Strapi MCP Server

The Strapi MCP Server is a Model Context Protocol (MCP) server built directly into Strapi. Once it is enabled, AI assistants such as Claude Code, Cursor, or Codex can work directly with the Content Manager of your Strapi project: list and retrieve entries, create, change, delete, publish, and unpublish them, and manage the media library. Instead of maintaining content by hand in the admin area or writing your own scripts against the REST interface, you describe the task in conversation, for example "Create three drafts for product pages" or "Show all unpublished articles of the last week". Strapi is an open-source headless CMS from Strapi Solutions SAS; the GitHub project strapi/strapi has more than 70,000 stars, is not archived, and was last updated on October 22, 2026. According to the official documentation the MCP server is one of the free features and is available in development and production.

What can the Strapi MCP Server do?

The tools are generated from your content types. For collection types the documentation lists up to eight tools: list with pagination, sorting, and filters, get, create, update, delete, as well as publish, unpublish, and discard_draft where Draft & Publish is enabled. Single types get up to six tools, with create and update merged into write. In addition there are ten tools for the media library: list files and folders, change metadata such as name, alternative text, and caption, move files and folders, create and rename folders, and delete files and folders. Multilingual content is supported through an optional locale parameter, and relations can be maintained with connect, disconnect, and set. During development a log tool is also available that writes messages to the server console.

What is it particularly useful for?

The value lies in everyday editorial and migration work. Whoever has to rework many entries, for example adding missing alternative texts in the media library or creating drafts from a pattern, saves long click paths. Quality checks work well too: the assistant filters for empty fields, summarizes anomalies, and proposes corrections that you review before publishing. For developers the server is handy for building test data or checking how a new content type behaves with real entries. Compared with a general database server it has the advantage of building on Strapi's own permission concepts: the assistant works through the Content Manager and not around its rules.

Setup and configuration

The server runs inside the Strapi process itself. You enable it in config/server.js (or server.ts) with mcp: { enabled: true } and restart Strapi. Optionally you can adjust connectTimeoutMs (default 5000) and requestTimeoutMs (default 60000). The endpoint is /mcp, locally http://localhost:1337/mcp; only POST requests are accepted, and the transport is stateless Streamable HTTP. For authentication you create an admin token in the admin area and send it as a bearer token in the Authorization header. In Claude Code, claude mcp add strapi-mcp --transport http http://localhost:1337/mcp -H "Authorization: Bearer YOUR_ADMIN_TOKEN" is enough. For Cursor you add a server of type streamable-http with URL and header to .cursor/mcp.json; according to the documentation Claude Desktop connects through the mcp-remote bridge.

Security: what to keep in mind

Strapi applies several layers of protection. A tool the token may not use is not offered at all. Input and output schemas contain only fields the token can access, the locale choice is narrowed per action, and every call checks the permissions once more on the specific document. Because each request is checked individually, revoked tokens and changed permissions take effect on the next request. Actions on content appear in the audit logs with origin: mcp; pure read access is not logged. Create a separate token with the lowest possible permissions for every AI client. Be especially careful with the media library: deletions are permanent, there is neither a trash nor an undo, and deleting a folder also removes all subfolders and files. The tools cannot check whether an entry still uses a file; both delete tools do support a trial run with dryRun. Limitations according to the documentation: files cannot be uploaded through MCP, nested relations are not loaded along, and dynamic zones appear in the schemas only as untyped lists.

Costs

According to the documentation the MCP server is a free feature. Strapi offers the Community edition, which according to the pricing page is free with no time limit and released under the MIT license, although parts in the ee/ directory are subject to a separate enterprise license. In addition there are paid plans for self-hosting and cloud, including a Growth plan and custom enterprise terms. Current terms are on Strapi's official pricing page.

Who is the Strapi MCP Server for?

It is worthwhile for teams that already run a Strapi 5 project and want to speed up recurring editorial or maintenance work with an AI assistant. Without a Strapi project it is useless. Start on a development or staging instance with a token that may only read, and extend the permissions only once the queries run reliably.

A running Strapi project (Strapi 5) with the MCP server enabled in config/server.js, an admin token, and an MCP client that supports Streamable HTTP such as Claude Code or Cursor.

With the Strapi MCP Server an AI assistant manages content and media of your Strapi project. This guide leads from activation to the first query.

Step 1: Check the prerequisites

You need a running Strapi 5 project and an MCP client that supports Streamable HTTP, such as Claude Code or Cursor. Start on a development or staging instance, not on the production environment.

Step 2: Enable the server

Add the block mcp: { enabled: true } to config/server.js (or server.ts) and restart Strapi. By default the server is switched off. Optionally adjust connectTimeoutMs and requestTimeoutMs.

Step 3: Create an admin token

In the admin area, create an admin token for exactly this AI client. Grant only the permissions the task needs and start with read access. Tools the token may not use are not offered by the server at all.

Step 4: Register it in the MCP client

In Claude Code the command is claude mcp add strapi-mcp --transport http http://localhost:1337/mcp -H "Authorization: Bearer YOUR_ADMIN_TOKEN". In Cursor you add a server of type streamable-http with URL and header to .cursor/mcp.json. According to the documentation Claude Desktop uses the mcp-remote bridge.

claude mcp add strapi-mcp --transport http http://localhost:1337/mcp -H "Authorization: Bearer YOUR_ADMIN_TOKEN"

Limit the risks

Media deletions are permanent, and deleting a folder also removes everything below it. Use the dryRun trial run for this first. Actions on content appear in the audit logs with origin: mcp.

Step 5: First queries

Start with read tasks, such as "List the ten newest articles" or "Which media have no alternative text?". Test write tasks such as creating drafts in the development instance first.

Admin token from the Strapi admin area as a bearer token in the Authorization header; every request is checked individually.

Matches the permissions of the admin token: read, create, change, delete, and publish entries and manage the media library. Tools that are not allowed are hidden.

The server runs in your own Strapi process. Retrieved entries and media data enter the AI client context and therefore reach the model provider. Actions on content appear in the audit logs with origin: mcp.

Unintended changing, publishing, or deleting of content, permanent deletion of files and folders without a trash, overly broad token permissions, an endpoint reachable without protection, and prompt injection via entry content.