PoC: comet mcp server

[manuelblum]

Summary

• Adds a new mcp-server/ package — a Model Context Protocol (MCP) server that exposes parts of the Comet DXP API as tools and
  resources for AI agents (Claude Code, Cursor, etc.)
• The server connects to the API via GraphQL and provides 11 tools and 2 resources for managing pages, page tree
  nodes, and DAM files
• Fully integrated into the monorepo: install script, dev-pm, linting, lint-staged, cspell, prettier, and
  setup-project-files all include the new package

Tools

Tool	Description
list_page_tree_nodes	List all page tree nodes in a scope, with optional category/documentType filters
get_page_tree_node	Get a single page tree node by ID
get_page_tree_node_by_path	Look up a page tree node by its URL path
get_page	Get page content (blocks, SEO, stage) by document ID
check_slug_availability	Check if a slug is available under a given parent
create_page_tree_node	Create a new page tree node (Page or Link)
update_page_tree_node	Update name, slug, or other properties of a page tree node
update_page_tree_node_visibility	Publish, unpublish, or archive a page tree node
save_page	Save page content with full block structure (content, SEO, stage)
list_dam_files	List/search DAM files with filtering by mimetype, folder, and search text
get_dam_file	Get a single DAM file by ID
delete_page_tree_node	Delete a page tree node

Resources

Resource	URI	Description
block-types	comet://block-types	Lightweight TypeScript interfaces for all CMS block types (~450 lines) —
preferred for constructing save_page inputs
block-meta	comet://block-meta	Full block schema metadata with field definitions, types, enums, and nesting
(~3000 lines) — for detailed field-level metadata

Tech Stack

• @modelcontextprotocol/sdk for the MCP server (stdio transport)
• graphql-request for API communication
• zod for input validation
• tsup for bundling
• @graphql-codegen for typed GraphQL operations
• Block types generated via @comet/cli

Showcase

note: Video Speed 2.5 x and split on some parts

TODOs

• Authentication: Currently uses system user with basic auth (system-user). Needs to be
  replaced with proper user-based authentication so actions are scoped and auditable.
• Authorization / Scoping: All requests run with full system-user privileges. Needs per-user permission checks.