Scopes and MCP tools
See every agent tool and the scope required to call it.
Each key belongs to one site. The server checks the key’s scopes for every MCP or REST operation that reads or changes the site. The current contract defines 42 tools. Two of them, skills.list and skills.get, return the public vibecms agent skills, so any valid key can call them (none below).
| Scope | Tools |
|---|---|
sites:read |
sites.get, sites.location.get, redirects.list |
site:write |
sites.update, sites.theme.get, sites.theme.update, sites.theme.revert, sites.voice.update, sites.signup_form.update, sites.location.set_subpath, sites.location.check, sites.location.remove, redirects.set, redirects.delete, tags.list |
analytics:read |
analytics.get |
posts:read |
posts.list, posts.search, posts.get, posts.get_by_slug, posts.versions.list, posts.versions.get, posts.format_guide, posts.preview, posts.seo_check |
posts:create |
posts.create |
posts:update |
posts.update, posts.preview.rotate, posts.unarchive, posts.versions.restore |
posts:publish |
posts.publish, posts.schedule, posts.unschedule |
posts:archive |
posts.archive |
assets:write |
assets.upload, assets.list, assets.get, assets.update |
assets:delete |
assets.delete |
activity:read |
activity.list |
none |
skills.list, skills.get |
Key levels in Connect
| Level | Granted scopes |
|---|---|
| Write drafts | sites:read, posts:read, posts:create, posts:update, assets:write, activity:read |
| Write and publish | Write drafts scopes plus posts:publish |
| Manage | Write and publish scopes plus posts:archive, site:write, analytics:read |
Manage can archive posts. None of these three levels grants assets:delete. The key’s scope controls whether a call is allowed; ask the person to approve the exact version and time before publishing or scheduling.
redirects.set and redirects.delete change live old-link behavior. Obtain the owner’s approval before calling them; one approval can cover an import batch. posts.publish can include originalPublishedAt on a post’s first publish for imports, but still requires the posts:publish scope and owner approval.
Never available to agents: billing, creating or deleting keys, permanently deleting archived posts, and deleting the blog or account.