Contentful MCP Server: Tools, and the CMA Token It Needs
Yes — Contentful maintains an official MCP server, and it comes in two flavors. There’s a remote, hosted one at https://mcp.contentful.com/mcp that authenticates through OAuth, and a local open-source one you run yourself with npx -y @contentful/mcp-server. Both expose the same core toolset. Contentful’s docs describe it as tools that AI agents can use to “read and write content, manage content models, work with assets, invoke AI Actions, and more, across your Contentful spaces and environments.”
The single thing people get wrong: this server runs on the Content Management API, not the Delivery API. If you paste a CDA key or a Preview key into it, nothing works and the error won’t say why. More on that below, along with the tool list, the real limits, and what to do when you want Contentful work that happens without you asking.
Contentful is one of many — the complete list of MCP servers covers every app that ships one, grouped by category.
CMA, not CDA or CPA — the token that trips everyone up
Contentful has three separate APIs with three separate key types, and they are not interchangeable:
- CDA (Content Delivery API) — read-only, published content only. This is the key in your website’s front end. The MCP server will not accept it.
- CPA (Content Preview API) — read-only, includes drafts. Also useless here.
- CMA (Content Management API) — read and write, everything: entries, drafts, content types, assets, environments. This is the one the MCP server needs.
For the local server, that means a Contentful Management API personal access token supplied as the CONTENTFUL_MANAGEMENT_ACCESS_TOKEN environment variable. You generate it in Contentful under your account settings’ API tokens section — a personal access token, not a space API key, which is a different screen entirely and the reason a lot of people end up with the wrong string.
The practical consequence worth pausing on: a CMA token is a full read/write credential across everything that token’s user can reach. Handing it to an AI client is not the same as handing over a read-only site key. Scope it deliberately.
The remote server sidesteps the token question — it uses an OAuth 2.1 flow, so you sign in to Contentful through the client and access is gated by your normal Contentful permissions. That’s the safer default for most people, and it’s the reason to start there unless you specifically need local control.
What the Contentful MCP server actually exposes
Contentful documents the tools by category, and the list is unusually complete for a first-party server:
- Entries —
search_entries,semantic_search,get_entry,create_entry,update_entry,publish_entry,unpublish_entry,archive_entry,delete_entry, plusget_entry_snapshotfor version history andresolve_entry_referencesfor walking linked entries. The semantic search tool is the interesting one: it means you can ask for entries by meaning rather than by exact field match. - Assets —
upload_asset,create_upload_session,list_assets,get_asset,update_asset,publish_asset,archive_asset,delete_asset. Uploads are two-phase: you stage the bytes, then bind them to an asset. Contentful notes that upload sessions “expire one hour after creation and are single-use.” - Content types —
list_content_types,create_content_type,update_content_type,publish_content_type, and field-level operations includingdelete_content_type_field,disable_content_type_field, andomit_content_type_field. This is real content-model surgery, which is worth respecting. - Spaces and environments —
list_spaces,get_space,list_environments,create_environment,delete_environment. - Locales and tags — full CRUD on locales, plus
list_tagsandcreate_tag. - AI Actions —
create_ai_action,invoke_ai_action,list_ai_actions,publish_ai_actionand the rest, so an agent can call the AI Actions you’ve already configured in Contentful. - Taxonomy and editor interfaces — concepts and concept schemes, plus
get_editor_interfaceandupdate_editor_interface.
There’s also a get_initial_context tool, which the server uses to orient the client before it starts calling anything else.
Two documented gaps to know going in: environment aliases are not currently supported, and the local server has a protected-environments setting where you list environment IDs that write and delete operations are blocked against. Use that second one. Pointing a content-model editing tool at master with no guardrail is how a Tuesday goes wrong.
Setting it up
The remote server is the fast path — add https://mcp.contentful.com/mcp as a remote MCP server in your client’s connector settings and complete the OAuth sign-in. Note that Contentful currently labels the hosted server beta, so treat it accordingly.
For the local server, the config is standard MCP JSON:
{
"mcpServers": {
"contentful": {
"command": "npx",
"args": ["-y", "@contentful/mcp-server"],
"env": {
"CONTENTFUL_MANAGEMENT_ACCESS_TOKEN": "your-CMA-token",
"SPACE_ID": "your-space-id",
"ENVIRONMENT_ID": "master",
"CONTENTFUL_HOST": "api.contentful.com"
}
}
}
}SPACE_ID and ENVIRONMENT_ID set defaults; the space and environment tools let an agent move beyond them. The source is MIT-licensed on GitHub as contentful/contentful-mcp-server, so you can read exactly what each tool does before you trust it with a content type. If you’re wiring this into ChatGPT specifically rather than Claude or Cursor, the setup path differs — connecting MCP servers to ChatGPT covers that side.
Contentful has webhooks. The MCP server doesn’t listen to them.
This is where the honest version differs from the usual “MCP can’t do events” line, because Contentful’s event story is genuinely good. Contentful fires webhooks on Entry.publish, Asset.publish, save and auto-save, plus unpublish and delete events that arrive as tombstone payloads. You can filter by environment ID, by entity ID, or by content type ID, and webhook transformations let you rewrite the method, headers, and body before it goes out. There’s a 30-second timeout and up to three delivery attempts, with an X-Contentful-Idempotency-Key header for deduplication.
So the events exist and they’re well-built. The gap is that the MCP server has no relationship with them. It is a request/response interface: your AI client calls a tool, the server calls the CMA, an answer comes back. Nothing in that loop is subscribed to Entry.publish.
MCP has no trigger mechanism and no scheduler. Its own Triggers and Events working group opens by conceding that clients learn about server-side changes by polling, and that work is still listed as on the horizon rather than shipped.
That’s a protocol-level fact, not a Contentful shortcoming. Which means if you want “when this entry publishes, do that” — the thing Contentful’s webhooks are perfectly capable of announcing — you need something on the other end of the webhook that is actually listening. An MCP server isn’t it.
The other structural limit: the Contentful MCP knows Contentful. A publish event that should also update a Jira ticket, post to Slack, and refresh a cache means a separate MCP server per app, each separately authed, and a client juggling all of them in one turn.
Running Contentful work that doesn’t need a chat open
That’s the gap Carly fills. Carly connects to Contentful natively — no server to host, no CMA token to store in a config file — along with the ~260 other apps it supports and anything with a public API via your own key. The difference from MCP is the one that matters here: Carly’s workflows are triggered and scheduled, so they’re on the receiving end of the events Contentful is already emitting.
- When an entry publishes → post it to the
#contentSlack channel, mark the Jira ticket done, and draft the social copy for review. - When a draft sits unpublished for 10 days → nudge the assigned editor with the entry title and link.
- Every Monday → audit entries missing SEO fields or alt text and send the content lead a list.
The non-AI steps — the routing, matching, and moving between apps — are free and unlimited, the Zapier-style backbone. The AI steps, like drafting and summarizing, start at $35/month. You describe the outcome in plain language rather than writing tool calls.
If you want to interrogate a space from a chat window or do bulk content-model work by hand, Contentful’s official MCP server is the right tool and it is a genuinely strong one. If you want Contentful to react, the webhooks are already firing — they just need something awake to catch them.
FAQ
Does Contentful have an official MCP server?
Yes. Contentful maintains both a remote hosted server at https://mcp.contentful.com/mcp, currently in beta, and a local open-source server published as @contentful/mcp-server on npm under an MIT license. Both expose the same core toolset across entries, assets, content types, spaces, environments, locales, tags, and AI Actions.
Which Contentful token does the MCP server need — CDA, CPA, or CMA?
The Content Management API. The local server requires a CMA personal access token in the CONTENTFUL_MANAGEMENT_ACCESS_TOKEN environment variable. A Content Delivery API key or Content Preview API key will not work, because both are read-only and the server performs writes. The remote server uses OAuth instead of a pasted token.
Can the Contentful MCP server react to a publish event?
No. Contentful’s webhooks fire on Entry.publish, Asset.publish, save, unpublish, and delete, but the MCP server is not subscribed to any of them — it only responds when an AI client calls a tool. To act on a Contentful event you need a workflow tool listening on the other end of the webhook, such as Carly.
Can I connect Contentful to AI without running a server or handling a CMA token? Yes. Carly connects to Contentful directly and lets you describe the automation in plain language, so there’s no MCP server to host, no npx process to keep alive, and no management token sitting in a local config file.
Ready to automate your busywork?
Carly schedules, researches, and briefs you—so you can focus on what matters.
See what people say
"Before Carly, I relied on a Calendly link, but the whole process felt impersonal and not very professional. Carly changed that by handling all the back-and-forth, so I'm no longer stuck in endless email threads trying to line up schedules.
Now Carly reaches out to candidates, shares my real-time availability, lets them pick a slot, then sends a Zoom link and drops it straight into my calendar. She sends reminders to both of us before each call, which has significantly reduced no-shows and last-minute confusion.
On top of scheduling, Carly acts like a full executive assistant, sending me my schedule the night before so I can prepare for each call. It reminds me of the old x.ai assistant, but Carly is noticeably smarter, faster, and better suited to my healthcare recruitment business."
