Start Free Trial

The CMS your coding agent already knows how to use.

⏺ totalcms · built-in MCP server

⎿ your schemas, your content, this install’s docs

MCP is the standard plug that lets AI agents use real tools. Total CMS ships one, and your client edits only what you allow — by hand in the admin, or through their own agent.

Start Free Trial See the hand-off 45 days, every Pro feature, no credit card.

Claude Code Builds a Website — Total CMS MCP Server Demo — The recorded session: Claude Code builds a site through the Total CMS MCP server.

The hand-off

Two agents, one set of guardrails.

The hand-off the demo video records, step by step. You build with your agent, your client works with theirs, and neither gets further than you allowed.

Illustrative session · real tool names and error text · scroll to play it · tap a step

Your agent builds the structure.

Working as you, with an API key, it creates a testimonial schema and a collection to hold it, open to your client’s signed-in agent. Four typed fields, each with the help text your client will see in the admin.
Your client’s agent fills it in.

The client signs their own assistant in through OAuth as an Editor. It adds Maria’s quote to the collection you built. The photo waits for the admin: agents don’t upload images.
Then it’s asked to touch the design.

The Editor group can’t update site pages, so the call is refused before anything runs. The agent gets exactly what the client’s account allows, and not one collection more.
What it wrote is a file you own.

A plain file in tcms-data on your own server — JSON by default, or Markdown with YAML front matter if you prefer. Open it, copy it, back it up. There is nothing to export, and no vendor between you and your content.

two agents · one site your agent · API key (admin) client’s agent · OAuth (Editor) client’s agent · OAuth (Editor) you · ssh mysite

> Add testimonials the client can manage herself

⏺ totalcms · create_schema

id: "testimonial"
properties: author · quote · photo · company

⎿ schema testimonial saved

⏺ totalcms · create_collection

id: "testimonials", schema: "testimonial"
mcp: { access: "authenticated" }

⎿ collection testimonials saved

> Add the quote from Maria’s email to the site

⏺ totalcms · create_object

collection: "testimonials"

{
  "id": "maria-lopez",
  "author": "Maria Lopez",
  "quote": "<p>I can finally update the site myself.</p>",
  "company": "Lopez Bakery"
}

Added. The photo field takes an upload, so that one’s yours to add in the admin.

> While you’re in there, swap the homepage hero for a video

⏺ totalcms · patch_object

collection: "builder-pages", id: "home"

Error: Your account’s groups do not grant update on ‘builder-pages’.

I can’t change the homepage. Your Editor access covers content like testimonials, not site pages — that one’s for your designer.

$ ls tcms-data/testimonials/

maria-lopez.json

$ cat tcms-data/testimonials/maria-lopez.json

{
  "id": "maria-lopez",
  "author": "Maria Lopez",
  "quote": "<p>I can finally update the site myself.</p>",
  "company": "Lopez Bakery"
}

One file on your server. Copy it, back it up, open it in any editor.

collections / testimonials / maria-lopez

Authortext Maria Lopez

Quotestyledtext I can finally update the site myself.

Photoimage Drop an image

Companytext Lopez Bakery

Saved maria-lopez.json

An illustrative session: the tool names, arguments and error message are the real ones from Total CMS. Maria and the bakery are made up.

“This isn't just a website builder, but the infrastructure of a web app builder… or even, a mini-platform builder.”

Matthew TurcoGenius By Design

4,500+: licensed sites
2015: first shipped
MCP built in: in Standard and Pro, not a plugin you install and keep patched

Guardrails

Agents get the same permissions as people.

Letting an agent into a site is a decision you make where you make every other permission decision. Access groups govern agents exactly as they govern people — the same system, not a parallel one bolted on.

Nothing exposed by default: Collections default to admin-only over MCP, and a field can be hidden from agents entirely. A public agent sees what you deliberately published.
Same limits, with or without an agent: Your client editing by hand in the admin gets exactly the limits their agent gets. An agent authorised by an editor sees and writes what that editor can, and nothing further.
The same save path as the admin: An agent’s write goes through the same save as the admin form: every field is built from your schema’s types and processed the same way.

The technical detail: personas, OAuth and tokens

Three personas. Anonymous public read, API-key admin, and per-user OAuth 2.1 with scopes. A caller is resolved to exactly one of them before a single tool runs.

A real OAuth server. PKCE, refresh tokens, a consent screen, revocation and an audit log — not an API key wearing an OAuth costume.

Bearer tokens. A token gets the checks a signed-in user gets, resolved against that user’s access groups on every call.

Permission Matrix Editor

Collection	Create	Read	Update	Delete
blog	Allowed	Allowed	Allowed	Allowed
testimonials	Allowed	Allowed	Allowed	Allowed
gallery	Allowed	Allowed	Allowed	Allowed
builder-pages	Not allowed	Allowed	Not allowed	Not allowed

Illustrative. One screen shows what each group can reach; the refusal in the session above is this row’s Update cell.

Version-matched docs

It reads your install, not its training data.

An agent working on a Total CMS site gets that install’s documentation — real field names, real Twig signatures, real schema definitions. Not documentation from two years ago, and not an invented API.

Signatures it can’t invent: The reference ships with each release and is built from that release’s own code, so what the agent reads is what your version actually exposes.
Your schemas, not a guess: An agent asks the site for its collections and fields and gets the real definitions back, including custom schemas that exist nowhere but your install.
Ships enabled: The documentation tools are a bundled extension turned on by default. There is no separate docs server to run and nothing to keep in sync.

Try it now

It’s already live. Connect to it.

The Total CMS documentation is served over MCP by Total CMS itself. Paste the config into your MCP client and ask it anything about Total CMS — no install, no signup.

This connects to our documentation, not to a site of yours. To connect your own, point the same client at yoursite.com/mcp; the connection guide covers both.

MCP client config

{
  "mcpServers": {
    "totalcms": {
      "url": "https://totalcms.co/mcp"
    }
  }
}

Claude Code

claude mcp add --transport http totalcms https://totalcms.co/mcp

Or one click: Claude Desktop Cursor VS Code

Pricing

What it doesn’t do, and what it costs.

Standard’s MCP is public and read-only: Standard gets anonymous read access to content you have published publicly. OAuth, API keys and agent writes are Pro, so on Standard no remote agent can reach a private client site.
PHP 8.2+, your own server: There is no hosted tier to sign up for. You run it, which is the point, but it does mean you need somewhere to run it.
Flat files have a ceiling: Excellent to a point and honest past it: this is not the right store for millions of records. Filtering large collections is done in memory.
Others have MCP through plugins: Craft, Statamic and Kirby each have a capable community-built MCP server; none ships one of its own. In Total CMS it is part of the product: same release cycle, same licence, same access groups. Accurate as of September 2026.

Standard

$195

One-time · per domain

The full CMS your clients edit
Public MCP, read-only
Agents answer questions about your public content

Buy Standard

For agent work

Pro

$395

One-time · per domain

API keys and OAuth 2.1
Private content and agent writes
Everything the hand-off shows: build, edit, refuse

Buy Pro

Start Free Trial

45 days with every Pro feature, no credit card. Both licenses are one-time, per domain, with two years of updates; the software keeps running after that. Compare every feature

Agents on your pages, too. Experimental

AI is moving into the browser itself. The WebMCP extension hands the agent in a visitor’s browser real tools instead of making it scrape your HTML.

Forms an agent can call: One Twig call renders a form an agent can fill and submit. It saves exactly the way a person’s submit does: the same validation, the same schema checks, the same form actions afterwards.
The visitor’s own permissions: Reads run as whoever is at the keyboard, always read-only, and another site can’t borrow the session.
Experimental, and says so: Off by default. It needs Chrome’s WebMCP origin trial and tracks a spec that’s still moving. Browsers without it just get a normal page.

Hand the agent the keys you choose.

Install it on any PHP host, connect your agent, and decide what your client’s agent can touch. 45 days, every Pro feature, no credit card.

Start Free Trial

$ composer create-project totalcms/totalcms

Using Claude Code? Run tcms skill:install and your agent picks up the Total CMS conventions, the CLI and the way schemas are meant to be written.