Connect an agent

Claude (web, desktop and phone)

1. In Claude, open Customize > Connectors > Add custom connector.
2. Name it vibecms and enter https://app.vibecms.dev/mcp as the URL.
3. Choose Connect or Sign in when prompted. Sign in to vibecms, choose the blog and access level, then select Allow.

Sign-in happens before MCP discovery or tool use, not only when you first call a tool. No agent key is needed. Only a blog owner can connect an app.

Access levels

See the exact scope strings and tools. Choose the smallest level that fits the work. Billing, key management, permanent post deletion, and blog or account deletion remain human actions.

When signing in, you pick the level on the approval screen. Write and publish is preselected; choose Write drafts for less, or Manage only when the job needs it (for example an import with redirects, or connecting your newsletter tool). An app that asks for fewer permissions only gets the levels it asked for. A tool call that lacks permission returns a tool error; it does not automatically request more access. To change the level later, disconnect the app under Connect → Connected apps and connect again.

Claude Code

claude mcp add --transport http vibecms https://app.vibecms.dev/mcp

In Claude Code, open /mcp, select vibecms, and sign in. Choose a blog and access level on the approval screen.

Self-hosters should replace https://app.vibecms.dev with their API and dashboard Worker origin.

Claude Code plugin

The vibecms plugin bundles the hosted MCP server and all vibecms skills:

claude plugin marketplace add moinulmoin/vibecms
claude plugin install vibecms@vibecms

Once the plugin is enabled, use /mcp to sign in and approve the connection.

Inside a session, /plugin marketplace add moinulmoin/vibecms followed by /plugin install vibecms@vibecms does the same. The plugin always connects to https://app.vibecms.dev/mcp; self-hosters should use claude mcp add with their own origin instead.

Disconnect

Open Dashboard > Connect, find the app under Connected apps, and choose Disconnect. It loses access right away; your posts stay. Only the blog owner can disconnect an app.

Use an agent key

For Codex, Cursor, or another client using a bearer key, open Dashboard > Connect, choose a key level, create the key, and copy it immediately. vibecms reveals each key once. Only the blog owner can create or revoke keys. Existing API-key users do not need OAuth sign-in; keep sending the key on every MCP request, including discovery.

Codex

Add to ~/.codex/config.toml, then restart Codex:

[mcp_servers.vibecms]
url = "https://app.vibecms.dev/mcp"
http_headers = { "Authorization" = "Bearer vc_..." }

Cursor

Add to ~/.cursor/mcp.json (or a project’s .cursor/mcp.json):

{
  "mcpServers": {
    "vibecms": {
      "url": "https://app.vibecms.dev/mcp",
      "headers": { "Authorization": "Bearer vc_..." }
    }
  }
}

The Connect page also offers a one-click Cursor install link once a key exists.

Generic Streamable HTTP client

{
  "mcpServers": {
    "vibecms": {
      "type": "http",
      "url": "https://app.vibecms.dev/mcp",
      "headers": { "Authorization": "Bearer vc_..." }
    }
  }
}

Install the agent skills

npx skills add https://vibecms.dev --skill '*'

This installs vibecms-core, vibecms-writing, vibecms-seo, vibecms-import, vibecms-newsletter, vibecms-cross-post, and vibecms-ship-to-draft. Run npx skills update to stay current. Skills never change the connection’s or key’s permissions.

Other ways to get the same skills, always the latest version:

• The CLI saves every skill to .agents/skills: npx vibecms-cli skills get. Pass skill names to select a subset, --dir <path> to choose the folder, or --force to overwrite existing files. Use npx vibecms-cli skills list to discover names. See the CLI guide.
• Over MCP or REST, an authenticated agent can call skills.list and skills.get (GET /api/v1/skills, GET /api/v1/skills/{name}). Save each content as <skills folder>/<name>/SKILL.md. OAuth connections are for MCP; REST uses an agent key.
• The files are public at /.well-known/agent-skills/index.json.

Verify the credential

Tool discovery requires authentication, but it does not prove that the credential has permission to read your site. Ask the connected agent to call sites.get, or check a key with:

curl https://app.vibecms.dev/mcp \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer vc_..." \
  --data '{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"sites.get","arguments":{}}}'

A valid key returns the current site. A missing or invalid key returns 401; a valid credential without sites:read returns FORBIDDEN.

Keep the key out of source control, published prompts, screenshots, and issues. Delete an unused or exposed key under Dashboard > Connect and create a new one.