{
  "markdown": "# Total CMS Desktop Extension (MCPB)\n\nA [Claude Desktop extension](https://www.anthropic.com/engineering/desktop-extensions)\nthat connects Claude to any [Total CMS](https://totalcms.co) site's built-in\nMCP server. Install once, and Claude can search docs, browse content, and\n(with an API key) manage your Total CMS site directly.\n\nThis is a **local bridge**, not a hosted connector: it runs as a small Node\nprocess on your machine and proxies MCP traffic to your site's `/mcp`\nendpoint over HTTPS. That's what lets it attach a custom `X-API-Key` header\nfor authenticated access - something Claude Desktop's built-in remote\nconnectors can't do for servers that advertise optional auth.\n\n## Privacy Policy\n\nThis extension does not collect, transmit, or store any data of its own. It\nopens an HTTPS connection directly from your machine to the Total CMS MCP\nendpoint you configure (default: `https://totalcms.co/mcp`, the official\nTotal CMS docs site) and relays MCP protocol messages between Claude Desktop\nand that endpoint. Your optional API key is stored in your OS's secure\ncredential store (via Claude Desktop's `sensitive: true` config handling) and\nis sent only as an `X-API-Key` request header to the site you configured -\nnever logged, never sent anywhere else.\n\nFor the privacy policy of the Total CMS product and totalcms.co itself, see\n**https://totalcms.co/privacy**.\n\n## Setup\n\n### Zero-config: ask about Total CMS itself\n\nJust install the extension. It defaults to `https://totalcms.co/mcp`, the\nofficial Total CMS documentation server, so Claude can immediately answer\nquestions like \"how do I set up webhooks in Total CMS?\" or \"what schema\nfields does Total CMS support?\" with no configuration.\n\n### Connect to your own site\n\n1. In your Total CMS admin, go to **Settings -> MCP** and copy your site's\n   MCP endpoint URL (it will look like `https://yoursite.com/mcp`, or include\n   a subpath if you installed Total CMS in one).\n2. In Claude Desktop's extension settings for Total CMS, paste that URL into\n   **Total CMS MCP endpoint**.\n3. Reinstall/reconnect. Claude can now browse and search your site's public\n   collections.\n\n### Authenticated (admin) access\n\n1. Generate a Total CMS API key for your site (Settings -> API Keys, or your\n   preferred key-issuing flow).\n2. Paste it into the **API key (optional)** field in the extension settings.\n   It's stored in your OS keychain, not in plain text.\n3. Claude now has admin-level access to your site's MCP tools (schema\n   management, templates, site info, cache clearing, etc.) in addition to\n   public content. Leave this field empty to keep Claude limited to public,\n   anonymous access.\n\n## How it works\n\n`server/index.js` is a small stdio MCP server that Claude Desktop spawns\ndirectly (no Node install required - MCPB bundles include their own\nruntime handling). It opens a\n[streamable HTTP](https://modelcontextprotocol.io/specification/2025-06-18/basic/transports)\nconnection to the `MCP_URL` you configured and forwards every JSON-RPC\nmessage in both directions verbatim: `initialize`, `tools/list`,\n`tools/call`, `resources/*`, `prompts/*`, and all notifications. When\n`API_KEY` is set, every outbound HTTP request carries an `X-API-Key` header.\n\nIt refuses to start unless `MCP_URL` is `https://` - plaintext credentials on\nthe wire are not acceptable, even for local testing.\n\n### Why not `mcp-remote`?\n\nWe spiked it first (see `BUILD-REPORT.md` for the full writeup). Short\nversion: `mcp-remote` unconditionally runs OAuth discovery on startup and,\non any HTTP 401 response, launches a browser-based OAuth authorization flow\nwith no flag to disable it. Total CMS uses a plain API-key header, not OAuth\n- a bad key needs to surface as a clean 401 error to the MCP client, not\nhang behind a browser popup trying to OAuth against a server that doesn't\nimplement it. So this bundle ships a small hand-rolled proxy built directly\non `@modelcontextprotocol/sdk`'s `StreamableHTTPClientTransport` and\n`StdioServerTransport` instead.\n\n## Development\n\n```bash\nnpm install\nnpm run build     # typecheck -> esbuild bundle -> mcpb validate -> mcpb pack\n```\n\nProduces `dist/totalcms.mcpb`. Install by dragging that file onto Claude\nDesktop.\n\n`npm run typecheck` and `npm run validate` are available standalone.\n\n## Releasing\n\n```bash\nnpm run bump 0.3.0                  # rewrites the version in all four files\n# add a \"## [0.3.0] - YYYY-MM-DD\" section to CHANGELOG.md\ngit commit -am \"Release v0.3.0\"\ngit tag v0.3.0 && git push origin master v0.3.0\n```\n\nPushing the tag is the whole release. The `Release` workflow builds the\nbundle, attaches it to a GitHub release, and publishes the new version to the\n[MCP Registry](https://registry.modelcontextprotocol.io) as\n`io.github.totalcms/total-cms`.\n\nThe GitHub release notes are the matching `CHANGELOG.md` section, so that\nfile is where a release gets described — write it before tagging. A missing\nsection warns and falls back to generated notes rather than failing the build;\na release should never be blocked because its prose was not written.\n\nTwo more things worth knowing:\n\n- **The registry is a separate system from GitHub Releases.** People who\n  installed from the MCP directory get updates from the registry, not from\n  the release page — publishing one without the other leaves them stranded on\n  the old version. That is why the workflow does both, and why it is worth\n  never publishing a release by hand.\n- **`fileSha256` in `server.json` is stamped by CI**, because a zip embeds\n  timestamps and a CI build never hashes identically to a local one. The value\n  committed to git is only a record of the last local build; ignore it.\n\nAuthentication to the registry is GitHub OIDC, so there is no secret to\nrotate. To re-publish a tag that already exists — or one released before this\nworkflow existed — run the `Release` workflow manually from the Actions tab\nand give it the tag.\n\n## Security notes\n\n- Zero filesystem access, zero subprocess spawns, outbound HTTPS to exactly\n  one host (whatever `MCP_URL` points at).\n- The API key is read from the `API_KEY` environment variable (set by Claude\n  Desktop from your keychain-stored config) and is never written to stdout,\n  stderr, or any log.\n- `MCP_URL` must be `https://` or the process refuses to start.\n\n## License\n\nSource code is [MIT licensed](LICENSE). The Total CMS name, flame logo, and\nthe bundled `icon.png` are trademarks and are not covered by that grant — you\nmay fork the code, but a redistributed version must not present itself as\npublished or endorsed by Total CMS.\n",
  "bytes": 6566,
  "sha": "b41048aa9bccc44654e57b2589121785ec86ba6d2026e95501d40dc1047b3543",
  "repo_slug": "totalcms/mcpb",
  "fonte": "repo",
  "truncated": false,
  "api": "https://agentalog.com/api/listings/mcp_io_github_totalcms_total_cms_3f2ee070/readme"
}