--- title: "Contentstack MCP: review, setup & limitations · Undominated.ai" canonical: https://undominated.ai/mcp-servers/contentstack/ description: "Expose selected Contentstack API groups to a local stdio client with service-specific credentials." --- # Contentstack MCP: review, setup & limitations · Undominated.ai > Expose selected Contentstack API groups to a local stdio client with service-specific credentials. [← Explore all mcp servers](/mcp-servers/) CONTENT MANAGEMENT / Contentstack # Contentstack MCP Expose selected Contentstack API groups to a local stdio client with service-specific credentials. [See setup guidance ↓](#setup)[Original source ↗](https://www.contentstack.com/docs/developers/contentstack-mcp-server) SOURCE REVIEW Reviewed 2026-10-14 Evidence 1 linked sources Publisher Contentstack Licence Not established [Read what was—and wasn’t—checked ↓](#review) “Contentstack MCP Server” [Contentstack · upstream description ↗](https://www.contentstack.com/docs/developers/contentstack-mcp-server) Our analysis follows below. 01 / THE REASONING ## Why this made the selection. - Separates published-content delivery from write-capable management groups. - Documents region selection and OAuth versus static-token requirements. - Contentstack’s page separates OAuth from management tokens and delivery tokens, and it says the content delivery API does not support OAuth or management-token authentication. - A delivery-token-only setup does not require OAuth, and without an OAuth session the client must set the region explicitly. ### A good fit for - Read published entries from one delivery environment. - Review content-management audit history using separately authorized CMA tooling. - Reading published content with a delivery token, or managing content with OAuth or a CMA management token - Not for calling Analytics, Automations, or the other listed services with only a management token ### Weigh up before choosing - Default group cma is write-capable; the shown cda-only profile cannot see drafts. - OAuth tokens are saved locally; token-only setups need an explicit region rather than relying on a saved OAuth session. - The docs contain inconsistent enrichment-variable spellings; this example does not depend on that option. - Management token authentication is supported only for CMA and CMA Extended. The page names other services that still require OAuth. - The CDA does not support OAuth or management token authentication. - No licence was stated on this page, and none was inferred. - This review did not execute the resource. - The server was not called. - No saved OAuth session exists to infer the region in management-token mode, and one token type does not cover every service group. 02 / THE REVIEW RECORD ## What we actually inspected. Source review has boundaries. A clear record is more useful than a “safe” badge. ### Material inspected - https://www.contentstack.com/docs/developers/contentstack-mcp-server - Round 2 reread of acquired publisher setup and permission evidence; see immutable wave review. ### Our findings - A delivery token cannot authenticate CMA; a management token is not interchangeable with CDA authentication. - GROUPS/--groups changes the exposed surface without changing credential permissions. - The page says management-token authentication is supported only for CMA and CMA Extended. Analytics, Automations, BrandKit, Launch, DeveloperHub, and Personalize still require OAuth. - The content delivery API does not support OAuth or a management token. It uses a delivery token, and that delivery-token setup does not require OAuth. - Without an OAuth session, a delivery-token or management-token configuration cannot infer the region. The page says the region must be set explicitly. - Management tokens can authenticate CMA and CMA Extended without OAuth, but do not authenticate Analytics, Automations, Launch or other OAuth groups. ### Not established by this review - Server startup, authentication, live tool execution and security isolation were not tested. - Published package/container parity with a source revision and hosted implementation internals were not tested. - The resource was not executed and its tools were not called. - The server was not called. A source review is not a runtime or security certification. The review applies to the material and revision named here. A newer upstream release can change its behavior. 03 / PUT IT TO WORK ## Connect a server deliberately. [Upstream setup instructions ↗](https://www.contentstack.com/docs/developers/contentstack-mcp-server) DOCUMENTED COMMAND npx -y @contentstack/mcp --groups cda Copy command ↗ Copying does not execute this command. It may retrieve a newer version than the reviewed source. - Supply CONTENTSTACK_API_KEY and an environment-scoped CONTENTSTACK_DELIVERY_TOKEN privately. - Set the correct CONTENTSTACK_REGION and launch the shown cda-only group. - For CMA use a management token or OAuth; other listed services require their own OAuth or token path. - For headless management use, pass stack API key, management token and an explicit --region or CONTENTSTACK_REGION; use delivery tokens for CDA and a Lytics token for Lytics. ### Before you start - Node.js 18+, npx, a stdio client and Contentstack credentials for the selected group. ### Documented configuration example Use the client and authentication context described in the setup guidance. Configuration formats vary between hosts. { "mcpServers": { "contentstack": { "command": "npx", "args": [ "-y", "@contentstack/mcp", "--groups", "cda" ], "env": { "CONTENTSTACK_REGION": "NA" } } } } Copy configuration ↗ ### Compatibility Node.js 18+, npx, a stdio client and Contentstack credentials for the selected group. ### Transports stdio ### Content management - CDA retrieves published content. CMA and additional groups can publish, delete, trigger workflows or deploy when enabled. ### Cost model Contentstack service/plan limits and any enabled downstream service usage apply. 04 / FOLLOW THE EVIDENCE ## The source trail. Our notes are separate from the original resource. Check upstream before adopting a new version. - [Publisher setup, capabilities and operating boundaries ↗](https://www.contentstack.com/docs/developers/contentstack-mcp-server) Checked 2026-10-14 https://www.contentstack.com/docs/developers/contentstack-mcp-server Supports: summary, install, configExample, access, limitations, bestFor, review, compatibility, transports KEEP COMPARING ## Other approaches to consider. Related by category or shared topics. These are alternatives to inspect, not a measured quality order. [### Sanity hosted MCP ↗ Query schemas and content, stage document changes and publish through Sanity-hosted MCP using an authenticated account.](/mcp-servers/sanity/)[### Contentful MCP ↗ Read and manage Contentful entries, assets, content types and environments through its local MCP server.](/mcp-servers/contentful/)[### Sanity Hosted MCP Server ↗ Hosted Sanity endpoint where an assistant runs GROQ queries, patches documents, manages releases and explores schema with OAuth or token auth.](/mcp-servers/sanity-hosted/) [AI Tools ↗](/tools/)[Skills ↗](/skills/)[Agents ↗](/agents/)[MCP Servers ↗](/mcp-servers/)[Workflows ↗](/workflows/) ## Continue your investigation - [Inspect resource evidence](/tools/) - [Choose a host](/agents/) - [Inspect reusable workflows](/skills/) - [Use Undominated data](/api/)