dev.vibecms/vibecms

CMS for AI Agents.

The CMS your agents publish into: Markdown posts, versions, and media over scoped MCP or the REST /api/v1 API - you own every post. Every mutation creates activity, and meaningful post changes create versions.

Features

• Clean hosted blog dashboard
• Public blog pages
• Markdown post editor
• R2 media uploads
• D1 database
• Activity history
• Post version history
• Scoped, reveal-once agent tokens with vc_live_ prefixes
• MCP endpoint for trusted agents
• Polar billing for hosted vibecms Cloud
• SELF_HOSTED=true mode without Polar

Connect an MCP client

vibecms exposes standards-based MCP over Streamable HTTP. Hosted vibecms uses https://app.vibecms.dev; self-hosters use their own API host.

Sign-in is required before MCP discovery or tool use: initialize, tools/list, server/discover, and legacy notifications/initialized all require authentication. OAuth clients such as Claude web, desktop and Code offer Connect or Sign in up front. Requests without a bearer receive HTTP 401 with an OAuth resource-metadata challenge; existing API-key users continue sending their bearer key as before. OAuth metadata, trusted CIMD/public-client registration, the static server card and HTTP agent skill files remain public.

Connect Claude Code with the URL, then open /mcp to sign in and approve access:

claude mcp add --transport http vibecms https://app.vibecms.dev/mcp

For a client using an agent key instead, open Connect in the dashboard, create a scoped token, and copy it once. Send it as a bearer credential:

{
  "mcpServers": {
    "vibecms": {
      "type": "http",
      "url": "https://app.vibecms.dev/mcp",
      "headers": {
        "Authorization": "Bearer vc_..."
      }
    }
  }
}

Install the client-independent safety, writing and SEO skills (every skill in skills/):

npx skills add https://vibecms.dev --skill '*'

Run npx skills update to stay current. Alternatively, use npx vibecms-cli skills get to save every skill to .agents/skills (pass skill names to select a subset, --dir <path> to choose the folder, or --force to overwrite existing files), or let a connected agent call the skills.list and skills.get MCP tools.

Claude Code users on the hosted service can install every skill and the MCP server as one plugin. The plugin connects using the server URL; open /mcp to sign in and approve access through OAuth:

claude plugin marketplace add moinulmoin/vibecms
claude plugin install vibecms@vibecms

Directory listing copy and submission notes live in docs/directory-listings.md.

Verify that the credential can read your site with a protected tool call (tools/list now also requires authentication, but only lists tools allowed by its scopes):

curl https://app.vibecms.dev/mcp \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer vc_..." \
  --data '{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"sites.get","arguments":{}}}'

A valid token returns the current site in structuredContent; an invalid or missing token returns 401. The approval-first publishing flow is:

sites.get -> posts.format_guide -> draft -> posts.preview
  -> latest saved version -> explicit approval
  -> posts.publish(postId, expectedVersionNumber) -> returned URL

Fix error and warn SEO findings before asking for publication approval. posts.preview includes deterministic seo findings. For a saved post, use posts.seo_check({postId, focusKeyword?}) or GET /api/v1/posts/{postId}/seo?focusKeyword=deployment. The 31 rules are plain code and run on every plan: 26 for search engines (metadata, headings, links, content, duplicates, indexing, focus keyword) and 5 for AI answers (a short opening paragraph before the first

... View full README on GitHub