Atlas / MCP servers / mfydev / Ghost

GhostSAFE

Name: Ghost
Author: mfydev

mcp/mfydev/ghost

MCP server by mfydev · claude · claude ai · ghost · Audited 2026-10-06

A Model Context Protocol (MCP) server for interacting with Ghost CMS through LLM interfaces like Claude. Allow you to control your Ghost blog by simply asking Claude etc.

Verdict

SAFE

Grade

Trust score

89 /100

Exposed tools

42 17r · 16w · 9d

Transport

stdio

License

MIT

Stars

236

Overview

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

A Model Context Protocol (MCP) server for interacting with Ghost CMS through LLM interfaces like Claude. This server provides secure and comprehensive access to your Ghost blog, leveraging JWT authentication and a rich set of MCP tools for managing posts, users, members, tiers, offers, and newsletters.

Features

Secure Ghost Admin API requests with @tryghost/admin-api
Comprehensive entity access including posts, users, members, tiers, offers, and newsletters
Advanced search functionality with both fuzzy and exact matching options
Detailed, human-readable output for Ghost entities
Robust error handling using custom GhostError exceptions
Integrated logging support via MCP context for enhanced troubleshooting

Usage

To use this with MCP clients, for instance, Claude Desktop, add the following to your claude_desktop_config.json:

{
"mcpServers": {
"ghost-mcp": {
"command": "npx",
"args": ["-y", "@fanyangmeng/ghost-mcp"],
"env": {
"GHOST_API_URL": "https://yourblog.com",
"GHOST_ADMIN_API_KEY": "your_admin_api_key",
"GHOST_API_VERSION": "v5.0"
}
}
}
}

Available Resources

The following Ghost CMS resources are available through this MCP server:

Posts: Articles and content published on your Ghost site.
Members: Registered users and subscribers of your site.
Newsletters: Email newsletters managed and sent via Ghost.
Offers: Promotional offers and discounts for members.
Invites: Invitations for new users or staff to join your Ghost site.
Roles: User roles and permissions within the Ghost admin.
Tags: Organizational tags for posts and content.
Tiers: Subscription tiers and plans for members.
Users: Admin users and staff accounts.
Webhooks: Automated event notifications to external services.

Available Tools

This MCP server exposes

Read from source at commit 00cd55bcba8fOBSERVED · 2026-10-06

Connect

Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.

claude-code

claude mcp add ghost-mcp --env GHOST_ADMIN_API_KEY=${GHOST_ADMIN_API_KEY} -- npx -y @fanyangmeng/[email protected]

claude-desktop

{
  "mcpServers": {
    "ghost-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "@fanyangmeng/[email protected]"
      ],
      "env": {
        "GHOST_ADMIN_API_KEY": "${GHOST_ADMIN_API_KEY}"
      }
    }
  }
}

Exposed tools (42)

17 read · 16 write · 9 destructive. Blast radius: 9 tools can delete or overwrite — an agent that can be talked into calling a tool can be talked into calling this one.

Tool	Risk	Description
`invites_add`	write
`invites_browse`	read
`invites_delete`	destructive
`members_add`	write
`members_browse`	read
`members_delete`	destructive
`members_edit`	write
`members_read`	read
`newsletters_add`	write
`newsletters_browse`	read
`newsletters_delete`	destructive
`newsletters_edit`	write
`newsletters_read`	read
`offers_add`	write
`offers_browse`	read
`offers_delete`	destructive
`offers_edit`	write
`offers_read`	read
`posts_add`	write
`posts_browse`	read
`posts_delete`	destructive
`posts_edit`	write
`posts_read`	read
`roles_browse`	read
`roles_read`	read
`tags_add`	write
`tags_browse`	read
`tags_delete`	destructive
`tags_edit`	write
`tags_read`	read
`tiers_add`	write
`tiers_browse`	read
`tiers_delete`	destructive
`tiers_edit`	write
`tiers_read`	read
`users_browse`	read
`users_delete`	destructive
`users_edit`	write
`users_read`	read
`webhooks_add`	write
`webhooks_delete`	destructive
`webhooks_edit`	write

Trust audit

SAFEgrade B · trust 89/100 Nothing in the source contradicts what it says it does. Grade A is reserved for packages that have also passed the behavioural sandbox.

Layer	What it checks	Result
L0	Provenance & inventory	PASS
L1	Static analysis of the code	PASS
L2	Instruction surface (what it tells the agent)	PASS
L3	Class-specific surface	WARN
L4	Behavioural (sandbox)	SKIPPED

What the source does

Filesystem: declared (1 observation(s))
Network: none-observed
Shell: none-observed
Dependencies: not all pinned
Secrets in source: none-found

Findings (3)

MEDIUMFilesystem / path · mcp.destructive_tools · CWE-22, CWE-59

invites_delete, members_delete, newsletters_delete, offers_delete, posts_delete, tags_delete, tiers_delete, users_delete, webhooks_delete

Why it matters. 9 tool(s) can delete or overwrite

Fix. prefer a read-only mode or scoped tokens; the page states the blast radius

LOWSupply chain · supply.unpinned · CWE-829, CWE-1357

package.json

@modelcontextprotocol/sdk, @tryghost/admin-api, axios, zod, @types/axios, @types/node, typescript

Why it matters. 7 dependency range(s) float

Fix. pin exact versions or ship a lockfile

INFOInventory / provenance · inv.oversize · CWE-1104

assets/ghost-mcp-demo.gif

assets/ghost-mcp-demo.gif

Why it matters. 9676768 bytes not read

Gates applied: no_behavioural_pass.

Audited 2026-10-06 · audit v0.4.1 · source sha 00cd55bcba8ffull audit observations/trust-audit/mcp-server/mfydev__ghost.json · Report an issue / request a re-scan

Audit history

Every audit this server has had. A grade with a past is a grade somebody is still checking.

Date	Source	Verdict	Grade	Score	Change
2026-10-06	`00cd55bcba8f`	SAFE	B	89	first audit

Questions

What is the Ghost MCP server?

A Model Context Protocol (MCP) server for interacting with Ghost CMS through LLM interfaces like Claude. Allow you to control your Ghost blog by simply asking Claude etc.

What tools does Ghost expose?

42 in total: 17 read-only, 16 that write, and 9 that can delete or overwrite (invites_delete, members_delete, newsletters_delete, offers_delete, posts_delete). Every one is listed on this page with its risk.

Is Ghost safe to connect to an agent?

The audit found nothing in the source that contradicts what it says it does, and graded it B (89/100). Grade A is held back for packages that have also passed a sandboxed behavioural run, which is why a clean server reads B. Separately from the audit: 9 of its tools can destroy data, so scope the token you give it to what you actually need.

What credentials does Ghost need?

It reads GHOST_ADMIN_API_KEY from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.

How does Ghost run?

It speaks stdio, so it runs as a local process your client starts. It is published on npm as @fanyangmeng/ghost-mcp at 0.2.0.

How current is this page?

The grade is for one exact copy of the source (00cd55bcba8f), read on 2026-10-06. The repository is watched and re-audited when it changes.

Source	mfydev/ghost-mcp
npm	`@fanyangmeng/ghost-mcp@0.2.0`
Transports	stdio
Credentials it reads	`GHOST_ADMIN_API_KEY`
License	MIT
Activity	pushed 162d ago