Atlas / MCP servers / umbraco / Umbraco

UmbracoBLOCK

Name: Umbraco
Author: umbraco

mcp/umbraco/umbraco-1

MCP server by umbraco · Audited 2026-10-08

⚑ Report / re-scan Source ↗

A developer focused model context protocol (MCP) server for Umbraco CMS

Verdict

BLOCK

Grade

Trust score

69 /100

Exposed tools

200 268r · 94w · 39d

Transport

stdio · streamable-http

License

MIT

Stars

Overview

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

Umbraco MCP

An MCP (Model Context Protocol) server for Umbraco CMS that unlocks AI-powered content management. It provides comprehensive access to the Umbraco Management API, enabling your AI agent to perform back office tasks through natural conversation - freeing you from the UI and making complex, repetitive workflows that would be tedious or impossible manually become effortless.

Intro

The MCP server authenticates using an Umbraco API user, ensuring secure, permission-based access to the Umbraco Management API. This means you maintain complete control over what your AI agent can do through Umbraco's standard user permission system - no special security model required.

Quick Start

1. Create an Umbraco API User

First, create an Umbraco API user with appropriate permissions. You can find instructions in Umbraco's documentation.

2. Install in Claude Desktop

Download and install the Claude Desktop app, then add the MCP server to your configuration:

Open Claude Desktop Settings > Developer > Edit Config
Add this configuration to your claude_desktop_config.json:

{
"mcpServers": {
"umbraco-mcp": {
"command": "npx",
"args": ["@umbraco-cms/mcp-dev@17"],
"env": {
"NODE_TLS_REJECT_UNAUTHORIZED": "0",
"UMBRACO_CLIENT_ID": "your-api-user-id",
"UMBRACO_CLIENT_SECRET": "your-api-secret",
"UMBRACO_BASE_URL": "https://localhost:{port}",
"UMBRACO_INCLUDE_TOOL_COLLECTIONS": "document,media,document-type,data-type"
}
}
}
}

Fully restart Claude Desktop (including in the system tray on Windows)

Documentation

For complete installation instructions, c

Read from source at commit a449a900e43bOBSERVED · 2026-10-08

Connect

Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.

claude-code (npm)

claude mcp add mcp-dev --env UMBRACO_CLIENT_ID=${UMBRACO_CLIENT_ID} --env UMBRACO_CLIENT_SECRET=${UMBRACO_CLIENT_SECRET} -- npx -y @umbraco-cms/[email protected]

Exposed tools (200)

268 read · 94 write · 39 destructive. Blast radius: 39 tools can delete or overwrite — an agent that can be talked into calling a tool can be talked into calling this one.

Tool	Risk	Description
`copy-data-type`	read	Copy a data type by Id. Returns the new data type
`copy-document`	read	Copy a document to a new location. Returns the new document
`copy-document-type`	read	Copy a document type to a new location. Returns the new document type
`copy-element`	read	Copy an element to a new location. Returns the new element
`copy-media-type`	read	Copy a media type to a new location
`copy-member-type`	read	Copy a member type to a new location
`create-data-type-folder`	write	Creates a new data type folder
`create-dictionary`	write	Creates a new dictionary item.
`create-document-blueprint`	write	Creates a new document blueprint.
`create-document-blueprint-folder`	write	Creates a new document blueprint folder
`create-document-type-folder`	write	Creates a new document type folder
`create-document-version-rollback`	write	Rollback document to a specific version
`create-element-folder`	write	Creates a new element folder
`create-language`	write	Creates a new language
`create-media`	write	Upload any media file to Umbraco (images, documents, audio, video, SVG, or custom types). Pick the sourceType that matches where the file lives: - If the file is attached to this chat or you just generated it → sourceType=
`create-media-folder`	write	Creates a new folder in the media library. Use this to organize media items into folders. For uploading actual media files (images, documents, etc.), use the create-media tool instead.
`create-media-multiple`	write	Batch upload multiple media files to Umbraco (maximum ${MAX_BATCH_SIZE} files per batch). Use this — not several separate create-media calls — when the user attached or generated multiple files in this chat (sourceType=
`create-media-type`	write	Creates a new media type
`create-media-type-folder`	write	Creates a new media type folder
`create-member`	write	Creates a member in Umbraco. Use this endpoint to create new members with the specified properties and groups.
`create-member-group`	write	Creates a new member group
`create-member-type`	write	Creates a new member type
`create-partial-view`	write	Creates a new partial view
`create-partial-view-folder`	write	Creates a new partial view folder
`create-script`	write	Creates a new script
`create-script-folder`	write	Creates a new script folder
`create-stylesheet`	write	Creates a new stylesheet.
`create-stylesheet-folder`	write	Creates a new stylesheet folder
`create-template`	write	Creates a new template
`create-user-data`	write	Creates a new user data record
`create-user-group`	write	Creates a new user group
`create-webhook`	write	Creates a new webhook Must contain at least one event from the events listed at /umbraco/management/api/v1/webhook/events endpoint. Cannot mix different event types in the same webhook.
`delete-data-type`	destructive	Deletes a data type by Id
`delete-data-type-folder`	destructive	Deletes a data type folder by Id
`delete-dictionary-item`	destructive	Deletes a dictionary item by Id
`delete-document`	destructive	Deletes a document by Id
`delete-document-blueprint`	destructive	Deletes a document blueprint by Id
`delete-document-blueprint-folder`	destructive	Deletes a document blueprint folder by Id
`delete-document-public-access`	destructive	Removes public access settings from a document by Id.
`delete-document-recycle-bin-item`	destructive	Permanently deletes a document from the recycle bin by its id
`delete-document-type`	destructive	Deletes a document type by Id
`delete-document-type-folder`	destructive	Deletes a document type folder by Id
`delete-element`	destructive	Deletes an element by Id
`delete-element-folder`	destructive	Deletes an element folder by Id
`delete-element-folder-from-recycle-bin`	destructive	Permanently deletes an element folder from the recycle bin by Id
`delete-element-from-recycle-bin`	destructive	Permanently deletes an element from the recycle bin by its id
`delete-from-recycle-bin`	destructive	Deletes a document from the recycle bin by Id.
`delete-language`	destructive	Deletes a language by ISO code
`delete-log-viewer-saved-search-by-name`	destructive	Deletes a saved search by name
`delete-media`	destructive	Deletes a media item by Id. Works for all media types including folders, images, files, videos, etc.
`delete-media-from-recycle-bin`	destructive	Deletes a media item from the recycle bin by Id.
`delete-media-recycle-bin-item`	destructive	Permanently deletes a media item from the recycle bin by its id
`delete-media-type`	destructive	Deletes a media type by Id
`delete-media-type-folder`	destructive	Deletes a media type folder by Id
`delete-member`	destructive	Deletes a member by Id
`delete-member-group`	destructive	Deletes a member group by Id
`delete-member-type`	destructive	Deletes a member type by id
`delete-partial-view`	destructive	Deletes a partial view by its path
`delete-partial-view-folder`	destructive	Deletes a partial view folder by its path
`delete-redirect`	destructive	Deletes a specific redirect by its ID. Parameters: - id: The unique identifier of the redirect to delete (string)
`delete-script`	destructive	Deletes a script by path
`delete-script-folder`	destructive	Deletes a script folder by path
`delete-stylesheet`	destructive	Deletes a stylesheet by its path
`delete-stylesheet-folder`	destructive	Deletes a stylesheet folder by its path
`delete-template`	destructive	Deletes a template by Id
`delete-temporary-file`	destructive	Deletes a temporary file by Id
`delete-user-avatar-by-id`	destructive	Deletes an avatar for a specific user by ID (admin only or self-service)
`delete-user-data`	destructive	Deletes user data by its id
`delete-user-group`	destructive	Deletes a user group by Id
`delete-user-groups`	destructive	Deletes all user groups
`delete-webhook`	destructive	Deletes a webhook by id
`empty-element-recycle-bin`	read	Empties the element recycle bin.
`empty-media-recycle-bin`	read	Empties the media recycle bin.
`empty-recycle-bin`	read	Empties the document recycle bin.
`execute-health-check-action`	write	Executes remedial actions for health issues. WARNING: This performs system remedial actions that may modify system configuration, files, or database content. Use with caution.
`execute-template-query`	write	Executes template queries and returns generated LINQ code with sample results and execution time. IMPORTANT: Always follow the example format exactly. Example: {
`find-data-type`	read	Finds a data type by Id or Name
`find-dictionary`	read	Finds a dictionary by Id or name
`find-member`	read	Finds members by various filter criteria
`find-user`	read	Finds users by filtering with name, email, or other criteria
`get-all-data-types`	read	Gets all data types by recursively fetching from root and all children. This is the preferred approach when you need to understand the full folder structure. For large sites, this may take a while to complete. For smaller sites its more efficient than fetching all data types by folder.
`get-all-document-types`	read	Gets all document types by recursively fetching from root and all children. This is the preferred approach when you need to understand the full folder structure. For large sites, this may take a while to complete. For smaller sites its more efficient than fetching all documents by folder.
`get-all-member-groups`	read	Gets all member groups with optional pagination
`get-all-redirects`	read	Gets all redirects from the Umbraco server. Returns a list of redirects with their details.
`get-all-webhook-logs`	read	Gets logs for all webhooks
`get-allowed-media-type`	read	Gets allowed file extensions for media types
`get-collection-document-by-id`	read	Get a collection of document items Use this to retrieve a filtered and paginated collection of document items based on various criteria like data type, ordering, and filtering.
`get-collection-media`	read	Get a collection of media items Use this to retrieve a filtered and paginated collection of media items based on various criteria like data type, ordering, and filtering.
`get-culture`	read	Retrieves a paginated list of cultures that Umbraco can be configured to use
`get-data-type`	read	Gets a data type by Id
`get-data-type-ancestors`	read	Gets the ancestors of a data type by Id
`get-data-type-ancestors-batch`	read	Gets the ancestor chain (breadcrumb) for multiple data type Ids in one call. Returns one entry per requested Id, each containing that Id
`get-data-type-batch`	read	Gets full data types for multiple Ids in one call. Returns each data type
`get-data-type-children`	read	Gets the children data types or data type folders by the parent id
`get-data-type-configuration`	read	Gets global data type configuration settings including change permissions and default list view IDs
`get-data-type-folder`	read	Gets a data type folder by Id
`get-data-type-root`	read	Gets the root level of the data type and data type folders in the tree.
`get-data-type-schemas`	read	Gets JSON Schemas for multiple data types in a single batch request. Returns JSON Schemas describing the value structure for each specified data type. This is more efficient than calling get-data-type-schema multiple times when you need schemas for several data types.
`get-data-type-search`	read	Searches the data type tree for a data type by name. It does NOT allow for searching for data type folders.
`get-data-type-siblings`	read	Gets sibling data types or data type folders for a given descendant id
`get-data-type-tree-search`	read	Searches data types in tree-node shape (with hasChildren and parent for tree navigation). Use this when paginating through tree results; for a flat search of items use get-data-type-search. Optional itemKind filter accepts
`get-data-types-by-id-array`	read	Gets data types by IDs (or empty array if no IDs are provided)
`get-default-language`	read	Gets the default language
`get-dictionary`	read	Gets a dictionary by Id
`get-dictionary-ancestors`	read	Gets the ancestors of a dictionary item by Id
`get-dictionary-by-id-array`	read	Gets dictionary items by IDs (or empty array if no IDs are provided)
`get-dictionary-children`	read	Gets the children of a dictionary item by Id
`get-dictionary-root`	read	Gets the root level of the dictionary tree
`get-document-ancestors`	read	Gets ancestor items for a document.
`get-document-ancestors-batch`	read	Gets the ancestor chain (breadcrumb) for multiple document Ids in one call. Returns one entry per requested Id, each containing that Id
`get-document-are-referenced`	read	Check if document items are referenced Use this to verify if specific document items are being referenced by other content before deletion or modification.
`get-document-audit-log`	read	Fetches the audit log for a document by Id.
`get-document-blueprint`	read	Gets a document blueprint by Id
`get-document-blueprint-ancestors`	read	Gets the ancestors of a document blueprint by Id
`get-document-blueprint-by-id-array`	read	Gets document blueprints by IDs (or empty array if no IDs are provided)
`get-document-blueprint-children`	read	Gets the children of a document blueprint by Id
`get-document-blueprint-folder`	read	Gets a document blueprint folder by Id
`get-document-blueprint-root`	read	Gets the root level of the document blueprint tree
`get-document-blueprint-scaffold`	read	Get scaffold information for a document blueprint Use this to retrieve the scaffold structure and default values for a document blueprint, typically used when creating new documents from blueprints.
`get-document-blueprint-siblings`	read	Gets sibling document blueprints for a given descendant id
`get-document-by-id`	read	Gets a document by id Use this to retrieve existing documents. When creating new documents, first get an existing document of similar type, then use the Copy document endpoint.
`get-document-by-id-referenced-by`	read	Get items that reference a specific document item Use this to find all content, documents, or other items that are currently referencing a specific document item.
`get-document-children`	read	Gets child items for a document.
`get-document-configuration`	read	Gets the document configuration for the Umbraco instance.
`get-document-domains`	read	Gets the domains assigned to a document by Id.
`get-document-notifications`	read	Gets the notifications for a document by Id.
`get-document-public-access`	write	Gets the public access settings for a document by Id. Set includeAncestors=true to also resolve protection inherited from an ancestor (the response
`get-document-publish`	write	Gets the published state of a document by Id.
`get-document-recycle-bin-siblings`	read	Gets sibling documents in the recycle bin for a given descendant id
`get-document-root`	read	Gets root items for documents.
`get-document-siblings`	read	Gets sibling documents for a given descendant id
`get-document-type-allowed-at-root`	read	Get document types that are allowed at root level
`get-document-type-allowed-children`	read	Gets the document types that are allowed as children of a document type
`get-document-type-allowed-parents`	read	Gets the document type Ids that may be a parent of the given document type. Counterpart of get-document-type-allowed-children — useful when validating where a content node of this type can be placed.
`get-document-type-ancestors`	read	Gets the ancestors of a document type
`get-document-type-ancestors-batch`	read	Gets the ancestor chain (breadcrumb) for multiple document type Ids in one call. Returns one entry per requested Id, each containing that Id
`get-document-type-available-compositions`	read	Gets the available compositions for a document type
`get-document-type-batch`	read	Gets full document types for multiple Ids in one call. Returns each document type
`get-document-type-blueprint`	read	Gets the blueprints for a document type
`get-document-type-by-id`	read	Gets a document type by id
`get-document-type-children`	read	Gets the children of a document type. Use get-all-document-types instead unless you specifically need only child level items for a specific folder.
`get-document-type-composition-references`	read	Gets the composition references for a document type
`get-document-type-configuration`	read	Gets the global configuration for document types
`get-document-type-folder`	read	Gets a document type folder by Id
`get-document-type-root`	read	Gets the root level of the document type tree. Use get-all-document-types instead unless you specifically need only root level items.
`get-document-type-siblings`	read	Gets sibling document types or document type folders for a given descendant id
`get-document-type-tree-search`	read	Searches document types in tree-node shape (with hasChildren and parent for tree navigation). Optional itemKind filter accepts
`get-document-types-by-id-array`	read	Gets document types by IDs (or empty array if no IDs are provided)
`get-document-urls`	read	Gets the URLs for a document.
`get-document-version`	read	List document versions with pagination
`get-document-version-by-id`	read	Get specific document version by ID
`get-element-ancestors`	read	Gets ancestor items for an element.
`get-element-are-referenced`	read	Check if element items are referenced Use this to verify if specific element items are being referenced by other content before deletion or modification.
`get-element-audit-log`	read	Fetches the audit log for an element by Id.
`get-element-by-id`	read	Gets an element by id
`get-element-by-id-referenced-by`	read	Get items that reference a specific element item Use this to find all content, documents, or other items that are currently referencing a specific element item.
`get-element-children`	read	Gets child items for an element.
`get-element-configuration`	read	Gets the element configuration for the Umbraco instance.
`get-element-folder`	read	Gets an element folder by Id
`get-element-item-ancestors`	read	Gets the ancestor chain (breadcrumb) for multiple element Ids in one call. Returns one entry per requested Id, each containing that Id
`get-element-published`	read	Gets the published version of an element by id. Unlike get-element-by-id, which returns the draft/current version, this returns only the data from the last published version of the element.
`get-element-root`	read	Gets root items for elements.
`get-element-siblings`	read	Gets sibling elements for a given descendant id.
`get-element-version`	read	List element versions with pagination
`get-element-version-by-id`	read	Get a specific element version by ID
`get-filter-user-group`	read	Gets filtered user groups
`get-health-check-group-by-name`	read	Gets specific health check group details by name for system monitoring
`get-health-check-groups`	read	Gets a paged list of health check groups for system monitoring
`get-icons`	read	Returns a list of all available Umbraco icons that can be used in document types and element types
`get-indexer`	read	Lists all indexes with pagination support. Returns an object containing: - total: Total number of indexes (number) - items: Array of index objects with name, searcherName, and other properties
`get-indexer-by-index-name`	read	Gets a specific index by its name. Returns detailed information about the index including its configuration and status.
`get-item-document`	read	Gets document items by their ids
`get-item-element`	read	Gets element items by their ids
`get-item-element-folder`	read	Gets element folder items by their ids
`get-item-media-type`	read	Gets media type items by their ids
`get-item-member-search`	read	Searches for member items
`get-item-user`	read	Gets user items for selection lists and pickers
`get-language`	read	Gets all languages with optional pagination
`get-language-by-iso-code`	read	Gets a language by ISO code
`get-language-items`	read	Gets language items (optionally filtered by isoCode)
`get-log-viewer-level`	read	Get log viewer levels
`get-log-viewer-level-count`	read	Get log viewer level counts
`get-log-viewer-log`	read	Get log viewer logs
`get-log-viewer-message-template`	read	Get log viewer message templates
`get-log-viewer-saved-search`	read	Get log viewer saved searches
`get-log-viewer-saved-search-by-name`	read	Gets a saved search by name
`get-log-viewer-validate-logs-size`	write	Validates the size of the logs, for the given start and end date, or the lase day if not provided
`get-manifest-manifest`	read	Gets all manifests (both public and private) from the Umbraco installation. Each manifest contains an extensions property showing what the package exposes to Umbraco. Use to see which packages are installed, troubleshoot package issues, or list available extensions.
`get-manifest-manifest-private`	read	Gets private manifests from the Umbraco installation. Private manifests require authentication and contain administrative/sensitive extensions.
`get-manifest-manifest-public`	read	Gets public manifests from the Umbraco installation. Public manifests can be accessed without authentication and contain public-facing extensions.
`get-media-ancestors`	read	Gets ancestor items for a media.
`get-media-ancestors-batch`	read	Gets the ancestor chain (breadcrumb) for multiple media Ids in one call. Returns one entry per requested Id, each containing that Id
`get-media-are-referenced`	read	Check if media items are referenced Use this to verify if specific media items are being referenced by other content before deletion or modification.
`get-media-audit-log`	read	Fetches the audit log for a media item by Id.
`get-media-by-id`	read	Gets a media item by id Use this to retrieve existing media items.
`get-media-by-id-array`	read	Gets media items by an array of IDs
`get-media-by-id-referenced-by`	read	Get items that reference a specific media item Use this to find all content, documents, or other items that are currently referencing a specific media item.
`get-media-children`	read	Gets child items for a media.
`get-media-configuration`	read	Gets the media configuration for the Umbraco instance.
`get-media-recycle-bin-siblings`	read	Gets sibling media items in the recycle bin for a given descendant id

Trust audit

BLOCKgrade D · trust 69/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.

Layer	What it checks	Result
L0	Provenance & inventory	FAIL
L1	Static analysis of the code	FAIL
L2	Instruction surface (what it tells the agent)	PASS
L3	Class-specific surface	WARN
L4	Behavioural (sandbox)	SKIPPED

What the source does

Filesystem: declared (1 observation(s))
Network: declared (10 observation(s))
Shell: none-observed
Dependencies: not all pinned
Secrets in source: found

Findings (18)

HIGHHard-coded secrets · inv.env_committed · CWE-798, CWE-321

.env

.env

Why it matters. a real .env in the package

Fix. ship .env.example with placeholders only

HIGHNetwork egress · net.tls_off · CWE-200, CWE-319

jest.config.ts:4

process.env.NODE_TLS_REJECT_UNAUTHORIZED = "0";

Why it matters. certificate verification is disabled

Fix. leave verification on

MEDIUMNetwork egress · net.raw_ip · CWE-200, CWE-319

demo-site-template/McpOAuthComposer.cs:51

new Uri("http://127.0.0.1:8787/callback"),

MEDIUMNetwork egress · net.raw_ip · CWE-200, CWE-319

demo-site-template/McpOAuthComposer.cs:56

new Uri("http://127.0.0.1:8787/logout-callback"),

MEDIUMNetwork egress · net.raw_ip · CWE-200, CWE-319

scripts/worktree-create.sh:131

.profiles["Umbraco.Web.UI"].applicationUrl = "https://127.0.0.1:0;http://127.0.0.1:0" |

MEDIUMNetwork egress · net.raw_ip · CWE-200, CWE-319

scripts/worktree-create.sh:133

.iisSettings.iisExpress.applicationUrl = "http://127.0.0.1:0"

MEDIUMFilesystem / path · mcp.destructive_tools · CWE-22, CWE-59

delete-data-type, delete-data-type-folder, delete-dictionary-item, delete-document, delete-document-blueprint, delete-document-blueprint-folder, delete-document-public-access, delete-document-recycle-

Why it matters. 39 tool(s) can delete or overwrite

Fix. prefer a read-only mode or scoped tokens; the page states the blast radius

LOWInventory / provenance · inv.hidden_file · CWE-1104

.dev.vars.example

.dev.vars.example

Why it matters. hidden member outside the usual dotfiles

Fix. review its purpose

LOWInventory / provenance · inv.hidden_file · CWE-1104

.env

.env

Why it matters. hidden member outside the usual dotfiles

Fix. review its purpose

LOWInventory / provenance · inv.hidden_file · CWE-1104

.worktreeinclude

.worktreeinclude

Why it matters. hidden member outside the usual dotfiles

Fix. review its purpose