Atlas / MCP servers / antonytm / Sitecore Server

Sitecore ServerBLOCK

Name: Sitecore Server
Author: antonytm

mcp/antonytm/sitecore-server

MCP server by antonytm · Audited 2026-10-08

⚑ Report / re-scan Source ↗

Model Context Protocol server for Sitecore

Verdict

BLOCK

Grade

Trust score

69 /100

Exposed tools

119 68r · 38w · 13d

Transport

stdio · streamable-http

License

Apache-2.0

Stars

Overview

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

[](https://github.com/Antonytm/mcp-sitecore-server/actions/workflows/publish-npm.yml) [](https://modelcontextprotocol.io/specification/2026-07-28) [](https://modelcontextprotocol.io/specification/) [](CONTRIBUTING.md)

This repository contains the source code for the Sitecore Community MCP server — an open-source Model Context Protocol server that gives AI agents direct read/write access to Sitecore, so you stop copy-pasting between your agent and the Content Editor.

121 tools across search, query, create, read, update, delete, media, PowerShell, logging, security and presentation
Three guides — guide://compose-page, guide://bulk-update and guide://diagnose-connection — resources an agent can read mid-task: two common, complex workflows that you'd want to use this MCP for, plus a connection issue self diagnosis helper.
Covers four Sitecore API surfaces: the Authoring and Management GraphQL API, the Item Service, GraphQL Edge and Sitecore PowerShell Extensions
Works with SitecoreAI and Sitecore XM/XP (all versions), from any MCP-compatible client
Implements MCP protocol revision 2026-07-28, and answers the older initialize handshake from the same tool registrations — negotiating down to any revision from 2025-11-25 to 2024-10-07, so a client on either era sees the same tools
Reported impact: 5× faster Figma-to-Sitecore workflows and ~70% less manual scaffolding (case study)
Three ways to run it: npm

Read from source at commit 180561d9c929OBSERVED · 2026-10-08

Connect

Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control.

claude-code

claude mcp add mcp-sitecore-server -- npx -y @antonytm/[email protected]

claude-desktop

{
  "mcpServers": {
    "mcp-sitecore-server": {
      "command": "npx",
      "args": [
        "-y",
        "@antonytm/[email protected]"
      ]
    }
  }
}

Exposed tools (119)

68 read · 38 write · 13 destructive. Blast radius: 13 tools can delete or overwrite — an agent that can be talked into calling a tool can be talked into calling this one.

Tool	Risk	Description
`add-rendering-to-placeholder`	write
`authoring-copy-item`	read
`authoring-create-item`	write
`authoring-create-item-template`	write
`authoring-delete-item`	destructive
`authoring-get-item`	read
`authoring-get-item-template`	read
`authoring-get-job`	read
`authoring-get-media-item`	read
`authoring-get-site`	read
`authoring-graphql`	read
`authoring-introspect-schema`	read
`authoring-list-jobs`	read
`authoring-list-sites`	read
`authoring-move-item`	write
`authoring-publish-item`	write
`authoring-publishing-status`	read
`authoring-rebuild-indexes`	read
`authoring-rename-item`	write
`authoring-search`	read
`authoring-update-item`	write
`authoring-update-item-template`	write
`authoring-upload-media`	write
`common-add-item-version`	write
`common-convert-from-item-clone`	read
`common-get-archive`	read
`common-get-archive-item`	read
`common-get-cache`	read
`common-get-database`	read
`common-get-item-clone`	read
`common-get-item-field`	read
`common-get-item-reference`	read
`common-get-item-referrer`	read
`common-get-item-template`	read
`common-get-item-workflow-event`	read
`common-get-sitecore-job`	read
`common-invoke-workflow`	write
`common-new-item-clone`	read
`common-new-item-workflow-event`	read
`common-publish-item`	write
`common-remove-archive-item`	destructive
`common-remove-item-version`	destructive
`common-reset-item-field`	destructive
`common-restart-application`	write
`common-restore-archive-item`	read
`common-set-base-template`	write
`common-set-item-template`	write
`common-test-base-template`	read
`common-update-item-referrer`	write
`config`	read
`create-component-datasource`	write
`get-allowed-components-by-placeholder`	read
`get-pages-by-site`	read
`get-powershell-documentation`	read
`get-site-information`	read
`indexing-find-item`	read
`indexing-get-search-index`	read
`indexing-rebuild-search-index`	read
`indexing-set-search-index-state`	write
`item-service-create-item`	write
`item-service-delete-item`	destructive
`item-service-edit-item`	write
`item-service-get-item`	read
`item-service-get-item-children`	read
`item-service-get-item-descendants`	read
`item-service-get-languages`	read
`item-service-search-items`	read
`list-insert-options`	write
`list-site-components`	read
`list-sites`	read
`logging-get-logs`	read
`media-download`	read
`media-upload`	write
`presentation-add-placeholder-setting`	write
`presentation-add-rendering`	write
`presentation-get-layout`	read
`presentation-get-layout-device`	read
`presentation-get-placeholder-setting`	read
`presentation-get-rendering`	read
`presentation-get-rendering-parameter`	read
`presentation-list-renderings`	read
`presentation-merge-layout`	write
`presentation-remove-placeholder-setting`	destructive
`presentation-remove-rendering`	destructive
`presentation-remove-rendering-parameter`	destructive
`presentation-reset-layout`	destructive
`presentation-set-layout`	write
`presentation-set-rendering`	write
`presentation-set-rendering-parameter`	write
`presentation-switch-rendering`	read
`provider-get-item`	read
`run-powershell-script`	write
`search-site-pages`	read
`security-add-role-member`	write
`security-disable-user`	write
`security-enable-user`	write
`security-export-account`	read
`security-get-current-user`	read
`security-get-domain`	read
`security-get-item-acl`	read
`security-get-role`	read
`security-get-role-member`	read
`security-get-user`	read
`security-import-account`	write
`security-new-domain`	read
`security-new-role`	read
`security-new-user`	read
`security-remove-domain`	destructive
`security-remove-role`	destructive
`security-remove-role-member`	destructive
`security-remove-user`	destructive
`security-set-item-acl`	write
`security-set-item-lock`	write
`security-set-item-protection`	write
`security-set-user`	write
`security-set-user-password`	write
`security-test-account`	read
`security-test-item-acl`	read
`security-unlock-user`	read

Trust audit

BLOCKgrade D · trust 69/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.

Layer	What it checks	Result
L0	Provenance & inventory	PASS
L1	Static analysis of the code	FAIL
L2	Instruction surface (what it tells the agent)	PASS
L3	Class-specific surface	WARN
L4	Behavioural (sandbox)	SKIPPED

What the source does

Filesystem: declared (6 observation(s))
Network: declared (3 observation(s))
Shell: declared (1 observation(s))
Dependencies: not all pinned
Secrets in source: none-found

Findings (21)

HIGHNetwork egress · net.tls_off · CWE-200, CWE-319

src/guides/diagnose-connection.ts:81

\`NODE_TLS_REJECT_UNAUTHORIZED=0\` for local work only; it must never be carried to a

Why it matters. certificate verification is disabled

Fix. leave verification on

MEDIUMObfuscation / stealth · obf.homoglyph · CWE-506, CWE-94

src/tools/powershell/simple/common/test-base-template.ts:16

.describe("The ID of the item to сheck template inheritance for. Supply this or path."),

MEDIUMObfuscation / stealth · obf.homoglyph · CWE-506, CWE-94

src/tools/powershell/simple/common/test-base-template.ts:18

.describe("The path of the item to сheck template inheritance for. Supply this or id."),

MEDIUMFilesystem / path · mcp.destructive_tools · CWE-22, CWE-59

authoring-delete-item, common-remove-archive-item, common-remove-item-version, common-reset-item-field, item-service-delete-item, presentation-remove-placeholder-setting, presentation-remove-rendering

Why it matters. 13 tool(s) can delete or overwrite

Fix. prefer a read-only mode or scoped tokens; the page states the blast radius

LOWInventory / provenance · inv.hidden_file · CWE-1104

.env.template

.env.template

Why it matters. hidden member outside the usual dotfiles

Fix. review its purpose

LOWFilesystem / path · fs.traversal · CWE-22, CWE-59

src/tools/graphql/register-graphql.ts:2

import type { Config } from "../../config.js";

LOWFilesystem / path · fs.traversal · CWE-22, CWE-59

src/tools/graphql/register-graphql.ts:3

import { safeMcpResponse } from "../../helper.js";

LOWFilesystem / path · fs.traversal · CWE-22, CWE-59

src/tools/item-service/logic/composite/get-item-descendants.ts:3

import RestfulItemServiceClient from "../../client.js";

LOWFilesystem / path · fs.traversal · CWE-22, CWE-59

src/tools/item-service/logic/composite/get-languages.ts:3

import RestfulItemServiceClient from "../../client.js";

LOWFilesystem / path · fs.traversal · CWE-22, CWE-59

src/tools/item-service/logic/simple/create-item.ts:3

import RestfulItemServiceClient from "../../client.js";

LOWNetwork egress · net.metadata_ip · CWE-200, CWE-319

docs/configuration.md:166

addresses (including the `169.254.169.254` cloud metadata endpoint) are refused unless

Why it matters. cloud metadata endpoint: the classic SSRF credential grab

LOWNetwork egress · net.metadata_ip · CWE-200, CWE-319

tests/unit/media.test.ts:94

await expect(assertFetchableSourceUrl("http://169.254.169.254/latest/meta-data/", {}))

Why it matters. cloud metadata endpoint: the classic SSRF credential grab

LOWNetwork egress · net.metadata_ip · CWE-200, CWE-319

tests/unit/media.test.ts:129

headers: { location: "http://169.254.169.254/latest/meta-data/" },

Why it matters. cloud metadata endpoint: the classic SSRF credential grab