Connect an AI Assistant (MCP)

MCP (Model Context Protocol) acts as a translator between your AI assistant and Kanorio. Once connected, you don't need to click through the dashboard manually. Just tell ChatGPT, Claude, or Cursor in plain English: "Help me create a website for a handmade bakery, add a hero section, three featured bread introductions, and an FAQ section on the homepage, then save it as a draft for me to review," and the AI will handle it for you in Kanorio.

• MCP Server URL: https://app.kanorio.com/api/mcp

Step 1: Determine your connection method

Depending on your tool, there are two ways to connect:

If you are unsure which method your tool uses, go to "Account Settings › API Access" and click "Create Key". The first step is to select your tool; if you choose a tool that supports OAuth links, the screen will provide the server URL directly without creating a new key.

Both methods share the same security rules: The AI can never perform actions beyond the permissions you grant, nor can it exceed your member role on that website.

Method 1: Connect via OAuth Link (ChatGPT, Claude, etc.)

Suitable for tools with built-in "Connectors" like ChatGPT, Claude, Gemini, Zapier, and Make. Here are examples for ChatGPT and Claude:

1. Add the Kanorio connector in your tool

• ChatGPT: Open "Settings" → "Connectors" (enable developer mode if using custom connectors), select "Create", name it Kanorio, enter the MCP server URL https://app.kanorio.com/api/mcp, and select OAuth as the authentication method.
• Claude: Open "Settings" → "Integrations" or "Connectors", select "Add remote MCP server", and enter the name Kanorio and the URL https://app.kanorio.com/api/mcp.

2. Select your website and click "Allow" on the Kanorio authorization page

After saving, your browser will open the Kanorio authorization page:

1. Confirm the screen displays the correct Kanorio account you want to use.
2. Review the list of permissions under "This application will be able to". Permissions are requested by the app (if not specified, the system defaults to the "Edit Content" plan, which allows viewing and editing pages and blog drafts, but not publishing or unpublishing websites).
3. Under "Accessible Websites", select only the websites you want the AI to manage. If you want the AI to build new websites from scratch, select "All websites (including future additions)".
4. Click "Allow" to return to your tool and enable the Kanorio tool in the chat box to start.

Prompted for authorization again? If you initially connected with the default "Edit Content" permission and later ask the AI to "publish the website" or "bind a custom domain," the AI assistant will automatically guide you back to the authorization page to grant the missing permissions (new items will be marked as "New"). Confirm and click "Allow" to continue. For a full explanation of the authorization screen and how to revoke access, see .

Gemini Usage Note: Google currently limits Gemini web's "Custom Apps" to personal accounts in the US, aged 18+, using an English interface. Gemini Enterprise is currently unsupported due to requirements for fixed client secrets.

Method 2: Connect via API Key (Cursor, Claude Code, etc.)

Suitable for Cursor, Claude Code, GitHub Copilot (VS Code), Windsurf, Perplexity, n8n, and custom programs.

1. Create a key and copy your configuration

1. Go to "Account Settings › API Access" and click "Create Key".
2. Select Tool: Click the icon of the tool you want to connect (e.g., Cursor or Claude Code).
3. Select Accessible Websites: For existing websites, we recommend selecting only that specific site. To allow the AI to build new sites from scratch, select "All websites (including future additions)".
4. Select Permission Plan:
   • The default "Edit Content" plan allows the AI to modify page modules, upload images, and write blog drafts (safest, as you review before publishing).
   • If you want the AI to handle publishing, domain binding, or product management, select "Full Management".
5. Select Expiration Date and confirm your identity, then click create. For details on key rotation, see .

2. Paste the configuration into your tool

Once the key is created, the screen will generate a configuration already populated with your key and server URL. Click "Copy Configuration" and paste it into the appropriate location:

Cursor Configuration (.cursor/mcp.json) Example:

{
  "mcpServers": {
    "kanorio": {
      "url": "https://app.kanorio.com/api/mcp",
      "headers": {
        "Authorization": "Bearer knr_pat_your_key"
      }
    }
  }
}

Claude Code Terminal Command Example:

claude mcp add --transport http kanorio https://app.kanorio.com/api/mcp \
  --header "Authorization: Bearer knr_pat_your_key"

Prefer not to store keys in local config files? Cursor and Claude Code also support OAuth links: omit the headers field in Cursor settings or the --header parameter in Claude Code. The tool will automatically open your browser on first use to take you to the Kanorio authorization page. Since these tools run locally, you may see a yellow "Identity Unverified" warning stating "You will be returned to the program on this device." As long as you initiated the connection, you can safely click "Allow" (see ).

What can the AI assistant do? (Safety Boundaries)

Drafts vs. Immediate Changes

Before letting the AI manage your site, understand which actions have a "draft buffer":

• Saved as drafts (requires "Publish" to go live):
  • Modifying all module content and layout on a page.
  • Modifying header navigation, footer, site-wide buttons, and social links.
  • Modifying site appearance settings (brand colors, fonts, corner styles, density, dark/light mode, content language).
  • Adding or modifying blog posts (new posts are always drafts; you must publish them separately).
• Reflected immediately on published sites:
  • Modifying page URL slugs, visibility status, and per-page SEO fields.
  • Adding, modifying, or archiving store products (products have no draft state; changes go live immediately).
  • Executing publish website, unpublish website, or bind custom domain.

What the AI cannot do

To protect your account security, finances, and customer privacy, the following actions are strictly prohibited via AI or API at the system level. Even with "Full Management" permissions, these must be performed by you in the Kanorio dashboard:

• Data Export & Private Files: Exporting site backups, exporting CSVs for orders/customers/marketing/analytics, or downloading form attachments.
• Payments, Orders & Billing: Issuing refunds, modifying order status/notes, changing site currency, changing product pricing plans, or managing subscription billing and payment methods.
• Irreversible Customer & Marketing Actions: Deleting contacts, bulk importing contacts, or directly sending/scheduling newsletters (AI can only draft these; you must confirm in the dashboard).
• Permissions & Ownership: Inviting/removing team members, transferring site ownership, or permanently deleting sites/blog posts.

Capability & MCP Tool Reference

Once connected, the AI can call these 17 capabilities (tool names on the right are for engineering reference or checking call logs in Cursor/Claude):

Recommended Workflow & Practical Prompts

Best Practices for AI Site Building

AI assistants work best when following these 7 steps (this sequence is built into the sections_describe guide, which the AI follows automatically):

1. Check Module Specs: Let the AI understand available modules and field limits.
2. Create or Select Site: Build a new site or list existing ones to confirm the target.
3. Set Brand Appearance & Global Buttons: Set brand colors, fonts, and global buttons (e.g., "Book Now") first so they are consistently applied to new pages.
4. Prepare Images: Send photos to the AI or ask it to pick from free stock libraries (see next section).
5. Rewrite Pages & Update Navigation: Have the AI read the current page before rewriting; remember to ask the AI to update the header navigation after adding new pages.
6. Review Drafts & Publish: Preview drafts in the editor, then ask the AI to publish (first-time publishing requires a .kanorio.com subdomain).
7. Bind Domain & Check DNS: If you have a custom domain, ask the AI to bind it and check DNS status.

Copy-Paste Prompt Templates

Example 1: Build a brand website from scratch (Draft mode)

Please build a new brand website for me in Kanorio:
- Brand Name: [Your Brand Name]
- Industry & Intro: [Description of your business and services]
- Style & Colors: [e.g., Warm earthy tones, soft rounded corners, light background]
- Primary Action Button: [e.g., Book Now (link to https://instagram.com/example)]
Please plan and build a "Homepage" and "About Us" page. Pick suitable stock photos for the bakery/bread theme. After building, update the header navigation and save as a draft for my review before publishing.

Example 2: Rewrite existing pages & optimize SEO

Please read my [Your Brand Name] website in Kanorio:
1. Review the current homepage modules, rewrite the text to be more engaging, and add an "FAQ" module at the bottom (include 4 Q&As regarding storage, booking times, and allergens).
2. Check and update the SEO title and description for all pages on the site.
Please save as a draft, do not publish yet, and tell me what you have changed.

Example 3: Uploading photos & drafting a blog post

I want to add a blog post about "Autumn Chestnut Sourdough Launch" to my [Your Brand Name] website and update the homepage hero image with a new photo I just took. Please provide a link for me to upload the photo. Once uploaded, please update the image and create the blog draft.

How does the AI get your images?

Why can't the AI use photos I paste into the chat?

Due to security restrictions, ChatGPT/Claude only allow the AI to "see" images in the chat; they do not transfer raw image files to Kanorio. When a site needs an image, the AI will follow one of these four paths. Just follow the AI's prompts:

Media Library & Trash Rules

• 24-Hour Cleanup: Images uploaded via AI that remain unused for 24 hours are automatically reclaimed to save space.
• Trash & 30-Day Recovery: Ask the AI to organize the media library and move unused files to the trash (media_trash). Files in the trash stop displaying on your site but still count toward storage. You can restore them within 30 days via the AI or the (media_restore). To permanently delete, ask the AI (media_purge; it will confirm if the image is still in use). Digital product downloads are protected and cannot be moved to trash.
• Overwriting Images: If you replace an old image with a new one in the dashboard, and the AI restores the old version from the trash, the system restores it as a new, independent file. Pages using the new version will not be affected.

Usage Limits & Notes

• Rate Limits: Each API key (or authorized app connection) can make up to 120 calls per minute for general operations. Publishing/Unpublishing (sites/blog posts) is capped at 30 calls per hour. If exceeded, the AI will notify you to wait a few seconds.
• AI Credits & Plans: Using the AI assistant for "AI Site Building" (sites_create in brief mode) uses your account's AI credits and daily site-building limits. Free plan limits (page count, visible modules) apply (see ).
• Multi-User/Tool Protection: If you edit a page in the dashboard while the AI is editing the same page, the system will block the second write and request a refresh to prevent overwriting. We recommend dividing tasks between human and AI.
• Handling Visitor Data: Form responses, contact info, and order notes are marked as "Untrusted visitor data" in tool descriptions. The AI should treat these as data, not instructions. Keep keys at "Edit Content" or "View Only" when letting AI read external visitor messages.
• Beta Status: MCP tools and REST API are in Beta. If a tool is deprecated, the tool description will suggest alternatives (the AI will automatically switch). Announcements are posted in the API Changelog. See for policies.

Related Documents