CONTENT MANAGEMENT / Sanity
Sanity hosted MCP
Query schemas and content, stage document changes and publish through Sanity-hosted MCP using an authenticated account.
“Sanity MCP server”
01 / THE REASONING
Why this made the selection.
- Connects content operations with deployed schemas and explicit draft/publish tools.
- Documents release-version and asynchronous asset workflows.
- Sanity documents a remote MCP server at https://mcp.sanity.io that uses OAuth by default and can instead take an API token in a header.
- With that header, the page says the server will not use OAuth, and tool calls stay inside the token’s role and permissions.
02 / THE REVIEW RECORD
What we actually inspected.
Source review has boundaries.
A clear record is more useful than a “safe” badge.
Material inspected
- https://www.sanity.io/docs/ai/mcp-server
- Round 2 reread of acquired publisher setup and permission evidence; see immutable wave review.
Our findings
- The publisher distinguishes draft changes, release versions and explicit publishing.
- OAuth and CLI-generated token setup are separate authentication paths.
- The Sanity page documents the remote server at https://mcp.sanity.io and says it uses OAuth by default to act on the user’s behalf.
- If an API token is placed in the Authorization header, the server will not use OAuth, and tool calls use that token’s role and permissions.
- A client that does not support remote MCP servers is not given a native connection. The page says a proxy may be an option.
- Asset uploads are asynchronous; the status tool returns a polling interval, and a lookup error does not establish that the upload failed.
Not established by this review
- Server startup, authentication, live tool execution and security isolation were not tested.
- Published package/container parity with a source revision and hosted implementation internals were not tested.
- The resource was not executed and its tools were not called.
- The server was not called. A source review is not a runtime or security certification.
The review applies to the material and revision named here. A newer upstream release can change its behavior.
03 / PUT IT TO WORK
Connect a server deliberately.
- Add the HTTP endpoint and complete OAuth with the intended Sanity account.
- Confirm project, dataset and deployed schema before querying or editing.
- Create the release version before patching a release; review drafts before invoking publishing tools.
- Retain operationIds, honor pollAfterMs and Retry-After, and inspect the destination before repeating an upload whose outcome is unknown.
Before you start
- A Sanity account with the needed project/dataset permissions and a remote MCP client.
Documented configuration example
Use the client and authentication context described in the setup guidance. Configuration formats vary between hosts.
{
"mcpServers": {
"sanity": {
"type": "http",
"url": "https://mcp.sanity.io"
}
}
}04 / FOLLOW THE EVIDENCE
The source trail.
Our notes are separate from the original resource.
Check upstream before adopting a new version.
https://www.sanity.io/docs/ai/mcp-server
Supports: summary, install, configExample, access, limitations, bestFor, review, compatibility, transports