Connect an agent
Create a scoped key, configure MCP, and verify access.
Open Dashboard > Connect, choose a key level, create the key, and copy it immediately. vibecms reveals each key once.
| Level | What your agent can do |
|---|---|
| Write drafts | Read the site and posts, create and edit drafts, upload images, and read activity. You publish. |
| Write and publish | Everything in Write drafts, plus publish and schedule posts. |
| Manage | Everything in Write and publish, plus change site settings, theme, voice, and signup form; read tags and analytics; and archive posts. |
See the exact scope strings and tools. Choose the smallest level that fits the work. Billing, key management, permanent post deletion, and blog or account deletion remain human actions.
Claude Code
claude mcp add --transport http vibecms https://app.vibecms.dev/mcp \
--header "Authorization: Bearer vc_..."
Self-hosters should replace https://app.vibecms.dev with their API and dashboard Worker origin.
Generic Streamable HTTP client
{
"mcpServers": {
"vibecms": {
"type": "http",
"url": "https://app.vibecms.dev/mcp",
"headers": { "Authorization": "Bearer vc_..." }
}
}
}
Install the agent skills
npx skills add moinulmoin/vibecms \
--skill vibecms-core \
--skill vibecms-writing
vibecms-core covers operation order, version binding, approval, and recovery. vibecms-writing covers editorial work. Neither skill changes the key’s permissions.
Verify the credential
Tool discovery does not prove that the key can access your site. Call sites.get:
curl https://app.vibecms.dev/mcp \
-H "Content-Type: application/json" \
-H "Authorization: Bearer vc_..." \
--data '{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"sites.get","arguments":{}}}'
A valid key returns the current site. A missing or invalid key returns 401; a valid key without sites:read returns FORBIDDEN.
Keep the key out of source control, published prompts, screenshots, and issues. Delete an unused or exposed key under Dashboard > Connect and create a new one.