CONTENT MANAGEMENT / Contentstack
Contentstack MCP
Expose selected Contentstack API groups to a local stdio client with service-specific credentials.
“Contentstack MCP Server”
01 / THE REASONING
Why this made the selection.
- Separates published-content delivery from write-capable management groups.
- Documents region selection and OAuth versus static-token requirements.
- Contentstack’s page separates OAuth from management tokens and delivery tokens, and it says the content delivery API does not support OAuth or management-token authentication.
- A delivery-token-only setup does not require OAuth, and without an OAuth session the client must set the region explicitly.
02 / THE REVIEW RECORD
What we actually inspected.
Source review has boundaries.
A clear record is more useful than a “safe” badge.
Material inspected
- https://www.contentstack.com/docs/developers/contentstack-mcp-server
- Round 2 reread of acquired publisher setup and permission evidence; see immutable wave review.
Our findings
- A delivery token cannot authenticate CMA; a management token is not interchangeable with CDA authentication.
- GROUPS/--groups changes the exposed surface without changing credential permissions.
- The page says management-token authentication is supported only for CMA and CMA Extended. Analytics, Automations, BrandKit, Launch, DeveloperHub, and Personalize still require OAuth.
- The content delivery API does not support OAuth or a management token. It uses a delivery token, and that delivery-token setup does not require OAuth.
- Without an OAuth session, a delivery-token or management-token configuration cannot infer the region. The page says the region must be set explicitly.
- Management tokens can authenticate CMA and CMA Extended without OAuth, but do not authenticate Analytics, Automations, Launch or other OAuth groups.
Not established by this review
- Server startup, authentication, live tool execution and security isolation were not tested.
- Published package/container parity with a source revision and hosted implementation internals were not tested.
- The resource was not executed and its tools were not called.
- The server was not called. A source review is not a runtime or security certification.
The review applies to the material and revision named here. A newer upstream release can change its behavior.
03 / PUT IT TO WORK
Connect a server deliberately.
DOCUMENTED COMMAND
npx -y @contentstack/mcp --groups cdaCopying does not execute this command. It may retrieve a newer version than the reviewed source.
- Supply CONTENTSTACK_API_KEY and an environment-scoped CONTENTSTACK_DELIVERY_TOKEN privately.
- Set the correct CONTENTSTACK_REGION and launch the shown cda-only group.
- For CMA use a management token or OAuth; other listed services require their own OAuth or token path.
- For headless management use, pass stack API key, management token and an explicit --region or CONTENTSTACK_REGION; use delivery tokens for CDA and a Lytics token for Lytics.
Before you start
- Node.js 18+, npx, a stdio client and Contentstack credentials for the selected group.
Documented configuration example
Use the client and authentication context described in the setup guidance. Configuration formats vary between hosts.
{
"mcpServers": {
"contentstack": {
"command": "npx",
"args": [
"-y",
"@contentstack/mcp",
"--groups",
"cda"
],
"env": {
"CONTENTSTACK_REGION": "NA"
}
}
}
}04 / FOLLOW THE EVIDENCE
The source trail.
Our notes are separate from the original resource.
Check upstream before adopting a new version.
https://www.contentstack.com/docs/developers/contentstack-mcp-server
Supports: summary, install, configExample, access, limitations, bestFor, review, compatibility, transports