MCP

The Model Context Protocol server is the Management API for AI assistants. Every operation is a tool, and the tool name equals the operation's operationId in the Management API reference, for example posts_create or site_publish. Permissions, errors, rate limits and drafts behave exactly as they do over REST.

Assistants with connectors

Claude, ChatGPT and other assistants with built-in connectors use OAuth, so nobody handles a token.

1. In the assistant's connector settings, add a custom connector with the server URL https://app.kanorio.com/api/mcp. Do not paste the URL into a chat.
2. Sign in to Kanorio when the assistant opens the consent page, choose the sites and permissions, and approve.

The assistant discovers everything else from https://app.kanorio.com/.well-known/oauth-protected-resource. Kanorio supports dynamic client registration and client ID metadata documents. You can review and revoke approved apps in your account settings at any time.

Coding assistants with a key

Cursor, Claude Code, Codex, Gemini CLI, Windsurf and VS Code use a personal access token. Create one under Account settings › API access. After you pick the tool, Kanorio shows the configuration with your token already filled in.

Cursor (.cursor/mcp.json):

{
  "mcpServers": {
    "kanorio": {
      "url": "https://app.kanorio.com/api/mcp",
      "headers": { "Authorization": "Bearer knr_pat_..." }
    }
  }
}

Claude Code:

claude mcp add --transport http kanorio https://app.kanorio.com/api/mcp --header "Authorization: Bearer knr_pat_..."

VS Code (.vscode/mcp.json):

{
  "servers": {
    "kanorio": {
      "type": "http",
      "url": "https://app.kanorio.com/api/mcp",
      "headers": { "Authorization": "Bearer knr_pat_..." }
    }
  }
}

Codex (~/.codex/config.toml):

[mcp_servers.kanorio]
url = "https://app.kanorio.com/api/mcp"
http_headers = { "Authorization" = "Bearer knr_pat_..." }

Keep files that contain a token out of version control.

How the tools behave

• Only what the token allows. tools/list hides tools outside the token's permissions. Call auth_whoami to see the token's permissions and any hidden capabilities.
• Drafts until published. Content writes stay in draft until site_publish, posts_publish or another publish tool runs.
• Structured results. Each tool returns structured content matching the operation's response schema. Lists use the pagination envelope.
• Errors. Failed calls return isError with the error envelope. FORBIDDEN, plan and mode errors are limits, not bugs; details says what the user needs to change.
• Idempotency. Tools for create operations that support it take an idempotencyKey argument. See Idempotency.
• Deprecation. A deprecated tool's description starts with [Deprecated, removed after …; use …].

Server versions

The server follows semantic versioning, reported in serverInfo.version and in https://app.kanorio.com/.well-known/mcp/server.json. The changelog records each version change. A major version means an existing tool may behave differently, so clients that cache tool schemas should refresh them.