# Best MCP CMS 2026: 11 CMS with Model Context Protocol compared > Source: > Published: 2026-11-06 14:13:07+00:00 Nine of the ten CMSs in this comparison now have an official MCP server (Drupal's is a contributed module), and most of them let Claude, ChatGPT or Cursor create, change and publish content on your site. Before you connect one, you'll want to know what happens when an agent uses it: I went through the MCP docs, changelogs and, where available, the source code of ten CMSs (eleven servers, because WordPress has two) to answer these questions, and took a shorter look at six more. ✅ yes · ⚠️ partly or with conditions · ❌ no · ❓ not documented | | Writes land as | Agent can publish | Server-side limits | Checked against content model | |---|---|---|---|---| | Contentful | ✅ Draft | ✅ | Per environment, read-only or read/write | ⚠️ | | Craft CMS 5.12 | ⚠️ Live, draft on request | ✅ | Three access levels | ✅ | | Directus 11.12+ | ⚠️ Depends on `status` field | ✅ | Deletes off by default, user role | ❓ | | Drupal | ⚠️ Depends on installed tools | ⚠️ | Per tool | ❓ | | PagibleAI | ✅ Draft version | ✅ | User permissions per action | ✅ | | Payload | ⚠️ Published unless `draft: true` | ✅ | Per API key and operation | ⚠️ | | Sanity | Draft or release | ✅ | Token role only | ⚠️ | | Storyblok | ✅ Draft unless `publish` is set | ✅ | Only in the client | ❓ | | Strapi 5.49+ | ✅ Draft with Draft & Publish | ✅ | Read-only tokens | ⚠️ | | WordPress | ⚠️ Depends on plugins | ⚠️ | Abilities private by default | ⚠️ | | WordPress.com | ✅ Draft | ✅ | Tool groups per site | ❓ | | | Runs on | Auth | Web chat apps | Cost | |---|---|---|---|---| | Contentful | Hosted, local server (MIT) | OAuth 2.1, token | ✅ | Free for all customers | | Craft CMS 5.12 | Your server, in core | OAuth, stdio | ✅ | All editions | | Directus 11.12+ | Your server or Cloud, in core | OAuth 2.1 (v12), token | ✅ (v12) | All plans | | Drupal | Contrib module, beta | OAuth (alpha), stdio | ⚠️ | Free | | PagibleAI | Your server, in core | OAuth (Passport) | ✅ | Free | | Payload | Your server, plugin | API key | ❌ | Free | | Sanity | Hosted only | OAuth, token | ✅ | Free for all projects | | Storyblok | Hosted only | OAuth, token | ✅ | All plans | | Strapi 5.49+ | Your server, in core | Admin API token | ❌ | Free on all plans | | WordPress | Your server, MCP Adapter plugin | Application password, JWT | ❌ | Free | | WordPress.com | Hosted | OAuth 2.1 | ✅ | All sites | "Agent can publish" means the server has a publish tool. Whether a specific agent may use it always depends on the permissions of the user or token it connects with. "Web chat apps" means claude.ai and ChatGPT in the browser, which need a remote server with OAuth. Local clients like Claude Code and Cursor work with all of them. Contentful has a [remote MCP server](https://www.contentful.com/blog/remote-mcp-now-generally-available/), generally available since July 2026 and free for all customers, plus an MIT-licensed [local server](https://github.com/contentful/contentful-mcp-server) with 88 tools in version 1.24.5. They cover entries, content types, assets, locales, environments, tags, taxonomies, releases and AI Actions. New entries are drafts, and publishing is a separate tool call. Before an agent can use the remote server in a space, an admin has to install the Contentful MCP app there and decide which tool categories are allowed per environment, each as read-only or read/write. The local server can protect whole environments from writes with `PROTECTED_ENVIRONMENTS`. Its `update_entry` tool also requires the `sys.version` the agent read and fails if someone changed the entry in the meantime; `patch_entry` only checks it when the agent passes one. Of the hosted options, this is the one with the most control on the server side. What the docs don't explain is how agent writes are validated: Contentful enforces content type validations when an entry is published, not when a draft is saved, and the MCP docs describe no extra check for agent writes. Craft 5.12 (November 3, 2026) ships [MCP in core](https://craftcms.com/docs/5.x/system/mcp), available in every edition. There are three servers: an authenticated HTTP server with OAuth, 2FA and a consent screen, a public HTTP server that only exposes content an admin approved, and a stdio server for local use. The 5.12.0.1 release defines 68 tools covering entries, drafts, revisions, assets, sections, fields, users, permissions, plugins and project config. The access levels are well thought out. "Read only" is preselected in the consent screen, "Read and write" is opt-in and "Full access" is reserved for admins. Element input is validated against JSON schemas, and `elements_validate` checks an entry against the live rules without saving it. The default is the weak spot: `elements_create` saves a live entry unless the agent passes `asUnpublishedDraft: true`. The stdio server also ignores the OAuth access levels and can do anything the selected user can. Assets can only be created from HTTPS URLs so far. Craft's license is proprietary, but the Solo edition is free. Solo allows only one user account, though, so you can't create a separate agent user there: the agent acts as your admin, and only the access level from the consent screen limits it. Directus has an [MCP server in core](https://directus.com/docs/guides/ai/mcp) since 11.12, off by default and available on all plans. Version 12 added OAuth 2.1 with PKCE. Its 12 grouped tools in version 12.6 handle items, files, folders, flows and the schema: collections, fields and relations. The [security page](https://directus.com/docs/guides/ai/mcp/security) is unusually candid. It tells you to create a dedicated AI user instead of using an admin, to grant delete rights only when needed and to review every tool call. "Allow Deletes" is off by default. There's one catch: in the version 12 source, permission rules that limit fields, filter items or set validation need a license entitlement. Without it, a role only gets full access to whole collections. The [pricing page](https://directus.com/pricing) lists "Advanced RBAC" and "Granular RBAC" on different plans, but doesn't say which one includes these rules, so check before you rely on them for an agent user. Directus has no separate draft concept for agents; whether an item is a draft depends on how you use the `status` field in your data model. Directus has been source-available since version 10 (BSL 1.1), not OSI-approved open source. With version 12, it moved to the Monospace Sustainable Core License, under which each release becomes GPL-3.0 four years after it's published. The [MCP Server](https://www.drupal.org/project/mcp_server) module (2.0.0-beta7, October 2026) is maintained by Lullabot and Omedia with sponsorship from Acquia. It has no stable release, so it isn't covered by Drupal security advisories. The module itself ships no content tools. You map tools from the Tool API, for example from Tool Belt, or write your own `#[Tool]` plugins. That's flexible, but what an agent can do, and whether it creates drafts through Content Moderation, depends entirely on what you install and configure. OAuth with per-tool scopes comes from a submodule that's still alpha and requires Drupal 11. If you're already deep into Drupal, it's worth a test. For a production site, I'd wait for a stable release. [PagibleAI](https://pagible.com) is an MIT-licensed CMS package for Laravel. The [MCP server](https://pagible.com/configure-mcp) is part of the default installation and has 47 tools: 32 for pages, shared elements and files, 12 AI tools (refine, translate, image generation and editing, alt text, transcription) and 3 metrics tools that return page analytics, Google Search queries, PageSpeed data and keyword volumes. Every save creates a new draft version that editors can diff in the history. Content is validated against the same JSON schema that defines the editor forms, so an agent can't save a field or element type your site doesn't know. Saves must include the `latest_id` of the version the agent read, which catches concurrent edits by a person in the admin panel. Deletes are soft and can be undone with the restore tools. Authentication uses OAuth via Laravel Passport, and each tool checks the user's CMS permissions, such as `page:save` or `page:publish`. An editor without publish rights can let an agent prepare pages, but not put them live. Publishing can be scheduled with an `at` date. You need a Laravel app and have to set up Passport yourself. The tools only cover content, so agents can't manage users or settings, and they can't change the content model, because the schema lives in your code. Payload's official [MCP plugin](https://payloadcms.com/docs/plugins/mcp) runs inside your app under the MIT license. Nothing is exposed by default: you enable each collection and operation in the config, and then per API key. Access runs as the key's user, so collection access rules, hooks and multi-tenant restrictions still apply. In the 3.x source, the `draft` parameter of the create and update tools defaults to `false`. On a collection with drafts enabled, an agent therefore overwrites the published document unless it explicitly asks for a draft. The docs don't mention this. The docs do warn that models get the full document by default, so you should strip sensitive fields with `overrideResponse` or `select`. The 4.0 beta adds tools for versions, restore, duplicates and schema. The [hosted MCP server](https://www.sanity.io/docs/ai/mcp-server) has been generally available since December 2025 and is free for all projects; only the image tools use AI credits. Its docs list 60 tools for GROQ queries, documents, releases, assets and semantic search, and even for deploying schemas and Studios. Edits are saved to drafts or release versions, never directly to published content (except for `liveEdit` types). Since version 2.45 in October 2026, writes that fail validation against the deployed schema are blocked. Creates and patches use looser structural rules, publishing checks required fields, and your custom validation rules are still skipped. There's no read-only mode or tool allow-list on the server. What an agent can do is defined by the role of its token, and an agent with a token that can deploy schemas can change your content model. Storyblok's [hosted server](https://www.storyblok.com/docs/tooling/mcp-server) takes an unusual approach. Instead of one tool per endpoint, it has seven: `search` and `describe` to discover the Management API, `execute_readonly`, `execute_mutating` and `execute_destructive` to call it, and two upload tools. This keeps the agent's context small and still covers stories, components, assets, datasources, workflows and releases. The three execute tools make it easy to require approval for writes and deletes in clients like Claude. That's a client setting, though, not a restriction on the server. Access is limited to the spaces and permissions granted during OAuth. Creates accept a `publish` parameter, so an agent can publish in the same call. Uploading files currently needs shell access, so it only works in agents like Claude Code. The server is available on all plans, including the free Starter plan. Strapi 5.49 made its [built-in MCP server](https://strapi.io/blog/the-strapi-mcp-server-is-now-ga) generally available on all plans, including the free Community edition. It's off by default and generates tools per content type: list, get, create, update, delete, publish, unpublish and discard draft, plus ten Media Library tools. With Draft & Publish enabled, new entries are drafts, and the publish tool needs the publish permission. Tokens are capped at their owner's permissions and adjust when the owner's roles change. A read-only token only gets the list and read tools, which is the simplest way to start. Agents can't change content types and can't upload new files. In the source, every content type gets a strict input schema with field types, enums and min/max limits, so unknown fields are rejected. Dynamic zones and media are the exception: they're passed as untyped arrays. For self-hosted WordPress, the official [MCP Adapter](https://wordpress.org/plugins/mcp-adapter/) (version 0.7.1) turns registered "abilities" into MCP tools. WordPress core only registers three read-only abilities for site, user and environment info. Everything else, including writing posts, comes from plugins that register public abilities. What an agent can do, and whether it creates drafts, depends on those plugins. Each ability declares a JSON schema for its input, but whether that schema matches your content model is up to the plugin. Authentication uses application passwords or JWT, so web clients that need OAuth can't connect without extra work. [WordPress.com](https://wordpress.com/support/mcp/) runs a hosted server with OAuth 2.1 that can write posts, pages, comments, categories, tags and media, and works for Jetpack-connected sites, too. You can switch tool groups on and off per site. Posts default to drafts, and permanent deletions always ask for confirmation. Changes to published posts go live immediately, though. Some things don't show up in feature lists, but they decide how much damage a wrong tool call can do: Connecting a server takes one command in Claude Code. A hosted server like Contentful's opens the OAuth login in your browser (an admin has to install the Contentful MCP app in the space first), and a self-hosted one like PagibleAI's runs under your own domain: ``` claude mcp add --transport http contentful https://mcp.contentful.com/mcp claude mcp add --transport http --scope user pagible https://example.com/mcp/cms/ ``` In claude.ai, the same URLs go into Settings → Connectors → Add custom connector, and in ChatGPT into Settings → Apps → Create. `draft: true`. I read the official MCP docs, changelogs and announcements of each CMS in November 2026. For Craft, Payload, Strapi and PagibleAI, I also checked draft handling, permissions or input validation in the source code, and I counted the registered tools in the current releases of Contentful's local server, Craft, Directus, Kontent.ai, Umbraco and PagibleAI. I didn't test paid Enterprise features. MCP servers change monthly. If you find something that's outdated, please let me know in the comments. Which CMS do you let an agent write to, and does it create drafts?