CMS Tool API schema
Public API version 1.4.41.
MCP server
Connect an MCP client to CMS Tool data and operations.
Connection
The MCP server is an extension of the API and uses the same OAuth access tokens and permission-based scopes.
Send JSON-RPC 2.0 messages by POST to https://api.cms-tool.net/api/mcp with Content-Type application/json and an Authorization Bearer header.
OAuth protected resource metadata
Session sequence
Call initialize first, send notifications/initialized, then use tools/list and tools/call. The server also supports ping and notifications/cancelled.
The supported MCP protocol version is 2025-11-25.
Available tools
Request only the scopes required by the tools your client will call.
| Tool | Scope | Limit | Purpose |
|---|---|---|---|
| get_database_schema_metadata | mcp/get_database_schema_metadata:read | 30/minute, 4 concurrent | Get current planning instructions and database metadata before building a report or product update plan. |
| get_website_metadata | mcp/get_website_metadata:read | 30/minute, 4 concurrent | Get website categories, pages, and site metadata used by a plan. |
| get_api_guidance | mcp/get_api_guidance:read | 20/minute, 4 concurrent | Find the right REST API endpoint for a task, then get its methods, parameters, body fields, types and examples. Lists only the endpoints and methods the connection's scopes and the user's permissions allow. It describes the API and does not call it; use read_api to read and call_api to change. |
| read_api | mcp/read_api:read | 60/minute, 4 concurrent | Read from the REST API (GET): list records or fetch one by id. The user's CMS permissions are applied. Reads return 25 rows by default (maximum 100) and a response is at most 50,000 characters. File and image endpoints are not available. |
| generate_report | mcp/generate_report:read | 10/minute, 2 concurrent | Validate a report plan and return either its data or a link, as selected by the plan. |
| get_domain_investigation | mcp/get_domain_investigation:read | 6/minute, 2 concurrent | Investigate a domain: registration, availability and transfer status, nameservers, hosting, mail, and whether our settings for it agree with the public records. |
| check_domain_availability | mcp/check_domain_availability:read | 10/minute, 2 concurrent | Check whether up to 10 candidate domain names can be registered in one call (.nz names with the NZ registry, others with our registrar), with a registration link for each available name. |
| get_email_investigation | mcp/get_email_investigation:read | 6/minute, 2 concurrent | Investigate why mail to or from an email address does or does not work: our rule for it, where forwarded mail ends up, whether our DNS and mail are authoritative, and the mail program settings. |
| get_url_investigation | mcp/get_url_investigation:read | 5/minute, 1 concurrent | Investigate ONE web page: HTTP status, redirect (reported, not followed), SSL certificate, where it resolves, and optionally its content and (include_css) its HTML and directly linked CSS for styling problems. Rate limited; not for scraping. |
| get_order_investigation | mcp/get_order_investigation:read | 10/minute, 2 concurrent | Retrieve an order and related pricing metadata so a model can explain discounts, tax, shipping, and totals. Field definitions are included only for keys present in the returned objects. |
| get_account_report | mcp/get_account_report:read | 10/minute, 2 concurrent | Get the hosting account status for the website: whether the website and email are live, the plan and its limits, current usage in MB, domains, balance and payment details, with a short explanation of each section. Requires the accounts permission. |
| get_ecommerce_settings | mcp/get_ecommerce_settings:read | 10/minute, 2 concurrent | Get the shopping cart configuration: shopping settings such as tax rate and currency, shipping rules, discount rules and up to 200 categories, with the definition of every setting, marking the ones that are not set. Products are not included. |
| investigate_object | mcp/investigate_object:read | 20/minute, 4 concurrent | Read one content object by ID through its REST API endpoint, with definitions only for fields present in the result. Useful for page content, sorting, pagination, and other behavior settings. The user's permission for the object's own endpoint applies. |
| list_my_websites | mcp/list_my_websites:read | 20/minute, 2 concurrent | List the websites you own or have been given access to, marking the active one. |
| search_websites | mcp/search_websites:read | 20/minute, 2 concurrent | Search websites by keywords, owner or website ID. Resellers and administrators search every website in their reseller channels; other users search their own. |
| switch_website | mcp/switch_website:write | 10/minute, 1 concurrent | Change the active website of an OAuth connection. Every other tool acts on the active website. Access is checked and permissions are refreshed for the new website. |
| preview_product_update | mcp/preview_product_update:read | 6/minute, 1 concurrent | Validate a product update and return its full match count plus up to 100 proposed before and after rows. |
| execute_product_update | mcp/execute_product_update:write | 4/minute, 1 concurrent | Apply a previously previewed product update, including supported restore and category operations. |
Tool calls
Call get_database_schema_metadata with purpose report or product_update before constructing the corresponding plan. Product-update metadata includes the complete plan rules and product field dictionary. Request categories and site through get_website_metadata when category IDs or tax settings are needed. Use the returned instructions and metadata as the current contract.
{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"get_database_schema_metadata","arguments":{"purpose":"report"}}}Report result delivery
Every generate_report report_plan must include result_mode. Use data when the model needs to inspect and reason about the returned rows. Use link when the user only needs access to the report and a compact response should avoid consuming tokens for its rows.
Every report is executed. Non-empty reports are recorded for later review. Data mode returns data, row_count, and columns. Link mode returns row_count and, when rows exist, report_link without including the rows in the tool response. An empty report returns row_count 0 and no link. The linked page reopens the logged report under the user's own signed-in website access.
Rate limits
Tools have per-user request and concurrency limits. Successful calls can include RateLimit response headers and rate_limit metadata. A limited request returns HTTP 429 with Retry-After.
/api/mcp
Process authenticated MCP JSON-RPC requests.
Machine-readable documentation
This documentation is also available as JSON or Markdown at the same URL. Request JSON with Accept: application/json or Markdown with Accept: text/markdown.