Plone MCP Server `1.0.0-alpha.1`

npm · @plone/mcp · latest release

Scan failed

Security result

Observed tools

Version rating

—

Change risk

Independent inventory

Observed 2026-08-21T20:50:27.918Z using mcpSecurity-inventory. Protocol 2025-06-18.

Tool	Category	Risk
plone_add_single_blockAdds a single new block to an existing content item without replacing other blocks. Specify the block type, data, and optional position. Example: plone_add_single_block({path: '/my-page', blockType: 'slate', blockData: {text: 'New paragraph'}}) Input schema { "$schema": "http://json-schema.org/draft-07/schema#", "type": "object", "properties": { "path": { "type": "string", "description": "Path to the content" }, "blockType": { "type": "string", "enum": [ "teaser", "slate", "__button", "separator", "image", "gridBlock", "listing" ], "description": "Type of block to add" }, "blockData": { "type": "object", "propertyNames": { "type": "string" }, "additionalProperties": {}, "description": "Block-specific data" }, "position": { "description": "Position to insert the block (optional, defaults to end)", "type": "number" } }, "required": [ "path", "blockType", "blockData" ] }	—	—
plone_configureEstablishes and authenticates the connection to a Plone CMS. Must be called once per session before other tools can be used. Configuration can be provided via arguments or environment variables (PLONE_BASE_URL, PLONE_USERNAME, PLONE_PASSWORD, PLONE_TOKEN). Arguments take precedence over environment variables. To use environment variables only, call with an empty object: plone_configure({}). Example with arguments: plone_configure({baseUrl: 'https://demo.plone.org', username: 'admin', password: 'secret'}). Input schema { "$schema": "http://json-schema.org/draft-07/schema#", "type": "object", "properties": { "baseUrl": { "description": "Base URL of the Plone site. Can be set via PLONE_BASE_URL environment variable.", "type": "string" }, "username": { "description": "Username for authentication. Can be set via PLONE_USERNAME environment variable.", "type": "string" }, "password": { "description": "Password for authentication. Can be set via PLONE_PASSWORD environment variable.", "type": "string" }, "token": { "description": "JWT token for authentication (alternative to username/password). Can be set via PLONE_TOKEN environment variable.", "type": "string" } } }	—	—
plone_create_blocks_layoutPrepares a complete block structure in memory (valid for 60 seconds). This structure is then used by the next immediate call to `plone_create_content` or `plone_update_content`. Use `plone_get_block_schemas` to learn what data each block type needs. The text displayed by the Title block is automatically managed by Plone, DO NOT add it in the block's data. Example: plone_create_blocks_layout({blocks: [{type: 'slate', data: {text: 'Hello World'}}]}) Input schema { "$schema": "http://json-schema.org/draft-07/schema#", "type": "object", "properties": { "blocks": { "type": "array", "items": { "type": "object", "properties": { "type": { "type": "string", "enum": [ "teaser", "slate", "__button", "separator", "image", "gridBlock", "listing" ], "description": "Type of block to create" }, "data": { "type": "object", "propertyNames": { "type": "string" }, "additionalProperties": {}, "description": "Block-specific data following the block specification" } }, "required": [ "type", "data" ] }, "description": "Array of block specifications to process. You MUST call plone_get_block_schemas first to see available block types and their required fields. You MUST follow the block specifications EXACTLY, DO NOT invent your own fields. DO NOT add the content object's title in a text block. To set the page title, use the 'title' field of the content object itself when calling plone_create_content or plone_update_content. A Title block will be automatically created by Plone." } }, "required": [ "blocks" ] }	—	—
plone_create_contentCreates a new content item (e.g., a page or news article) in Plone. To add complex block-based content, first prepare the structure with `plone_create_blocks_layout`, then call this tool. Example: plone_create_content({parentPath: '/', type: 'Document', title: 'My Page', description: 'A sample page'}) Input schema { "$schema": "http://json-schema.org/draft-07/schema#", "type": "object", "properties": { "parentPath": { "type": "string", "description": "Path where to create the content (e.g., '/parentDocument/document' or '/' for root)" }, "type": { "type": "string", "description": "Content type to create (e.g., 'Document', 'Event', 'News Item')" }, "title": { "type": "string", "description": "Title of the new content" }, "description": { "description": "Description of the new content", "type": "string" }, "id": { "description": "ID for the new content (optional, will be auto-generated if not provided)", "type": "string" }, "blocks": { "description": "Volto blocks structure for the content, it specifies the blocks data and content", "type": "object", "propertyNames": { "type": "string" }, "additionalProperties": {} }, "blocks_layout": { "description": "Volto blocks layout configuration, it specifies the order of blocks", "type": "object", "propertyNames": { "type": "string" }, "additionalProperties": {} }, "additionalFields": { "description": "Additional fields to update. For preview images, include preview_image_link: { '@id': 'image-url' } in this object (if you get a 400 error, make sure the image URL is accessible).", "type": "object", "propertyNames": { "type": "string" }, "additionalProperties": {} } }, "required": [ "parentPath", "type", "title" ] }	—	—
plone_create_userCreates a new user in the Plone site. Requires Manager role or self-registration to be enabled. Example: plone_create_user({username: 'jdoe', password: 'secret', email: 'jdoe@example.com', fullname: 'John Doe', roles: ['Contributor']}) Input schema { "$schema": "http://json-schema.org/draft-07/schema#", "type": "object", "properties": { "username": { "type": "string", "description": "Username for the new user" }, "password": { "type": "string", "description": "Password for the new user, it must be 8 characters or longer. Unless specified otherwise, use 12345678 as the default password for created users." }, "email": { "description": "Email address of the user", "type": "string" }, "fullname": { "description": "Full name of the user", "type": "string" }, "description": { "description": "Short biography or description of the user", "type": "string" }, "home_page": { "description": "URL of the user's home page", "type": "string" }, "location": { "description": "Location of the user", "type": "string" }, "roles": { "description": "Roles to assign to the user (e.g., ['Contributor', 'Editor'])", "type": "array", "items": { "type": "string" } }, "sendPasswordReset": { "description": "If true, send a password reset email to the user instead of setting the password directly", "type": "boolean" } }, "required": [ "username", "password" ] }	—	—
plone_delete_contentPermanently deletes a content item from Plone using its path. Example: plone_delete_content({path: '/old-content'}) Input schema { "$schema": "http://json-schema.org/draft-07/schema#", "type": "object", "properties": { "path": { "type": "string", "description": "Path to the content to delete" } }, "required": [ "path" ] }	—	—
plone_get_block_schemasLists all available Volto block types (e.g., 'slate', 'teaser', 'button') and their required data schemas. Essential for understanding how to construct blocks. Example: plone_get_block_schemas({blockType: 'teaser'}) Input schema { "$schema": "http://json-schema.org/draft-07/schema#", "type": "object", "properties": { "blockType": { "description": "Specific block type to get schema for (optional, returns all if not specified).", "type": "string", "enum": [ "teaser", "slate", "__button", "separator", "image", "gridBlock", "listing" ] } } }	—	—
plone_get_contentRetrieves the full JSON data for a single content item from Plone using its path. Example: plone_get_content({path: '/news/latest-update'}) Input schema { "$schema": "http://json-schema.org/draft-07/schema#", "type": "object", "properties": { "path": { "type": "string", "description": "Path to content (e.g., '/parentDocument/document' or just '/' for root level)" }, "expand": { "description": "Components to expand (e.g., ['breadcrumbs', 'actions', 'workflow'])", "type": "array", "items": { "type": "string" } } }, "required": [ "path" ] }	—	—
plone_get_navigation_treeGet the site navigation tree as seen from a given path. The tree is rooted at the nearest navigation root (the site root, or the language folder on multilingual sites) — use depth to include nested levels, then look up the relevant subtree in the result. Example: plone_get_navigation_tree({root_path: '/en/documentation', depth: 3}) Input schema { "$schema": "http://json-schema.org/draft-07/schema#", "type": "object", "properties": { "root_path": { "description": "Path whose navigation root determines the tree (defaults to portal root). Note: the tree is rooted at the nearest navigation root of this path (e.g. the language folder on multilingual sites), not at the path itself.", "type": "string" }, "depth": { "default": 2, "description": "How many levels of the navigation tree to include", "type": "number" } } }	—	—
plone_get_site_infoRetrieves top-level information and metadata about the connected Plone site, such as available languages and Plone version. Input schema { "$schema": "http://json-schema.org/draft-07/schema#", "type": "object", "properties": {} }	—	—
plone_get_translationRetrieves all available translations for a content item, identified by its '@id' (URL). Example: plone_get_translation({path: '/en/my-page'}) Input schema { "$schema": "http://json-schema.org/draft-07/schema#", "type": "object", "properties": { "path": { "type": "string", "description": "Path to the content item (e.g., '/en/my-page')" } }, "required": [ "path" ] }	—	—
plone_get_type_schemaGets the full JSON schema for a specific content type, including all fields, their types, required status, and validation rules. Use this to understand what fields are available when creating or updating content. Example: plone_get_type_schema({contentType: 'Document'}) Input schema { "$schema": "http://json-schema.org/draft-07/schema#", "type": "object", "properties": { "contentType": { "type": "string", "description": "Content type to get the schema for (e.g., 'Document')" } }, "required": [ "contentType" ] }	—	—
plone_get_typesLists all available content types that can be created in the Plone site (e.g., 'Document', 'Event'). Input schema { "$schema": "http://json-schema.org/draft-07/schema#", "type": "object", "properties": {} }	—	—
plone_get_vocabulariesLists all available vocabularies, or fetches the allowed values of one specific vocabulary — such as a list of categories or tags. Useful for finding valid inputs for content fields. Call with no arguments to discover vocabulary names, then with a name to get its terms. Example: plone_get_vocabularies({vocabulary: 'plone.app.vocabularies.Keywords'}) Input schema { "$schema": "http://json-schema.org/draft-07/schema#", "type": "object", "properties": { "vocabulary": { "description": "Vocabulary name (e.g. 'plone.app.vocabularies.Keywords'). Omit to list all available vocabularies.", "type": "string" }, "title": { "description": "Filter terms by title", "type": "string" }, "token": { "description": "Filter terms by token", "type": "string" } } }	—	—
plone_get_workflow_infoShows the current workflow state (e.g., 'Published', 'Private') and available transitions for a content item. Example: plone_get_workflow_info({path: '/my-document'}) Input schema { "$schema": "http://json-schema.org/draft-07/schema#", "type": "object", "properties": { "path": { "type": "string", "description": "Path to the content" } }, "required": [ "path" ] }	—	—
plone_link_translationLinks an existing content item as a translation of another. Both items must already exist. Pass the '@id' (full URL) of the existing content item. Example: plone_link_translation({path: '/en/my-page', id: 'https://example.com/de/meine-seite'}) Input schema { "$schema": "http://json-schema.org/draft-07/schema#", "type": "object", "properties": { "path": { "type": "string", "description": "Path to the source content item" }, "id": { "type": "string", "description": "The path of the content item to link as a translation (e.g., '/es/test-document')." } }, "required": [ "path", "id" ] }	—	—
plone_remove_single_blockDeletes a single block from a content item, identified by its block ID. Example: plone_remove_single_block({path: '/my-page', blockId: 'abc123'}) Input schema { "$schema": "http://json-schema.org/draft-07/schema#", "type": "object", "properties": { "path": { "type": "string", "description": "Path to the content" }, "blockId": { "type": "string", "description": "ID of the block to remove" } }, "required": [ "path", "blockId" ] }	—	—
plone_searchPerforms a detailed search for content items, allowing filters by text, content type, path, and workflow state. Example: plone_search({query: 'annual report', portal_type: ['Document'], review_state: ['published']}) Input schema { "$schema": "http://json-schema.org/draft-07/schema#", "type": "object", "properties": { "query": { "description": "Search query text", "type": "string" }, "portal_type": { "description": "Content types to search for", "type": "array", "items": { "type": "string" } }, "path": { "description": "Path to search within", "type": "string" }, "review_state": { "description": "Workflow states to filter by", "type": "array", "items": { "type": "string" } }, "sort_on": { "description": "Field to sort by (e.g., 'modified', 'created', 'sortable_title')", "type": "string" }, "sort_order": { "description": "Sort order", "type": "string", "enum": [ "ascending", "descending" ] }, "b_size": { "description": "Batch size (number of results per page)", "type": "number" }, "b_start": { "description": "Batch start (for pagination)", "type": "number" } } }	—	—
plone_transition_workflowChanges the workflow state of a content item by executing a specific transition, like 'publish' or 'submit'. Example: plone_transition_workflow({path: '/my-document', transition: 'publish'}) Input schema { "$schema": "http://json-schema.org/draft-07/schema#", "type": "object", "properties": { "path": { "type": "string", "description": "Path to the content" }, "transition": { "type": "string", "description": "Workflow transition to execute" }, "comment": { "description": "Comment for the transition", "type": "string" } }, "required": [ "path", "transition" ] }	—	—
plone_unlink_translationRemoves the translation link between a content item and one of its translations, identified by language code. Example: plone_unlink_translation({path: '/en/my-page', language: 'de'}) Input schema { "$schema": "http://json-schema.org/draft-07/schema#", "type": "object", "properties": { "path": { "type": "string", "description": "Path to the content item to unlink a translation from" }, "language": { "type": "string", "description": "Language code of the translation to unlink (e.g., 'de', 'fr')" } }, "required": [ "path", "language" ] }	—	—
plone_update_contentModifies an existing content item in Plone. Can update metadata (like title) and/or replace the entire block structure. Use `plone_create_blocks_layout` to prepare complex block updates. Example: plone_update_content({path: '/my-page', title: 'Updated Title'}) Input schema { "$schema": "http://json-schema.org/draft-07/schema#", "type": "object", "properties": { "path": { "type": "string", "description": "Path to the content to update" }, "title": { "description": "New title", "type": "string" }, "description": { "description": "New description", "type": "string" }, "blocks": { "description": "Volto blocks structure for the content", "type": "object", "propertyNames": { "type": "string" }, "additionalProperties": {} }, "blocks_layout": { "description": "Volto blocks layout configuration", "type": "object", "propertyNames": { "type": "string" }, "additionalProperties": {} }, "additionalFields": { "description": "Additional fields to update. For preview images, include preview_image_link: { '@id': 'image-url' } in this object (if you get a 400 error, make sure the image URL is accessible).", "type": "object", "propertyNames": { "type": "string" }, "additionalProperties": {} } }, "required": [ "path" ] }	—	—
plone_update_single_blockModifies the data of a single, existing block within a content item, identified by its block ID. Example: plone_update_single_block({path: '/my-page', blockId: 'abc123', blockData: {text: 'Updated text'}}) Input schema { "$schema": "http://json-schema.org/draft-07/schema#", "type": "object", "properties": { "path": { "type": "string", "description": "Path to the content" }, "blockId": { "type": "string", "description": "ID of the block to update" }, "blockData": { "type": "object", "propertyNames": { "type": "string" }, "additionalProperties": {}, "description": "New block data" } }, "required": [ "path", "blockId", "blockData" ] }	—	—
plone_update_userUpdates an existing user's properties in Plone. Requires Manager role or the user updating their own account. Roles are specified as an object mapping role names to booleans to add or remove them. Example: plone_update_user({userid: 'jdoe', fullname: 'Jane Doe', roles: {Editor: true, Contributor: false}}) Input schema { "$schema": "http://json-schema.org/draft-07/schema#", "type": "object", "properties": { "userid": { "type": "string", "description": "The ID of the user to update" }, "email": { "description": "New email address", "type": "string" }, "fullname": { "description": "New full name", "type": "string" }, "description": { "description": "New biography or description", "type": "string" }, "home_page": { "description": "New home page URL", "type": "string" }, "location": { "description": "New location", "type": "string" }, "roles": { "description": "Roles to add or remove, as an object mapping role names to booleans (e.g., {Contributor: true, Editor: false})", "type": "object", "propertyNames": { "type": "string" }, "additionalProperties": { "type": "boolean" } } }, "required": [ "userid" ] }	—	—

Resources 2

plone-site

Provides direct read-only access to the Plone site's root information object.

Metadata

{
  "resource_key": "plone://site",
  "uri": "plone://site",
  "name": "plone-site",
  "description": "Provides direct read-only access to the Plone site's root information object.",
  "mime_type": "application/json",
  "annotations": null,
  "metadata_hash": "963fb65113f10e8bff9f5430b9073549a93af2a77924731d4bc5732287565678"
}

plone-types

Provides direct read-only access to the list of available content types.

Metadata

{
  "resource_key": "plone://types",
  "uri": "plone://types",
  "name": "plone-types",
  "description": "Provides direct read-only access to the list of available content types.",
  "mime_type": "application/json",
  "annotations": null,
  "metadata_hash": "a0ecaf3e1dd882bdea5a0291982d177cf6c5101b2040d0cd59772df277dea1f3"
}

Resource templates 1

plone-content

Provides direct read-only access to the full JSON of a Plone content item via its path.

Metadata

{
  "template_key": "plone://content{+path}",
  "uri_template": "plone://content{+path}",
  "name": "plone-content",
  "description": "Provides direct read-only access to the full JSON of a Plone content item via its path.",
  "mime_type": "application/json",
  "annotations": null,
  "metadata_hash": "53e740747b37a9834b18fcfac7ec9979d304ddcf14673ef930211fc8363fd40c"
}

Prompts 2

create-example-site-workflow

A guided workflow to create a small, multi-page example website with interconnected content.

Metadata

{
  "prompt_key": "create-example-site-workflow",
  "name": "create-example-site-workflow",
  "description": "A guided workflow to create a small, multi-page example website with interconnected content.",
  "arguments": [
    {
      "name": "contentTypes",
      "description": "Types of content to create (e.g., 'Documents, News Items')",
      "required": true
    },
    {
      "name": "purpose",
      "description": "The overall theme or topic of the site",
      "required": true
    },
    {
      "name": "audience",
      "description": "The target audience for the site",
      "required": false
    },
    {
      "name": "numberOfPages",
      "description": "The number of pages to create (default is 3)",
      "required": false
    }
  ],
  "metadata_hash": "db8184b86ee57d84d5fd21f19a04d59272da6eaab1d02f7b47d287265871141d"
}

create-page-workflow

A guided workflow to create a single web page with specific content and structure.

Metadata

{
  "prompt_key": "create-page-workflow",
  "name": "create-page-workflow",
  "description": "A guided workflow to create a single web page with specific content and structure.",
  "arguments": [
    {
      "name": "contentType",
      "description": "Type of content to create (e.g., 'Document', 'News Item')",
      "required": true
    },
    {
      "name": "purpose",
      "description": "The purpose or topic of the page",
      "required": true
    },
    {
      "name": "audience",
      "description": "The target audience for the page",
      "required": false
    }
  ],
  "metadata_hash": "513eafa57360a05fa8d2f30aec72cec730434f90f8f419225bc0d0f74e469af9"
}

Changes from previous version

No completed comparison is available.

Risk	Change	Subject
No material changes recorded.

Confirmed vulnerabilities

Severity	Finding	Advisory
No confirmed vulnerability is published for this version.

Provenance

Artifact SHA-256: fb1dbaaf7e1a9520606c6c4999baa4a92bd18170be0876bd711df0db501e24cd

Scanner: mcp-proof-engine 0.1.0.

Plone MCP Server 1.0.0-alpha.1

Independent inventory

Resources 2

Resource templates 1

Prompts 2

Changes from previous version

Confirmed vulnerabilities

Provenance

Plone MCP Server `1.0.0-alpha.1`