cmsbrew

cmsbrew

Connect a Git-hosted site to CMS Brew from your terminal, and give your AI agent the same access over MCP.

CMS Brew lets your clients edit their own site by chat, safely: the AI resolves every request against a manifest of editable fields built from the repo, so it changes content and never writes code. This package is the developer-facing on-ramp to that.

npx cmsbrew login
npx cmsbrew connect

Commands

Command	What it does
cmsbrew login	Store an API key from the dashboard, and verify it works
cmsbrew logout	Remove the stored key from this machine
cmsbrew connect [repo]	Connect a repository. Defaults to this checkout's origin
cmsbrew sites	List connected sites and their state
cmsbrew status [site]	Show one site in detail
cmsbrew setup [client]	Write the MCP config for Claude Desktop, Claude Code, Cursor, Windsurf, or Codex. Signs you in first if you have not
cmsbrew mcp	Run the MCP server over stdio. Your agent runs this, not you

Global options: --json, --host <url>, --token <key>.

connect

Run it inside a checkout and it reads the origin remote:

cmsbrew connect

Or name the repository, which is what CI and monorepos need:

cmsbrew connect acme/marketing-site
cmsbrew connect acme/monorepo --source-root apps/web --site acme-web

Connecting returns as soon as the site is registered, then CMS Brew maps the repo in the background. The command waits for that and prints the framework and field count when it finishes. Pass --no-wait to return immediately.

MCP

The same five tools reach your agent two ways. Pick whichever your client supports.

Local server

cmsbrew setup detects the MCP clients installed on your machine, shows the config it will add, and asks before writing. It backs up any file it changes. With no key stored it signs you in first, so it works from nothing.

cmsbrew setup                 # every detected client
cmsbrew setup claude-desktop  # just one

To configure a client by hand, run cmsbrew mcp as the server command with your key in the environment:

{
  "mcpServers": {
    "cmsbrew": {
      "command": "npx",
      "args": ["-y", "cmsbrew", "mcp"],
      "env": { "CMSBREW_TOKEN": "cmsb_..." }
    }
  }
}

Hosted server

Nothing to install, and no local process to spawn:

https://cmsbrew.com/api/mcp

Two ways in, and the endpoint decides which by what you send.

With a key. Authorization: Bearer <your key>, the same key cmsbrew login stores. Any client that lets you set a header can do this, including Claude Code and Cursor.

Without one. Add the URL as a custom connector in Claude.ai, or any other hosted MCP client. It discovers the authorization server, signs you in, and asks how much access to give. Nothing is copied by hand. The grant then appears in Settings, API keys, marked as a connected app, and revoking it there stops it on the next call.

Both servers expose an identical tool set and enforce identical permissions, so a prompt that works against one works against the other.

Tools

Tool	What the agent can do
list_sites	Every connected site, with status, framework, and unpublished-edit state
connect_site	Connect a GitHub repository
get_manifest	Read a site's editable fields
edit_content	Make a content edit in plain language. Lands as a draft
list_escalations	Requests routed to the team because they need a developer

There is no publish tool at any permission level. Publishing commits straight to a client's live production site, so it stays a decision a person makes in the dashboard.

Permissions

Every key carries a preset, chosen when you mint it. They nest, narrowest first:

Preset	Can
Setup only	Connect repositories, read sites and manifests
Safe agent access (default)	Setup, plus content edits that land as a draft
Full access	Everything, plus publish and revert

The preset is enforced on the server, so a key cannot exceed it whichever tool calls it. It also cannot exceed the person who minted it: revoke their access to the workspace and their keys stop working.

Keys cannot mint keys. That is deliberate, and it is what keeps a narrow preset meaningful.

Configuration

Variable	Purpose
CMSBREW_TOKEN	The API key. Overrides the stored config, which is what CI and MCP clients need
CMSBREW_HOST	Target a different CMS Brew host

cmsbrew login writes ~/.cmsbrew/config.json, owner-readable only.

Requirements

Node 20 or newer.

Development

The package is written in TypeScript and published as the compiled output under dist/, so a checkout needs one build before it will run:

npm install && npm run build
node dist/cli.js sites

npm run watch rebuilds on save, and npm run typecheck checks without emitting. npm pack and npm publish build first, from a clean dist/.

The tests run on Node's own test runner, so there is nothing extra to install:

npm test

Links

• cmsbrew.com
• Dashboard
• Mint a key