Ghost MCP Server

Community

An MCP server for managing Ghost CMS through LLM interfaces

How to install ↓ Compare GitHub source repository ↗

Category: Other #124 of 230
Stars: ★ 236 Popular
Transport: stdio (local process)
Runtime: Node.js
Credentials: API key / credential required
License: MIT
Last commit: 6 months ago ⚠
Tools: 42

53FMRS · D

Ghost MCP Server is a third-party MCP server that gives LLM clients such as Claude broad access to Ghost CMS through the Ghost Admin API and JWT authentication. It covers posts, members, newsletters, offers, tiers, tags, users, roles, invites, and webhooks, with custom error handling and logging. It suits users who want to manage a Ghost blog in natural language, but it requires an Admin API key and carries risks of data loss from mistakes or key exposure.

Strongest · Setup experience 12/20 Weakest · Security and permissions 9/20

Reliability

11/20

Security and permissions

9/20

Maintenance

10/20

Documentation

11/20

Setup experience

12/20

Why each score

Reliability 11/20: Per the README: this is a JWT-authenticated MCP server built on @tryghost/admin-api, exposing browse/read/add/edit/delete tools across posts, members, newsletters, offers, invites, roles, tags, tiers, users, and webhooks, with a custom GhostError type and MCP-context logging. The happy path looks plausible: npx launch, env-based credentials, and tool semantics that map to normal Ghost Admin API operations. Under the static calibration, however, the repository supplies no verifiable execution evidence: no CI workflows, no committed tests, no cached manifest, and no reproducible startup or call output in the README. Whether the advertised 'comprehensive' tool set (~40 operations) matches src/tools/ cannot be verified, and for destructive tools (delete across posts/members/newsletters/offers/invites/tags/tiers/users/webhooks) there is no stated confirmation, idempotency, or retry-on-failure behavior; error paths are covered only by a one-line GhostError mention. Dependency pinning, API version compatibility, rate limiting, and pagination boundaries are all undocumented. Given a credible happy path but missing CI/tests and edge-case handling, reliability lands mid-low and below 12.
Security and permissions 9/20: Per the README: Ghost Admin API credentials arrive via GHOST_ADMIN_API_KEY in the MCP client's env block, and no real token appears in the documented example (all values are placeholders, which satisfies the rule). It uses Ghost's official @tryghost/admin-api with JWT, a conventional and auditable credential path, and no malware, credential theft, covert exfiltration, or fabricated identity was found, so the 0-4 red-line band is not triggered. Deductions are nonetheless clear: an Admin API key is a high-privilege credential, and the tool set includes delete operations on posts, members, users, webhooks, and invites, yet the README says nothing about pre-delete confirmation, least privilege, permission scoping, or warning on destructive actions. The webhooks tools produce outbound side effects to external services with no data-flow disclosure. Access to the user's own Ghost instance is necessary, but there is no guidance on credential storage, log redaction, or key rotation. With least-privilege and dangerous-operation confirmation absent, this sits mid-low.
Maintenance 10/20: Per the README and repository metadata: MIT licensed, 229 stars, 8 open issues, not archived, indicating continued attention and a clear license, which is positive evidence; the README also documents a contribution flow (fork, branch, commit, PR), suggesting basic collaboration norms. Key maintenance evidence is missing though: no Releases or version history, no CHANGELOG, no dependency-update automation (Dependabot/Renovate) described, no security-response channel (SECURITY.md) or vulnerability reporting process, and no issue-response timeliness data; 8 open issues hint at backlog but reveal nothing about response quality. Versioning is only implicit in the npm package name @fanyangmeng/ghost-mcp, with no stated versioning policy. This is the 'active but with governance/versioning gaps' middle state, hence 10.
Documentation 11/20: Per the README: strengths include a clear structure covering the feature overview, a Claude Desktop config example with GHOST_API_URL, GHOST_ADMIN_API_KEY, and GHOST_API_VERSION, a resource inventory, per-resource tool lists, plus error handling and license sections; tool naming and purpose are easy to follow, and cost is naturally minimal (self-hosted, no third-party metering). Deductions are substantial: tool parameter schemas are not documented at all, deferred to 'see src/tools/ source', which leaves hidden assumptions for users; there is no guidance on obtaining an API key or the required permission scope; pagination, rate limits, and how fuzzy vs. exact matching is triggered are unspecified; there is no troubleshooting section, no version compatibility matrix (what to put in GHOST_API_VERSION), and no known-limitations or risk disclosure; whether deleted entities are recoverable is unstated. That is 'usable but with hidden assumptions and troubleshooting gaps', hence 11.
Setup experience 12/20: Per the README: the install path is explicit, adding npx -y @fanyangmeng/ghost-mcp with three environment variables to claude_desktop_config.json, a ready-made config example for a mainstream client (Claude Desktop), so in principle this is a short setup; cross-platform is via npx/Node, and while no Node version is declared the path itself is generic. Deductions: prerequisites are missing (Node/npm versions, Ghost version and API key generation, where to obtain an Admin API key), the meaning and format of environment variables (e.g., GHOST_API_VERSION = v5.0) are unexplained, and there are no failure-troubleshooting or verification steps; clients other than Claude Desktop are not covered, and there is no Docker or local-source run instruction. Under the static calibration setup is capped at 15, and with missing prerequisites and verification steps it lands at 12.

Static review · not runListed 2026-09-10

Read the FMRS scoring method →

Fit and risk

What it can accessUses the networkChanges third-party account data

Best for

Content operators using Ghost CMS who want to manage a blog through an LLM interface.
Developers or administrators who need to manage Ghost entities from MCP clients such as Claude Desktop.

Not for

Users who do not use Ghost CMS.
Users who cannot provide a Ghost Admin API key or access to a Ghost site.

Required permissions

Requires a Ghost Admin API key (GHOST_ADMIN_API_KEY) to access the Ghost Admin API.
Requires a Ghost site URL (GHOST_API_URL) and optionally an API version (GHOST_API_VERSION).

Risks and side effects

The server can create, edit, and delete entities such as posts, members, and newsletters, so mistakes may cause content or member data loss.
An Admin API key grants administrative access to the Ghost site; exposure or misuse may lead to unauthorized access.
The key is supplied as a plaintext environment variable in the client configuration, so the local config file must be protected.

Setup

Before you start

Runtime：Node.js

GHOST_API_URL required Your Ghost site URL (e.g. https://yourblog.com), visible in your Ghost admin URL settings.

GHOST_ADMIN_API_KEY requiredsecret Ghost Admin API key, obtained by creating a custom integration under Settings → Integrations in Ghost admin.

GHOST_API_VERSION required Ghost Admin API version; the README example uses v5.0.

Add the following to Claude Desktop's claude_desktop_config.json: under mcpServers, add ghost-mcp with command npx, args ["-y", "@fanyangmeng/ghost-mcp"], and env values for GHOST_API_URL, GHOST_ADMIN_API_KEY, and GHOST_API_VERSION.

claude_desktop_config.json

{"mcpServers":{"ghost-mcp":{"command":"npx","args":["-y","@fanyangmeng/ghost-mcp"],"env":{"GHOST_API_URL":"https://yourblog.com","GHOST_ADMIN_API_KEY":"your_admin_api_key","GHOST_API_VERSION":"v5.0"}}}}

Shown for Claude Desktop. Other clients may use a different file or key (VS Code uses "servers") — the configurator below converts it.

.vscode/mcp.json

{
  "servers": {
    "ghost-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "@fanyangmeng/ghost-mcp"
      ],
      "env": {
        "GHOST_API_URL": "https://yourblog.com",
        "GHOST_ADMIN_API_KEY": "your_admin_api_key",
        "GHOST_API_VERSION": "v5.0"
      }
    }
  }
}

Goes in your project's .vscode/mcp.json (VS Code uses a "servers" key).

Terminal

claude mcp add ghost-mcp -e GHOST_API_URL=https://yourblog.com -e GHOST_ADMIN_API_KEY=your_admin_api_key -e GHOST_API_VERSION=v5.0 -- npx -y @fanyangmeng/ghost-mcp

Run it in a terminal; replace any <…> placeholders with your own values first.

Generate and validate client config

Check that it works

After configuration, tools like browse_posts and add_post from ghost-mcp should appear in your client's tool list; ask 'list the posts on my Ghost blog' — a real post list confirms the connection works.

Troubleshooting

Verify that GHOST_API_URL points to the correct Ghost site and includes the protocol.
Verify that GHOST_ADMIN_API_KEY is valid and has the required permissions.
If the API version is incompatible, check whether GHOST_API_VERSION matches the Ghost instance.
Review MCP context logs for more detail and check the descriptive message provided by GhostError.

Things to try

Once connected, you can ask your AI assistant things like:

List the 10 most recent posts on my Ghost blog
Create a new post titled 'Weekly Update' from my draft
Look up the member with email [email protected]
Delete the webhook with ID 5

Tools 42

browse_posts read-only

List posts with optional filters, pagination, and ordering.

read_post read-only

Retrieve a post by ID or slug.

add_post writes

Create a new post with title, content, and status.

edit_post writes

Update an existing post by ID.

delete_post destructive

Remove a post by ID.

browse_members read-only

List members with filters and pagination.

read_member read-only

Retrieve a member by ID or email.

add_member writes

Create a new member.

Show 34 more tools

edit_member writes

Update member details.

delete_member destructive

Remove a member.

browse_newsletters read-only

List newsletters.

read_newsletter read-only

Retrieve a newsletter by ID.

add_newsletter writes

Create a new newsletter.

edit_newsletter writes

Update newsletter details.

delete_newsletter destructive

Remove a newsletter.

browse_offers read-only

List offers.

read_offer read-only

Retrieve an offer by ID.

add_offer writes

Create a new offer.

edit_offer writes

Update offer details.

delete_offer destructive

Remove an offer.

browse_invites read-only

List invites.

add_invite writes

Create a new invite.

delete_invite destructive

Remove an invite.

browse_roles read-only

List roles.

read_role read-only

Retrieve a role by ID.

browse_tags read-only

List tags.

read_tag read-only

Retrieve a tag by ID or slug.

add_tag writes

Create a new tag.

edit_tag writes

Update tag details.

delete_tag destructive

Remove a tag.

browse_tiers read-only

List tiers.

read_tier read-only

Retrieve a tier by ID.

add_tier writes

Create a new tier.

edit_tier writes

Update tier details.

delete_tier destructive

Remove a tier.

browse_users read-only

List users.

read_user read-only

Retrieve a user by ID or slug.

edit_user writes

Update user details.

delete_user destructive

Remove a user.

browse_webhooks read-only

List webhooks.

add_webhook writes

Create a new webhook.

delete_webhook destructive

Remove a webhook.

Use cases

Browse, retrieve, and create Ghost blog posts via natural language through Claude and other LLMs.

Manage Ghost members, newsletters, offers, tiers, and tags.

Inspect users, roles, invites, and webhooks.

Troubleshoot Ghost Admin API calls with MCP context logging.

Supported clients

Claude Desktop

Listed from the project's documentation, not tested by this site.

Overview

Ghost MCP Server is a Model Context Protocol (MCP) server that lets users interact with Ghost CMS through LLM interfaces such as Claude, enabling control of a Ghost blog. It uses the Ghost Admin API with JWT authentication and provides a rich set of MCP tools for entities including posts, users, members, tiers, offers, and newsletters, with fuzzy and exact search options, human-readable output, custom GhostError exception handling, and MCP context logging.

Similar servers

Hevy MCP 77 · B

Manage your Hevy workout data from AI assistants via MCP.

★ 517 · Tools 26 Compare with this →

Firecrawl MCP Server 75 · B

Firecrawl's official MCP server for web search, scraping, and structured extraction for AI agents

★ 7.6k · Tools 11 Compare with this →

BioMCP 75 · B

One binary. One grammar. Evidence from the biomedical sources you already trust.

★ 659 · Tools 11 Compare with this →

Compartment 75 · B

Encrypted, fully offline long-term memory for AI agents

★ 583 · Tools 14 Compare with this →

Compare with other MCP servers

Source revision ba976b63cb3c Data synced 2026-10-19 Read the FMRS scoring method