My AI assistant edits the content of my website, but it has no administrator account and no access to the database. In LydiaCMS it is an ordinary user with limited permissions, and everything it does is written to the audit log. I can therefore entrust it with routine edits of texts, SEO and translations and still know what has changed.
What can go wrong and what the system does about it
The assistant makes a mistake
Every change is written to the audit log with the old and the new value, and the administration shows it as a diff. I can see who made the change and exactly what changed in the text, and I can revert a bad edit with one click.
A change can be reverted only if the record has not changed since. If it has, the system refuses the revert and lists which fields have changed in the meantime, so newer work is never overwritten. Reverting applies to pages and other content records. I deliberately do not offer it for users and roles.
The assistant wants more than it is allowed to
The MCP server runs under a specific user and every operation goes through the same permission check (ACL) as the administration. The assistant cannot manage users or roles, and nobody can grant more rights than they have themselves. How permissions are inherited down the tree of contexts is described in Architecture.
Malicious code gets into the content
HTML is filtered on saving against a list of allowed tags and attributes (HTMLPurifier). Scripts and disallowed attributes are removed from the content regardless of who sent it.
An unauthorised party calls the server
Tools with permissions require a shared token. If no token is configured, the server lets nobody in. The token is read from the environment only at call time, so it does not end up in the compiled DI container.
How I use it
This is how I edit the content of this website as well: page texts, their SEO properties (slug, title, description), image uploads and translations. The tools are generated from registered endpoints of the administration API and named after them, for example core_pages_update or core_translations_set. Other packages add their own tools, for example management of cities and countries in the location package.
Under the hood: one API, two transports
- Local STDIO in
lydiacms/core. An MCP client startslydiacms:mcpthrough Docker, the CLI or SSH, so no public HTTP endpoint is needed. - Streamable HTTP in
lydiacms/api. The same capabilities can be exposed remotely at/api/mcpand authenticated with a webservice Bearer token. Remote access has to be switched on explicitly.