/core.git
cd core/core-web
# Install dependencies
yarn install
# Build the server
yarn nx build mcp-server
[!NOTE] Files are located in
core-web/apps/mcp-serverand we use Nx monorepo
After a succesful build
npx @modelcontextprotocol/inspector -e DOTCMS_URL=https://demo.dotcms.com -e AUTH_TOKEN=the-auth-token node dist/apps/mcp-server
Claude Desktop Configuration:
{
"mcpServers": {
"dotcms": {
"command": "node",
"args": ["/path/to/dotcms/core/core-web/dist/apps/mcp-server/main.js"],
"env": {
"DOTCMS_URL": "your-dotcms-url",
"AUTH_TOKEN": "your-auth-token"
}
}
}
}
Cursor IDE Configuration:
{
"mcpServers": {
"dotcms": {
"command": "node",
"args": ["/path/to/dotcms/core/core-web/dist/apps/mcp-server/main.js"],
"env": {
"DOTCMS_URL": "your-dotcms-url",
"AUTH_TOKEN": "your-auth-token"
}
}
}
}
mcp-server/
├── src/
│ ├── main.ts # Entry point and server initialization
│ ├── services/ # HTTP clients for dotCMS APIs
│ │ ├── client.ts # Base authenticated HTTP client
│ │ ├── contentype.ts # Content type operations
│ │ ├── workflow.ts # Content workflow actions
│ │ ├── search.ts # Content search functionality
│ │ └── site.ts # Site information
│ ├── tools/ # MCP tool implementations
│ │ ├── context/ # Context initialization
│ │ ├── content-types/ # Content type management
│ │ ├── workflow/ # Content operations
│ │ └── search/ # Search functionality
│ ├── types/ # TypeScript type definitions
│ └── utils/ # Shared utilities
├── jest.config.ts # Test configuration
└── project.json # Nx project configuration
Service Layer: All services extend AgnosticClient which provides:
Tool Registration: Each tool module exports a registration function that:
Type Safety: Extensive use of Zod schemas for:
# Build for development
yarn nx build mcp-server
# Lint the code
yarn nx lint mcp-server
# Serve in development mode
yarn nx serve mcp-server
# Run all tests
yarn nx test mcp-server
# Run tests in watch mode
yarn nx test mcp-server --watch
# Run with coverage
yarn nx test mcp-server --coverage
When adding new MCP tools:
src/tools/ subdirectorysrc/main.tsDevelopment Guidelines:
The MCP server includes comprehensive logging:
We offer multiple channels to get help with the dotCMS MCP Server:
When reporting issues, please include:
GitHub pull requests are the preferred method to contribute code to dotCMS. We welcome contributions to the dotCMS MCP Server! If you'd like to contribute, please follow these steps:
git checkout -b feature/amazing-mcp-feature)apps/mcp-server directoryyarn nx test mcp-server)git commit -m 'Add amazing MCP feature')git push origin feature/amazing-mcp-feature)When adding new MCP tools:
src/tools/ subdirectorysrc/main.tsdotCMS comes in multiple editions and as such is dual-licensed. The dotCMS Community Edition is licensed under the GPL 3.0 and is freely available for download, customization, and deployment for use within organizations of all stripes. dotCMS Enterprise Editions (EE) adds several enterprise features and is available via a supported, indemnified commercial license from dotCMS. For the differences between the editions, see the feature page.
This MCP Server is part of dotCMS's dual-licensed platform (GPL 3.0 for Community, commercial license for Enterprise).
Learn more at dotcms.com.
FAQs
Model Context Protocol (MCP) server for dotCMS - enables AI agents to interact with dotCMS content management capabilities
We found that @dotcms/mcp-server demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
CVE disclosures hit a record 48,185 in 2025, driven largely by vulnerabilities in third-party WordPress plugins.

Security News
Socket CEO Feross Aboukhadijeh joins Insecure Agents to discuss CVE remediation and why supply chain attacks require a different security approach.

Security News
Tailwind Labs laid off 75% of its engineering team after revenue dropped 80%, as LLMs redirect traffic away from documentation where developers discover paid products.