Connect an AI agent over MCP

The CMS has an MCP (Model Context Protocol) server, so AI assistants such as Claude can find, read and draft content the way an editor does. The address is:

https://app.bifrostorbit.com/cms/mcp

It uses the Streamable HTTP transport. The same address, with a copy button, is on Configuration › AI agents. For what an editor sees and how drafts are reviewed, see Let an AI assistant draft content.

Before you start

1. Open Configuration › AI agents on the website the agent should work on.
2. Check the switches under Access:
   • Allow AI agents in the organisation is on by default. Turning it off stops every agent on every website at once. It needs someone who can change the organisation's settings.
   • Allow AI agents on this website is off until an Administrator turns it on.
   • Allow drafts in production is off by default. Agents can then read Production but only draft in other environments, such as Staging.
3. You need to be able to edit content on the website. Agents never get more rights than the person they act for.

While either of the first two switches is off, every request is refused with AI agents are switched off for this website.

Sign in or use a key

There are two ways to connect. Both act for a person, within that person's rights, and both are capped to the agent's short list of drafting permissions.

Sign-in uses OAuth with PKCE. The client finds the sign-in details by itself from the MCP address, so there is nothing to copy except the address.

Create an agent key

1. In Configuration › AI agents, under Keys, select New agent key.
2. Give it a Name, such as Claude. The name appears on everything the agent drafts.
3. Choose the Kind:
   • Personal, acts for me: for your own assistant. Anyone who can edit content can create one.
   • Automation, scheduled jobs: for jobs that run with no one present. Only people who manage API keys can create one. It still acts with the rights of the person who created it.
4. Choose when it Expires after.
5. If the website has more than one region, tick the Regions it may change. None ticked means every region. The agent can still read the others.
6. Select Create key and copy the key. This is the only time it is shown. If it is lost, revoke it and create another.

Keep the key out of source control and shared files. Anyone with the key can draft as you.

Connect your client

The quickest way is on the AI agents screen under Configuration: Add to Cursor and Add to VS Code open the app and ask to add the server, and Copy Claude Code command copies the command for a terminal. They use the address of the CMS you are in, so they work the same on staging. The steps below do the same by hand.

Use cms-orbit as the server name, or any name you like.

Claude (web and desktop app)

Add a custom connector in Claude's connector settings and paste the MCP address. Claude opens the sign-in page. Sign in, choose the website and select Allow.

Custom connectors sign in; they do not take an agent key. To use a key in the Claude desktop app instead, run the open source mcp-remote bridge from claude_desktop_config.json. It needs Node.js.

1{2  "mcpServers": {3    "cms-orbit": {4      "command": "npx",5      "args": [6        "mcp-remote",7        "https://app.bifrostorbit.com/cms/mcp",8        "--header",9        "Authorization:${AUTH_HEADER}"10      ],11      "env": {12        "AUTH_HEADER": "Bearer cms_ag_your_key"13      }14    }15  }16}

Restart the app after saving the file.

Claude Code

Copy Claude Code command on the AI agents screen gives you the first command below. To sign in, add the server and then run /mcp inside Claude Code and choose it to authenticate:

claude mcp add --transport http cms-orbit https://app.bifrostorbit.com/cms/mcp

To use an agent key instead:

claude mcp add --transport http cms-orbit https://app.bifrostorbit.com/cms/mcp \  --header "Authorization: Bearer cms_ag_your_key"

Add --scope user to make it available in every project, rather than only the current one.

Cursor

Choose Add to Cursor on the AI agents screen, confirm in Cursor, and sign in when it first connects. To set it up by hand, add the server to ~/.cursor/mcp.json, or to .cursor/mcp.json in a project. To sign in, give only the address; Cursor asks you to sign in when it first connects:

1{2  "mcpServers": {3    "cms-orbit": {4      "url": "https://app.bifrostorbit.com/cms/mcp"5    }6  }7}

To use an agent key, add a header:

1{2  "mcpServers": {3    "cms-orbit": {4      "url": "https://app.bifrostorbit.com/cms/mcp",5      "headers": {6        "Authorization": "Bearer cms_ag_your_key"7      }8    }9  }10}

Do not commit a project file that contains a key.

VS Code

Choose Add to VS Code on the AI agents screen, confirm in VS Code, and sign in when the server starts. To set it up by hand, add the server to .vscode/mcp.json in your workspace. To sign in, give only the type and address; VS Code asks you to sign in when the server starts:

1{2  "servers": {3    "cms-orbit": {4      "type": "http",5      "url": "https://app.bifrostorbit.com/cms/mcp"6    }7  }8}

To use an agent key without writing it in the file, let VS Code ask for it once and store it securely:

1{2  "inputs": [3    {4      "type": "promptString",5      "id": "cms-orbit-key",6      "description": "CMS Orbit agent key",7      "password": true8    }9  ],10  "servers": {11    "cms-orbit": {12      "type": "http",13      "url": "https://app.bifrostorbit.com/cms/mcp",14      "headers": {15        "Authorization": "Bearer ${input:cms-orbit-key}"16      }17    }18  }19}

Any other MCP client

Any client that supports the Streamable HTTP transport works:

• Address: https://app.bifrostorbit.com/cms/mcp
• Sign-in: OAuth 2.1 with PKCE (S256) and dynamic client registration. An unauthenticated request gets 401 with a WWW-Authenticate header pointing at the sign-in details. The client must return to an https address, or to http on localhost.
• Key: send Authorization: Bearer cms_ag_… on every request.
• The server answers each request with plain JSON and keeps no session between requests.

Which website, environment and region

• Website: each key or sign-in belongs to one website. A key belongs to the website it was created on; when signing in you pick it under Which website?. To work on two websites, connect twice.
• Environment: tools work in Staging unless the agent names another environment. Drafting in Production also needs Allow drafts in production.
• Region and language: tools use the default region and its default language unless the agent names others, such as region de and locale de-DE.

Ask the agent to run list_scopes to see every environment, region and language, and which ones it may change. See MCP tools for every tool.

Test the connection

In the assistant, ask something that reads only, such as "List the scopes you can work in" or "Find the page at /products/hiking-boots". The assistant should call list_scopes or search_content and show the result.

With a key, you can also test from a terminal. This lists the tools without changing anything:

1curl https://app.bifrostorbit.com/cms/mcp \2  -H "Authorization: Bearer cms_ag_your_key" \3  -H "Content-Type: application/json" \4  -H "Accept: application/json, text/event-stream" \5  -d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}'

A working key answers with a list of tools. On Configuration › AI agents, the key's Last used column then shows when it was last used.

Revoke access

On Configuration › AI agents, open the menu at the end of the key's row and select Revoke. The agent is refused from its next request. Revoking cannot be undone; create a new key or sign in again to reconnect.

• Signed-in connections are listed with the badge Signed in, so you disconnect them the same way.
• You can revoke your own keys and connections. People who manage API keys see every key on the website and can revoke any of them.
• To stop every agent at once, turn off Allow AI agents on this website, or Allow AI agents in the organisation for every website.
• If the person a key acts for is deactivated, all their keys and connections stop working.
• A new key, or signing in again, is a new connection. An agent can discard only the drafts and uploads it made through its own connection, so it cannot tidy up what an old one left. A person can delete those. See MCP tools.

Troubleshooting

For errors that tools return while drafting, see Limits and errors.