Total CMS Docs

co.totalcms/docstotalcms.costreamable-httpv1.0.0Scanned 53 minutes ago

Read-only Total CMS docs: Twig signatures, field types, schema options, the CLI and the REST API.

20 tools: 2 change things and 18 only read.

Reads private data · 4
Reads text others write · 1
Can send data out · 1
1 finding

Anlyon alternative

2 of these tools change something. Run those as governed actions.

Declare what an action changes, and Anlyon puts it under a shared limit, binds every approval to the exact request, and grades the outcome. It works on any HTTPS API you can describe as an action.

Anlyon does not run, proxy or govern this MCP server. A tool your own code calls directly is not routed through Anlyon and is not governed by it.

Import an OpenAPI spec →

Tools

Grouped by what each tool does, most consequential first. Open one for its reasons and full description; descriptions are the publisher's own words.

20 tools

Changes things 2Creates or changes something that can be changed back.Claude Code: ask

latest_releaseThe most recent Total CMS release: version, title, date and the release summary.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Description, as the server wrote it
The most recent Total CMS release: version, title, date and the release summary. Returns: paginated releases objects with url per item.
Annotations the server declares
- title: Latest Release
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
needs_reviewComparison pages ordered by how long ago their competitor facts were last verified, oldest first.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Description, as the server wrote it
Comparison pages ordered by how long ago their competitor facts were last verified, oldest first. Pass `before` (ISO date) to return only pages last verified before that date. Each page shows its verification date publicly, so keeping these fresh matters. Parameters: - before (string, optional): Only pages whose reviewed date is on or before this ISO date (optional). Returns: paginated comparisons objects with url per item.
Annotations the server declares
- title: Needs Review
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false

Only reads 18Looks things up and changes nothing.Show 18 read-only tools

describe_collectionDescribe one collection in detail.No findings
Why it is in this group
- The name "describe_collection" says "describe": a word for reading.
Description, as the server wrote it
Describe one collection in detail. Returns the collection metadata plus a properties array — each entry is a property with its type, description, and indexed/filterable/sortable flags. Call list_collections first to find a collection id, then describe_collection to see what is queryable inside it. `indexed: true` means the property appears in query_collection / search_collection results (and may be filterable/sortable). `indexed: false` means the property exists on objects but is not returned by query/search — retrieve it through get_object instead.
Annotations the server declares
- title: Describe Collection
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
describe_viewDescribe one data view in detail.No findings
Why it is in this group
- The name "describe_view" says "describe": a word for reading.
Description, as the server wrote it
Describe one data view in detail. Returns metadata (id, name, description, last_built, access, total_items) plus output_shape — the list of keys present on the first cached item, sampled so agents can compose effective query_view / get_view calls. Admin callers also receive the view's Twig definition for dev visibility. Use list_views to discover view ids first.
Annotations the server declares
- title: Describe Data View
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
docs_getFetch a full Total CMS documentation page as markdown by its path (as returned by docs_search), e.g.Reads private dataNo findings
Why it is in this group
- The name "docs_get" says "get": a word for reading.
What it can reach
- private-dataThe name "docs_get" says "get" and "doc": it reads documents.
- private-dataThe description's first sentence says "fetch" and "doc": it reads documents.
Description, as the server wrote it
Fetch a full Total CMS documentation page as markdown by its path (as returned by docs_search), e.g. "twig/data" or "site-builder/overview".
Annotations the server declares
- title: Get Documentation Page
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
docs_lookupLook up a specific Total CMS reference entry: Twig functions/filters, field types, REST API endpoints, schema configuration keys, CLI commands, extension API, or builder API.Reads private dataNo findings
Why it is in this group
- The name "docs_lookup" says "lookup": a word for reading.
What it can reach
- private-dataThe name "docs_lookup" says "lookup" and "doc": it reads documents.
Description, as the server wrote it
Look up a specific Total CMS reference entry: Twig functions/filters, field types, REST API endpoints, schema configuration keys, CLI commands, extension API, or builder API. Omit `name` to list all entries of a kind.
Annotations the server declares
- title: Look Up Reference Entry
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
docs_searchSearch the Total CMS documentation.Reads private dataNo findings
Why it is in this group
- The name "docs_search" says "search": a word for reading.
What it can reach
- private-dataThe name "docs_search" says "search" and "doc": it reads documents.
Description, as the server wrote it
Search the Total CMS documentation. Returns matching pages with their path, title, group, and section headings. Use docs_get with a returned path to read the full page.
Annotations the server declares
- title: Search Total CMS Docs
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
fetchFetch the full document for a search result id.Reads private dataNo findings
Why it is in this group
- The name "fetch" says "fetch": a word for reading.
What it can reach
- private-dataThe description's first sentence says "fetch" and "document": it reads documents.
Description, as the server wrote it
Fetch the full document for a search result id. Returns {id, title, text, url, metadata}; `text` is the readable body for citation. Pass an id returned by the `search` tool.
Annotations the server declares
- title: Fetch
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
find_comparisonFind the head-to-head comparison page for a competitor by name (case-insensitive partial match).No findings
Why it is in this group
- The name "find_comparison" says "find": a word for reading.
Description, as the server wrote it
Find the head-to-head comparison page for a competitor by name (case-insensitive partial match). Returns the full page content including the feature table. Parameters: - competitor (string, required): Competitor name, e.g. "Kirby" or "Craft". Returns: paginated comparisons objects with url per item.
Annotations the server declares
- title: Find Comparison
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
get_objectFetch a single object by its id from a collection.No findings
Why it is in this group
- The name "get_object" says "get": a word for reading.
Description, as the server wrote it
Fetch a single object by its id from a collection. Returns the full object as a flat map of fields, decorated with a `url` field where the collection has a public URL pattern configured. This tool does not search or filter — use query_collection for paginated lists or search_collection for free-text search. Available collections and filterable properties: - articles — id (id, sortable), title (text), author (select), summary (textarea), date (date, sortable), draft (toggle), updated (datetime, sortable) - comparisons — competitor (text), competitorUrl (url), heading (text), lede (textarea), reviewed (date, sortable), draft (toggle), sort (number, sortable), id (id, sortable) - extension — id (id, sortable), name (text), extensionId (text), soldAs (text), summary (textarea), category (select), price (number, sortable), currency (select), minEdition (select), minVersion (text), bundled (toggle), beta (toggle), docsUrl (url), productUrl (url), draft (toggle), owner (select), featured (toggle), approved (datetime, sortable), submitted (datetime, sortable), weight (range, sortable) - releases — id (id, sortable), version (text), title (text), date (date, sortable), draft (toggle), urgent (toggle), fullnotesurl (url), announce (toggle) - roundups — heading (text), lede (textarea), reviewed (date, sortable), draft (toggle), sort (number, sortable), id (id, sortable) - showcase — name (text), url (url), industry (select), id (id, sortable), owner (select), draft (toggle), featured (toggle), approved (datetime, sortable), submitted (datetime, sortable), weight (range, sortable)
Annotations the server declares
- title: Get Object
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
get_resourceResolve a tcms:// resource URI to its underlying object.Reads text others writeCan send data outNo findings
Why it is in this group
- The name "get_resource" says "get": a word for reading.
What it can reach
- untrusted-inputThe description's first sentence says "resolve" and "uri": it reads web pages, which anyone can write.
- untrusted-inputThe input takes a URL (input.uri), and the tool reads it: it reads web pages, which anyone can write.
- outboundThe input takes a URL (input.uri): a request to a URL can carry data to whoever runs it.
Claude Code: ask, because it is tagged outbound.
Description, as the server wrote it
Resolve a tcms:// resource URI to its underlying object. Format: tcms://{collection}/{id} — e.g. tcms://blog/hello-world. Equivalent to calling get_object with the parsed collection and id; returns the same shape. Use this when a URI has been surfaced to you (in other tool output, in user input, etc.); use get_object directly when you have a separate collection + id pair. Extension-registered URIs (other schemes) are reachable via the resources/read transport surface.
Annotations the server declares
- title: Get Resource
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
get_viewFetch a data view's full cached result by id.No findings
Why it is in this group
- The name "get_view" says "get": a word for reading.
Description, as the server wrote it
Fetch a data view's full cached result by id. Output is freeform — each item's field set depends on the view's Twig definition. Call describe_view first to learn the expected shape. Capped at 50 items; larger views return the first 50 plus a hint to call query_view for pagination. For per-item paginated access use query_view directly.
Annotations the server declares
- title: Get Data View
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
list_collectionsDiscover the collections visible to you.No findings
Why it is in this group
- The name "list_collections" says "list": a word for reading.
Description, as the server wrote it
Discover the collections visible to you. Lean overview — one entry per collection. Returns id, name (display label), schema (the schema id this collection uses), description, url_pattern, access level, and total_objects (so you can decide whether to paginate or enumerate). For the per-property detail of one collection (which properties exist, which are filterable/sortable), call describe_collection. Then query_collection / search_collection / get_object for the data.
Annotations the server declares
- title: List Collections
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
list_guidesThe site's Guides: evergreen buying-guide pages served at /guides/{id}, stored in the roundups collection.No findings
Why it is in this group
- The name "list_guides" says "list": a word for reading.
Description, as the server wrote it
The site's Guides: evergreen buying-guide pages served at /guides/{id}, stored in the roundups collection. Returns every guide in display order with its id, heading, lede, reviewed date and draft flag. A guide's full content (contenders, choose, howToChoose, faqs, sources) is on the object itself: get_object with collection "roundups". Returns: paginated roundups objects with url per item.
Annotations the server declares
- title: List Guides
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
list_viewsDiscover the pre-computed data views visible to you.No findings
Why it is in this group
- The name "list_views" says "list": a word for reading.
Description, as the server wrote it
Discover the pre-computed data views visible to you. Lean overview — one entry per view. Data views are Twig-defined queries that aggregate across collections; their result is cached and accessible by id. Returns id, name, description, last_built, and access. Use the id with query_view (paginated query), get_view (fetch the whole cached result), or describe_view (output shape + metadata). For raw collection content use list_collections instead.
Annotations the server declares
- title: List Data Views
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
query_collectionQuery a collection for paginated content.1 finding
Why it is in this group
- The name "query_collection" says "query": a word for reading.
Findings
- Info
  The description is 2,016 characters long, over the 2,000 this check looks for.
  Matched text
  description ends: "...ed (datetime, sortable), submitted (datetime, sortable), weight (range, sortable)"
  What this check looks for
Description, as the server wrote it
Query a collection for paginated content. Returns the matching items plus pagination metadata (total, limit, offset, has_more); each item is decorated with a public `url` field where one is configured. Use REST-style `include` / `exclude` filter strings (comma-separated field:value pairs; AND-semantics for include, OR-semantics for exclude) and `sort` (e.g. `date:desc`). Only properties listed in the catalog below are queryable — other schema properties exist on objects but are not filterable here; use get_object if you need the full record or describe_collection to see every property. This tool does not free-text search content — use search_collection for that. It does not fetch a single object by id — use get_object. Available collections and filterable properties: - articles — id (id, sortable), title (text), author (select), summary (textarea), date (date, sortable), draft (toggle), updated (datetime, sortable) - comparisons — competitor (text), competitorUrl (url), heading (text), lede (textarea), reviewed (date, sortable), draft (toggle), sort (number, sortable), id (id, sortable) - extension — id (id, sortable), name (text), extensionId (text), soldAs (text), summary (textarea), category (select), price (number, sortable), currency (select), minEdition (select), minVersion (text), bundled (toggle), beta (toggle), docsUrl (url), productUrl (url), draft (toggle), owner (select), featured (toggle), approved (datetime, sortable), submitted (datetime, sortable), weight (range, sortable) - releases — id (id, sortable), version (text), title (text), date (date, sortable), draft (toggle), urgent (toggle), fullnotesurl (url), announce (toggle) - roundups — heading (text), lede (textarea), reviewed (date, sortable), draft (toggle), sort (number, sortable), id (id, sortable) - showcase — name (text), url (url), industry (select), id (id, sortable), owner (select), draft (toggle), featured (toggle), approved (datetime, sortable), submitted (datetime, sortable), weight (range, sortable)
Annotations the server declares
- title: Query Collection
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
query_viewPaginated query against a data view's cached result.No findings
Why it is in this group
- The name "query_view" says "query": a word for reading.
Description, as the server wrote it
Paginated query against a data view's cached result. REST-syntax include/exclude/sort, same vocabulary as query_collection. View data is freeform — call describe_view first to learn the field set before composing filters. `limit` is capped at 50; use offset to paginate larger views.
Annotations the server declares
- title: Query Data View
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
searchSearch site content across all collections you can see.No findings
Why it is in this group
- The name "search" says "search": a word for reading.
Description, as the server wrote it
Search site content across all collections you can see. Returns matching results as {id, title, url}; pass a result id to `fetch` to read the full document. Drafts are hidden from anonymous callers.
Annotations the server declares
- title: Search
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
search_collectionFree-text search within a single collection.No findings
Why it is in this group
- The name "search_collection" says "search": a word for reading.
Description, as the server wrote it
Free-text search within a single collection. Returns matching items decorated with a public `url`; total reflects what was found. Supports AND (default), OR, and "quoted phrases". Searches across the properties listed in the catalog below — other schema properties exist on objects but are not searchable here; use get_object for the full record or describe_collection to see every property. This tool does not filter by field value — use query_collection with `include`/`exclude` for that. Drafts are auto-hidden from anonymous callers. Available collections and filterable properties: - articles — id (id, sortable), title (text), author (select), summary (textarea), date (date, sortable), draft (toggle), updated (datetime, sortable) - comparisons — competitor (text), competitorUrl (url), heading (text), lede (textarea), reviewed (date, sortable), draft (toggle), sort (number, sortable), id (id, sortable) - extension — id (id, sortable), name (text), extensionId (text), soldAs (text), summary (textarea), category (select), price (number, sortable), currency (select), minEdition (select), minVersion (text), bundled (toggle), beta (toggle), docsUrl (url), productUrl (url), draft (toggle), owner (select), featured (toggle), approved (datetime, sortable), submitted (datetime, sortable), weight (range, sortable) - releases — id (id, sortable), version (text), title (text), date (date, sortable), draft (toggle), urgent (toggle), fullnotesurl (url), announce (toggle) - roundups — heading (text), lede (textarea), reviewed (date, sortable), draft (toggle), sort (number, sortable), id (id, sortable) - showcase — name (text), url (url), industry (select), id (id, sortable), owner (select), draft (toggle), featured (toggle), approved (datetime, sortable), submitted (datetime, sortable), weight (range, sortable)
Annotations the server declares
- title: Search Collection
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
search_collectionsFull-text search across every collection you can see, in one call.No findings
Why it is in this group
- The name "search_collections" says "search": a word for reading.
Description, as the server wrote it
Full-text search across every collection you can see, in one call. Returns matching items each decorated with `collection` (which collection the hit came from) and `url`. Pair `collection` + `id` to fetch the full record via get_object. Call list_collections for the available collections and describe_collection on any one for its full property list; properties not flagged filterable there exist on objects but are not searched here (use get_object for the full record). For a single-collection search use search_collection instead — same query syntax, scoped tighter. Drafts are auto-hidden from anonymous callers.
Annotations the server declares
- title: Search Across Collections
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false

This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.

Exfil surface

Which tools read private data, which read text someone else can write, and which can send data out. One of each is a path a prompt injection can use.

4 paths in this server alone from private data, through text someone else wrote, to a way out. Denying 1 outbound tool breaks every one.

Reads private data4: Reads files, mail, messages, databases, secrets, calendars or repositories.; docs_get
docs_lookup
docs_search
fetch
Reads text others write1: Brings in text someone else can write: web pages, inbound email, messages, issues and comments.; get_resource
Can send data out1: Can carry data to people or systems: it sends, posts or publishes, or takes a recipient, channel or URL.; get_resource

deny to break every path

{
  "permissions": {
    "deny": [
      "mcp__docs__get_resource"
    ]
  }
}

Other servers in the same agent add their own tools to these paths. Audit your whole setup to see them together.

Findings

Matches of fixed checks, with the text they matched.

1 info

Infoquery_collection
The description is 2,016 characters long, over the 2,000 this check looks for.
Matched text
description ends: "...ed (datetime, sortable), submitted (datetime, sortable), weight (range, sortable)"
What this check looks for

History

Changes to its tool definitions and to its remote endpoint, newest first.

No change seen yet. Its tools are rescanned every day, and a remote endpoint is looked at once a week.

All changes to this server

Install

Pinned to version 1.0.0. Values in angle brackets are yours to fill in.

claude mcp add --transport http docs https://totalcms.co/mcp

claude mcp add --transport http docs https://totalcms.co/mcp

Run in a terminal.

Claude Code permissions

Allow the reads, ask before a change or a way out, deny the deletes. Paste into .claude/settings.json.

.claude/settings.json

{
  "permissions": {
    "allow": [
      "mcp__docs__describe_collection",
      "mcp__docs__describe_view",
      "mcp__docs__docs_get",
      "mcp__docs__docs_lookup",
      "mcp__docs__docs_search",
      "mcp__docs__fetch",
      "mcp__docs__find_comparison",
      "mcp__docs__get_object",
      "mcp__docs__get_view",
      "mcp__docs__list_collections",
      "mcp__docs__list_guides",
      "mcp__docs__list_views",
      "mcp__docs__query_collection",
      "mcp__docs__query_view",
      "mcp__docs__search",
      "mcp__docs__search_collection",
      "mcp__docs__search_collections"
    ],
    "ask": [
      "mcp__docs__get_resource",
      "mcp__docs__latest_release",
      "mcp__docs__needs_review"
    ],
    "deny": []
  }
}

Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. A read that can send data out (it takes a URL, say) asks first too. It assumes the server is installed as docs. Review it before you use it.

Capability tags behind 5 rules

mcp__docs__docs_get private-data
mcp__docs__docs_lookup private-data
mcp__docs__docs_search private-data
mcp__docs__fetch private-data
mcp__docs__get_resource untrusted-input, outbound

Keep the decision: fail CI when the tools change, follow every change, or show a badge.

Pin in CI

Fail a build when the tools you reviewed are not the tools the server serves today.

curl -s "https://anlyon.dev/api/v1/servers/co.totalcms/docs/verify?hash=aaf21b1c98251e756f51d499a61bf70509481c123411aedd72329537ee58cc8f" | jq -e '.changed == false'

Pinned hash aaf21b1c9825, from Oct 24, 2026, 06:17 UTC.

Watch

Get told when its tools change: a new tool, a new description, a new class.

https://anlyon.dev/servers/co.totalcms/docs/changes.xml

An Atom feed. Works in any feed reader or Slack's RSS app.

Badge

[![anlyon.dev](https://anlyon.dev/badge/co.totalcms/docs.svg)](https://anlyon.dev/servers/co.totalcms/docs)

Source: MCP Registry · repository. Synced Oct 24, 2026, 06:17 UTC.