{"name":"com.tuskcms/mcp","slug":"tuskcms-mcp","title":null,"description":"Client editing for sites you built: register, scan, publish, go live, invite the client.","url":"https://mcp.market/server/tuskcms-mcp","rating":null,"grade":"C","score":58,"certified":false,"status":"active","category":"security","tags":["security"],"presence":{"score":3,"stars":null,"forks":null,"downloads_week":null,"last_push_at":null,"license":"UNLICENSED"},"uptime":null,"claimed":false,"transport":"npm","callable_via_gateway":false,"default_price_micros":0,"repository":"https://github.com/emiledelarey/oryx-portal","website":"https://tuskcms.com","version":"0.3.1","remotes":[],"packages":[{"registryType":"npm","registryBaseUrl":"https://registry.npmjs.org","identifier":"@tuskcms/mcp","version":"0.3.1","runtimeHint":"npx","transport":{"type":"stdio"},"environmentVariables":[{"description":"Optional. A Tusk access token (tusk_pat_…). Leave unset and run `npx @tuskcms/mcp login --site <slug> --scopes scan,fields,content,publish,deploy,invite` once instead; the token is then saved on this machine.","format":"string","isSecret":true,"name":"TUSK_PAT"},{"description":"Optional. The Tusk server, default https://tuskcms.com.","format":"string","default":"https://tuskcms.com","name":"TUSK_URL"}]}],"tools":[{"name":"create_site","description":"Create a new site in this studio. `name` is required; `domain` (the live hostname) and `previewUrl` (an https address Tusk can reach to scan and preview) are strongly recommended so the site is connectable straight away. `deployHook` (an https deploy hook, or a vercel://token@team/project URL) lets a publish rebuild the host. Returns the new site and its slug. May return a 402 if the studio is ove","write_action":true,"price_micros":0,"input_schema":null},{"name":"create_token","description":"Mint a new personal access token for this studio and return it once. Use it to provision another headless client (a CI job, a second machine). The plaintext is shown only in this result; store it immediately. Pass `site` to bind the new token to a single site (least privilege — it can act on that site and no other) and `scopes` to record the capabilities it needs. Omit both for a studio-wide token","write_action":true,"price_micros":0,"input_schema":null},{"name":"deploy_status","description":"Check where the host's rebuild stands after a publish (queued/building/ready/error). Pass the deployment `id` from a publish result when you have it; otherwise the newest production deployment is checked. Only this tool ever reports a deploy as actually live.","write_action":true,"price_micros":0,"input_schema":null},{"name":"get_connect_guide","description":"Fetch the public Tusk integration guide (the data-tusk marking grammar, how scanning works, how to pull and apply a snapshot). Read this once before marking up or scanning a site so you use the right conventions. Needs no token.","write_action":false,"price_micros":0,"input_schema":null},{"name":"get_instruction","description":"A ready-to-follow instruction, tailored to THIS site, for wiring its build to Tusk (the build token, the pull command, how to apply the snapshot). Use get_connect_guide instead for the general grammar before a site exists.","write_action":false,"price_micros":0,"input_schema":null},{"name":"get_schema","description":"The site's editable schema: every page and the fields on it (id, label, kind, and the CSS bind that locates each field in the page HTML). This is what the editor edits and what `@tuskcms/sdk` applies at build time. Read it after a scan to see what became editable.","write_action":false,"price_micros":0,"input_schema":null},{"name":"get_setup","description":"The connection checklist for a site: is it reachable, does it have editable fields, a deploy hook, a client seat, and has it ever been published — plus the next step to do. Use it to decide what to do next when connecting a site.","write_action":false,"price_micros":0,"input_schema":null},{"name":"get_site","description":"Full detail for one site: its pages (with editable fields), clients, project record, files, invoices and recent events. Use it to inspect a site before scanning or publishing.","write_action":false,"price_micros":0,"input_schema":null},{"name":"invite_client","description":"Invite the site owner (the client) to edit one site. Tusk emails them a link; they choose a password and land in the editor for that site only, seeing just the fields marked editable. Call it last, after publish and deploy_status confirm the site goes live. Needs the `invite` capability on a scoped token. Never invite an address the developer has not given you.","write_action":false,"price_micros":0,"input_schema":null},{"name":"list_sites","description":"List every site in this studio with its slug, domain, preview URL, page count, clients, and last publish/deploy status. Use the returned `slug` as the identifier for every other site tool. (Backed by the studio overview, which also reports the studio plan and site allowance.)","write_action":false,"price_micros":0,"input_schema":null},{"name":"list_tokens","description":"List this studio's Tusk access tokens (label, masked preview, last used, created). Secrets are never returned. Use it to audit which tokens exist before revoking one.","write_action":false,"price_micros":0,"input_schema":null},{"name":"publish","description":"Publish a site: flip its pages' draft content to live, write the snapshot the build reads, and (in hook mode) ping the deploy hook to rebuild the host. Omit `pages` to publish every page with unpublished changes, or pass specific page keys. `note` is an optional short publish note. Read the returned `status` (published, deploy_requested, deploy_failed, no_hook, feed) then poll deploy_status for th","write_action":true,"price_micros":0,"input_schema":null},{"name":"revoke_token","description":"Revoke one of this studio's access tokens by its id (from list_tokens). Revocation takes effect immediately. Do not revoke the token this server is currently using unless you mean to disconnect it.","write_action":false,"price_micros":0,"input_schema":null},{"name":"rotate_build_token","description":"","write_action":false,"price_micros":0,"input_schema":null},{"name":"save_fields","description":"Set the editable fields for a site by hand, or keep a chosen subset after a scan. `pages` is an array of { key, title?, url?, remove?, fields:[{ id, label, kind, bind?, auto? }] }; kinds are text, textarea, html, photos, file, files, list. Prefer scan_site to discover fields; use this to curate or define them precisely.","write_action":false,"price_micros":0,"input_schema":null},{"name":"scan_site","description":"Scan one or more live page URLs to discover editable content and write it into the site's schema. Pass the page addresses in `urls`. `auto` controls whether unmarked elements are read: leave it unset to read unmarked elements only on pages with no data-tusk marks at all, true to always read unmarked elements, false to only honour explicit data-tusk marks. Returns the fields found per page and what","write_action":false,"price_micros":0,"input_schema":null},{"name":"set_deploy","description":"Record how a publish reaches the live site, after YOU have wired it in the developer's OWN host. Tusk never touches the host itself and never stores host credentials: it only remembers the deploy hook URL so a future client Publish can trigger a rebuild. Typical flow for a git-linked host: in the host (e.g. Cloudflare Pages → Settings → Deploy Hooks) create a deploy hook, ensure the build runs `tu","write_action":true,"price_micros":0,"input_schema":null},{"name":"whoami","description":"Return the studio user this access token belongs to, and the sites it can see. Call this first to confirm the token works and which studio you are acting as.","write_action":false,"price_micros":0,"input_schema":null}],"scan":{"score":58,"grade":"C","scanned_at":"2026-09-19T19:53:57.916Z","report":{"scannerVersion":"0.1.5","scannedAt":"2026-09-19T19:53:57.907Z","components":{"code":{"score":25,"max":25,"notes":["8 source files scanned"]},"reliability":{"score":-1,"max":20,"notes":["no gateway calls yet and no remote to probe"]},"poisoning":{"score":-1,"max":15,"notes":["tools not inspected (local package is not executed); not counted"]},"auth":{"score":6,"max":15,"notes":["static API keys via environment variables"]},"maintenance":{"score":3,"max":15,"notes":["repository not readable: repo not found"]},"identity":{"score":4,"max":10,"notes":["verified namespace with website, no repo"]}},"findings":[],"inputs":{"packages":[{"registryType":"npm","identifier":"@tuskcms/mcp","version":"0.3.1","found":true,"license":"UNLICENSED","hasInstallScripts":false,"dependencyCount":2,"publishedAt":"2026-09-14T22:09:16.303Z","repositoryUrl":"git+https://github.com/emiledelarey/oryx-portal.git"}],"repo":{"found":false,"owner":"emiledelarey","repo":"oryx-portal","error":"repo not found"},"icon":{"url":"https://tuskcms.com/favicon.ico","source":"registry","width":256,"height":256},"presence":{"stars":null,"forks":null,"downloadsWeek":null,"license":"UNLICENSED","lastPushAt":null,"score":3}}}},"grade_history":[],"reviews":[]}