How-to library · Developer docs

How-to library

Task-shaped pages: a title that starts with a verb, the situation in a few lines, the steps, the working code in both engines, and why this way rather than another. Found from a search, done, and left.

How-to APIs and JavaScript

Connect an editor to a site's MCP server

Published

One configuration entry, a name and https://<site>/cdna-mcp, connects an AI assistant to a site; the client handles the OAuth sign-in. Put the development site in the repository's .mcp.json and production only in your own configuration.

Context

Context. Every Core dna site has an MCP server at https://<site>/cdna-mcp, which lets an AI assistant read and change the site's records and configuration as you. Connecting takes one entry in your editor's configuration: a name and that URL. Authentication is OAuth, handled by the client: the first call opens the site's sign-in page in a browser. The one decision that matters is which site goes where: the development site in the repository's shared configuration, production only in your own.

Steps

  1. Add the development site to .mcp.json at the root of the theme repository and commit it, so everyone on the project gets it.
  2. Start your assistant in the repository. On the first tool call, sign in to the development site in the browser window that opens.
  3. Ask it to describe something small to check the connection.
  4. Only if you need production: add it in your user configuration, not the repository, and sign in as a user with no more access than the task needs.

Code

JSON 
{
  "mcpServers": {
    "example-dev": {
      "type": "http",
      "url": "https://example-dev.au.coredna.dev/cdna-mcp"
    }
  }
}
Shell 
# production, for you only (Claude Code); not committed
claude mcp add --transport http --scope user example-production https://www.example.com/cdna-mcp

# see what is configured, and where
claude mcp list

A first request that proves the connection and is useful on any site:

Using example-dev: list the layouts with the template each one uses,
and count the published pages on each layout.

Why this and not that

Not production in .mcp.json: everyone who clones the repository, and every assistant they run in it, gets a connection that can change the live site, and an instruction such as "delete the test pages" does not say which site. Not an API key in the file: the MCP server signs you in with OAuth, and a key in a committed file is a leaked key. Not MCP for anything that has to run unattended: it acts as whoever approved it, through an assistant's judgement; a job or an integration uses the REST API with its own key. The full list of tools and what to ask a site you have just inherited are in MCP, for editors and agents.

Go deeper
GuideMCP, for editors and agents GuideAuthentication and authorisation

Was this page helpful?

Your answer goes to the docs team.