# What to Look for When Evaluating a CMS MCP: Permissions, Approval, and Traceability > Six questions for evaluating any CMS MCP server: permissions, approval, traceability, and deployment. How Griddo answers them today. **URL:** https://griddo.io/en/journal/evaluating-cms-mcp/ **Language:** English **Published:** 2026-11-05 **Updated:** 2026-11-09 **Author:** Daniel Serrano **Tags:** ai, cms, security --- ## Key Takeaways - **MCP has already reached the CMS:** several vendors have shipped one or offer it in beta; connecting an AI agent to the CMS is becoming a university decision. - **Six questions organize it:** permissions, approval, draft, reversibility, traceability, and deployment — what makes the difference is how what the agent reads and writes gets governed. - **The standard already sets the bar:** the MCP specification and OWASP require a human who can deny, least privilege, and a log of every invocation. - **Our position at Griddo:** the agent prepares, and a person validates. --- ## MCP Has Already Reached the CMS On October 7, 2026, [Strapi declared its MCP server generally available](https://strapi.io/blog/agentic-content-management-headless-cms-architecture). [Umbraco has an editor MCP in public beta](https://umbraco.com/blog/umbraco-product-update-q3-2026/) and expects the final release in early November. [Hygraph offers its own in early access](https://hygraph.com/blog/mcp-server). And [WordPress.com announced in March](https://wordpress.com/blog/2026/03/20/ai-agent-manage-content/) that an AI agent can already create, edit, and manage content on its sites. Optimizely, Sanity, and Contentstack also document their own servers. Having an MCP in the CMS is still recent. The questions worth asking before connecting an agent are being written right now. If you run digital transformation or technology for a university, here are six, valid for any vendor. Including us. ### What an MCP Is MCP (Model Context Protocol) is an open standard for connecting AI applications to external systems. Anthropic introduced it in November 2024. In December 2025, [it donated it to the Agentic AI Foundation](https://www.anthropic.com/news/donating-the-model-context-protocol-and-establishing-of-the-agentic-ai-foundation), a fund run by the Linux Foundation. In a CMS, the MCP server gives the agent concrete actions. Umbraco, for example, exposes the day-to-day editorial ones: search, create, update, and publish. At Griddo, we believe MCP opens up the other half of the conversation. Until now we talked about agents that read a university's website. Now we're talking about agents that work inside the CMS. That's where we see the value: analyzing and auditing content, cross-referencing it with results, batch tasks like translations, and preparing drafts. That's exactly why it matters so much who validates what the agent does. For context, we cover it in [why a centralized platform is key in the AI era](/en/journal/centralized-platform-ai-era/) and, from the reading side, in [Open Knowledge Format, the standard AI reads](/en/journal/open-knowledge-format-machine-experience/). ## Six Questions for Any Vendor #### Six questions for any vendor 1. **Permissions.** What identity and what role does the agent act with? 2. **Approval.** Who can deny an action before it happens? 3. **Draft.** Does what the agent creates start as a draft? Who publishes it? 4. **Reversibility.** How do you undo an agent's mistake? 5. **Traceability.** What gets logged, and through which channel? 6. **Deployment.** What needs installing, who administers it, and what does it cover? Anyone on the team can ask these, and all of them get checked in a demo. ## What the Standard and the Vendors Answer What follows is what each vendor documents about its own product, as an example answer to each question. ### 1. Permissions: Who Acts, and With What Role [The MCP specification](https://modelcontextprotocol.io/specification/2026-07-28/server/tools) requires servers to have proper access controls. [OWASP](https://cheatsheetseries.owasp.org/cheatsheets/MCP_Security_Cheat_Sheet.html) gets specific: least privilege per server and per tool. And it names the underlying risk, the *confused deputy*: a server that acts with its own privileges, often broad ones, instead of the person's. Several vendors explain how they handle this. [Optimizely](https://docs.optimizely.com/cms-saas/docs/mcp-server-overview) says its server uses your account's credentials and sees the same thing you see in its interface. Umbraco says editors carry their backoffice permissions with them, so an agent can never do more than that person can. WordPress.com says writes respect the same role permissions as the rest of the platform. On Hygraph, operations depend on the access token's permissions. **Ask to be shown** what identity the agent enters with, and what changes when that person loses a permission. ### 2. Approval: Who Can Deny The specification is clear: for security, there should always be a human capable of denying a tool invocation. It also recommends requesting confirmation for sensitive operations. OWASP calls for explicit confirmation on destructive, financial, or data-sharing operations, and never auto-approving a call. WordPress.com states that every change requires your approval and that every operation has its own switch in settings. Storyblok separates reading, modifying, and destroying into distinct modes, and requires explicit intent for anything destructive. [Hygraph](https://hygraph.com/docs/hygraph-ai/mcp-server) keeps deleting and unpublishing out of the MCP entirely. **Ask to be shown** where approval actually lives. The specification delegates that confirmation to the client — the assistant the person uses. Ask what the CMS itself controls on top of that. ### 3. Draft by Default WordPress.com says new posts and pages start as drafts. Strapi proposes that the agent write in draft, with a person opening and saving it before publishing. With draft-by-default, the final word stays inside the editorial workflow your team already knows. **Ask to be shown** what state the agent's output lands in, and who takes the step of publishing it. ### 4. Reversibility Strapi frames it this way: with agents that publish, the CMS also has to change in how it recovers from mistakes made at machine speed. WordPress.com sends deleted items to trash, recoverable for 30 days. Strapi explains on its blog that its content history doesn't capture API writes, including those from the MCP. Because of that, it says, an entry published by an agent is harder to revert, and reversibility deserves extra weight when evaluating. **Ask to be shown** whether the agent's writes enter version history, and how long you can recover what was deleted. ### 5. Traceability: What Gets Logged OWASP recommends logging every tool invocation with its full parameters, the person's context, and the timestamp. The specification recommends logging tool use for audit purposes. WordPress.com says every change shows up in its Activity Log. At Strapi, the audit log (Enterprise, from version 5.52.0 onward) indicates whether an action came from the MCP or the admin panel. Read-only operations aren't logged. **Ask to be shown** an actual log. It should answer who, what, when, and through which channel. And ask whether reads get logged too. ### 6. Deployment: What Gets Installed, and Who Administers It Optimizely offers a hosted server. It distinguishes two audiences: developers in AI-powered editors, and technical marketing and editorial profiles who query the CMS in natural language for reports and audits. Umbraco hosts its editor MCP on Umbraco Cloud. Every connected tool also adds weight. [Anthropic documents](https://www.anthropic.com/engineering/code-execution-with-mcp) that tool definitions take up context window, and that the agent gets slower and more expensive as the number of connected tools grows. We think that's the sector's next challenge: combining several MCPs in the same agent while keeping control. **Ask to be shown** who installs and activates the server, what tools it exposes, and whether you can limit them. ## Limits Worth Knowing **Security.** OWASP lists risks specific to MCP: malicious instructions hidden in tools (*tool poisoning*) and servers that change their tools after approval (*rug pull*). The specification asks that a tool's annotations — like "read-only" — be treated as untrusted unless they come from a trusted server. Who you connect to matters as much as what you connect. **Maturity.** Part of the market is in beta or early access. [The Bounteous agency](https://www.bounteous.com/insights/2026/08/17/mcp-servers-and-ai-agents-adobe-experience-manager-cloud-service/), after testing with Adobe Experience Manager, concludes the work is still early. Everything we cite from vendors are capabilities they themselves declare. **Scope.** [Dan Drapeau, writing in CMS Critic](https://cmscritic.com/where-native-dxp-ai-fits-within-an-agentic-enterprise-strategy), notes that MCP support can live in one specific product and not across the whole suite. That's why, he says, evaluating an offering means understanding exactly where that support sits and what it actually covers. **Content quality.** An agent works with what it finds. Nazanin Ramezani, VP of Product at Optimizely, said at Opticon that creating source content and managing the central repository is increasingly the hardest part of the job. According to [CMSWire](https://www.cmswire.com/digital-experience/what-happens-when-ai-agents-inherit-your-messy-content-repository/), content quality becomes the scarce asset. Bounteous agrees: AI makes content architecture more valuable. We develop this in [The Raw Material of AI](/en/journal/information-architecture-ai-visibility/). ## How Griddo Answers Today Our position is simple: the agent prepares, and a person validates. MCP is an open standard, and at Griddo we've adopted it by publishing our own servers. **Status as of this article:** - **Griddo AX Docs:** available since the Rooted Redwood release, September 2026. - **Griddo DXP MCP:** rolling out in November 2026. The only pending step is AWS approval of a required service for Griddo SSO, which will add stronger security, simpler management, and an easier user experience. ### Griddo AX Docs: Griddo's Documentation, Inside Your Assistant Lets assistants like Claude, ChatGPT, Copilot, or Cursor query Griddo's documentation in real time, in Spanish and English. It's read-only: it searches and reads public documentation pages, with no access to account data or editorial content. It's built for people who work with Griddo daily — in marketing, admissions, and communications. Setting it up means adding a URL to the assistant's settings. ### Griddo DXP MCP: Your Institution's Content This is a second connector, distinct from AX Docs, for reading and managing each institution's own editorial content. It answers two of the six questions: - **Permissions.** It respects Griddo's RBAC: the agent only sees what the authenticated person sees. - **Deployment.** It authorizes with OAuth 2.1 and PKCE. ### What the Person Validates, and Where For us, the person validates what gets published, and does it inside Griddo. For approval, draft, reversibility, and traceability, here's what the platform offers today to people's editorial work: - **Traceability.** Every action (edit, publish, image upload, module configuration, SEO change) lands in an immutable audit log, attributed to a person, a site, a content type, and a timestamp. - **Permissions.** Six predefined roles (Super Admin, Administrator, Viewer, Webmaster, Editor, and SEO Validator) and granular control by content type, field, workflow stage, language, and API token scope. - **Approval and draft.** You can configure a writer to only create drafts and require approval to publish. - **Reversibility.** Rollback-capable versioning and multi-level editorial workflows. We go deeper on roles and auditing in [Web Portal Governance: Granular RBAC and Native Auditing](/en/journal/web-portals-governance-rbac-university-cio/). When the DXP MCP arrives, ask it the same six questions. It's what we expect you to ask any vendor — starting with us. ## Bring the Six Questions to Your Next Meeting MCP in the CMS is recent and moving fast. Permissions, approval, draft, reversibility, traceability, and deployment: with those six answers in writing, your university decides with judgment which agent to connect, and with what control. We're tracking how this evolves and covering it in our newsletter. **Subscribe to Beyond The Grid.** ## Sources [Strapi: agentic content management](https://strapi.io/blog/agentic-content-management-headless-cms-architecture) | [Umbraco: Q3 2026 product update](https://umbraco.com/blog/umbraco-product-update-q3-2026/) | [Hygraph: MCP server](https://hygraph.com/blog/mcp-server) | [WordPress.com: AI agent manage content](https://wordpress.com/blog/2026/03/20/ai-agent-manage-content/) | [Anthropic: donating MCP to the Agentic AI Foundation](https://www.anthropic.com/news/donating-the-model-context-protocol-and-establishing-of-the-agentic-ai-foundation) | [MCP specification](https://modelcontextprotocol.io/specification/2026-07-28/server/tools) | [OWASP: MCP Security Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/MCP_Security_Cheat_Sheet.html) | [Optimizely: MCP server overview](https://docs.optimizely.com/cms-saas/docs/mcp-server-overview) | [Hygraph: MCP docs](https://hygraph.com/docs/hygraph-ai/mcp-server) | [Anthropic: code execution with MCP](https://www.anthropic.com/engineering/code-execution-with-mcp) | [Bounteous: MCP servers and AI agents](https://www.bounteous.com/insights/2026/08/17/mcp-servers-and-ai-agents-adobe-experience-manager-cloud-service/) | [CMS Critic: native DXP AI in an agentic enterprise strategy](https://cmscritic.com/where-native-dxp-ai-fits-within-an-agentic-enterprise-strategy) | [CMSWire: AI agents inherit your messy content repository](https://www.cmswire.com/digital-experience/what-happens-when-ai-agents-inherit-your-messy-content-repository/) --- *Generated from [What to Look for When Evaluating a CMS MCP: Permissions, Approval, and Traceability](https://griddo.io/en/journal/evaluating-cms-mcp/)*