The Item Service handles ordinary content, GraphQL answers the read-heavy questions after you introspect the schema, and PowerShell Extensions covers everything the first two do not, with the command documentation available so a model can write a correct script. The security surface is unusually complete: ACLs, locks, roles and domains are all here, which makes this an administration tool as much as a content one, and worth scoping credentials for accordingly.
A Sitecore server that bridges three API surfaces at once: the Item Service, GraphQL endpoints per schema, and Sitecore PowerShell Extensions.
- Item work through the Item Service: get by id or path, children and descendants, create from a template, edit, delete, search, and run stored queries and searches
- GraphQL per schema — introspect it to get the shape, then execute queries against edge or master
- PowerShell as the escape hatch, with the documentation for every Sitecore PowerShell command retrievable and scripts run through the remoting API
- Security administration in depth: users created, edited, disabled, enabled, unlocked and removed; roles and domains created and removed; role membership added and checked
- Item-level access control read, tested, added, set and cleared by id or path, and items locked, unlocked, protected and unprotected
- Content operations you would otherwise script by hand: base templates added, item versions added, clones read and converted, item fields, references, referrers and templates read by id or path
- Workflow visibility — an item's workflow events read, and a workflow invoked on it
- Instance-level reads such as the languages present, the databases, the cache, and Sitecore jobs
- A config tool reporting how the server is currently wired
A reachable Sitecore instance and credentials for each surface you enable: GRAPHQL_ENDPOINT with GRAPHQL_SCHEMAS, GRAPHQL_API_KEY and optional extra headers; ITEM_SERVICE_SERVER_URL with ITEM_SERVICE_DOMAIN, ITEM_SERVICE_USERNAME and ITEM_SERVICE_PASSWORD; and POWERSHELL_SERVER_URL with the matching POWERSHELL_DOMAIN, POWERSHELL_USERNAME and POWERSHELL_PASSWORD. Published on npm as @antonytm/mcp-sitecore-server, with Docker and from-source options. TRANSPORT selects stdio, streamable-http or sse. Works with XM Cloud and with XM/XP.
One command plus a key — npx -y @antonytm/mcp-sitecore-server, then supply credentials