dotCMS MCP SERVER
Where AI Agents Meet Governed Content
The dotCMS MCP server connects AI Assistants directly to a dotCMS instance, allowing you to create full sites, migrate sites and content, and make your pages accessible using natural language instead of the UI.
A secure bridge between AI and your content infrastructure.
An MCP (Model Context Protocol) server is a secure connector that lets AI tools see and act on a real system the way a person would: what content exists, how it's structured, what it's allowed to touch. For dotCMS, that means an AI agent can search, create, and update content, execute workflow steps, and generate code — all inside the same permissions and audit trail your human team already works under.
“Your next content teammate might not be human — but it must be governed like one.”
— Freddy Montes, VP of Prodcut, dotCMS
One server. Built for two teams.
Marketers and developers both work through the same secure MCP layer —
each with tooling shaped for how they actually work.
Four steps from zero to agent.
Start prompting
"Show me all my content types" or "Generate a React component for my Product content type."
Configure your AI assistant
Claude Desktop or Cursor are documented today — drop in the config snippet below.
Create an AI User + API token
Scoped to only the permissions the agent needs. Least privilege by default.
Get a dotCMS environment
Cloud, self-hosted, or just use the dotCMS demo site to try it out — no setup required.
{
"mcpServers": {
"dotcms": {
"command": "npx",
"args": ["-y", "@dotcms/mcp-server@beta"],
"env": {
"DOTCMS_URL": "https://your-dotcms-instance.com",
"AUTH_TOKEN": "your-auth-token"
}
}
}
}Governance built in, not bolted on.
The same enterprise controls dotCMS customers already rely on — extended to every AI action the moment it happens.
See our Security & ComplianceEvery AI action is logged, traceable, and reversible
Role-based permissions decide exactly what each agent can see or edit
API tokens are sandbox-isolated and never exposed to the AI model itself
Built on the open Model Context Protocol standard — no proprietary lock-in
Questions, answered.
Still curious? The docs go deep on setup, permissions, and every tool the server exposes.
Read the docsIt's a secure connector implementing the open Model Context Protocol. It lets AI assistants read your dotCMS content, schemas, and workflows — and take governed actions like creating content, executing workflow steps, or generating code — through scoped API tokens.
Evergreen is recommended. Version 24.4 is the minimum supported release.
Claude Desktop and Cursor are documented today. Because MCP is an open standard, any MCP-compatible client can connect.
No — the public demo site at demo.dotcms.com works. Point the server at it, generate a token, and try prompts without provisioning anything.
No. Tokens are sandboxed on the MCP server side and never included in prompts or responses sent to the model.
Content Types, Content, and Workflows — scoped to whatever the agent should actually do. We strongly recommend least privilege: grant read where possible, and only add write on the specific types the agent needs.
Ask it anything you'd otherwise do by clicking through the dotCMS back end or writing a REST script — find and bulk-edit content, push things through workflow, build or refactor content types, and build front end components, themes, and templates.