MCP server for Cure Kode CDN - enables AI agents to manage, deploy, and analyze Webflow scripts
npm install @curenorway/kode-mcpMCP (Model Context Protocol) server that enables AI agents to manage Webflow scripts via Cure Kode CDN.
- Script Management - List, create, update, and delete scripts
- Deployment Control - Deploy to staging, promote to production, rollback
- Page Context - Cache and retrieve page structures for development
- Script Analysis - Auto-analyze scripts for metadata (selectors, triggers, dependencies)
- Production Safety - Explicit enable required, confirmation for promote
The easiest way is to run kode init in your project, which creates .mcp.json:
``json`
{
"mcpServers": {
"cure-kode": {
"type": "stdio",
"command": "npx",
"args": ["-y", "@curenorway/kode-mcp"]
}
}
}
Then restart Claude Code and approve the MCP when prompted.
Add to your Claude Code configuration (~/.claude/claude_code_config.json):
`json`
{
"mcpServers": {
"cure-kode": {
"command": "npx",
"args": ["-y", "@curenorway/kode-mcp"]
}
}
}
The MCP server reads configuration from .cure-kode/config.json (created by kode init):
`json`
{
"siteId": "your-site-uuid",
"siteSlug": "my-site",
"siteName": "My Site",
"apiKey": "ck_...",
"scriptsDir": ".cure-kode-scripts",
"environment": "staging"
}
Or via environment variables:
`bash`
export CURE_KODE_API_KEY="ck_..."
export CURE_KODE_SITE_ID="your-site-uuid"
| Tool | Description |
|------|-------------|
| kode_list_scripts | List all scripts for the site |kode_get_script
| | Get script by slug (supports includeContent: false for metadata only) |kode_create_script
| | Create a new script entry (metadata only, no content) |kode_update_script
| | Update script settings (autoLoad, scope, purpose) |kode_delete_script
| | Delete a script |kode_push
| | Upload local files from .cure-kode-scripts/ to server |
| Tool | Description |
|------|-------------|
| kode_deploy | Deploy to staging |kode_promote
| | Promote staging to production (requires confirmed: true) |kode_rollback
| | Rollback to previous deployment |kode_status
| | Get deployment status |
| Tool | Description |
|------|-------------|
| kode_production_enable | Enable production environment |kode_production_disable
| | Disable production environment |
| Tool | Description |
|------|-------------|
| kode_fetch_html | Fetch and parse HTML from URL |kode_fetch_html_smart
| | Fetch with CMS truncation for smaller context |kode_list_pages
| | List page definitions for the site |kode_assign_script_to_page
| | Assign script to specific pages |kode_remove_script_from_page
| | Remove script from page |
| Tool | Description |
|------|-------------|
| kode_refresh_page | Fetch and cache page structure |kode_get_page_context
| | Get cached page context (sections, forms, CTAs, selectors) |kode_list_pages_context
| | List all cached page contexts |
| Tool | Description |
|------|-------------|
| kode_analyze_script | Analyze script and generate metadata |kode_get_script_metadata
| | Get script metadata and AI summary |
| Tool | Description |
|------|-------------|
| kode_sync_documentation | Update .cure-kode/KODE.md with current scripts/pages |
| Tool | Description |
|------|-------------|
| kode_site_info | Get site info and CDN URL |kode_read_context
| | Read AI context file |kode_update_context
| | Update AI context file |
MCP is the control plane - never send script content through MCP tools.
The correct workflow:
1. Write script file locally to .cure-kode-scripts/script-name.jskode_push
2. Use to upload local files to serverkode_deploy
3. Use to deploy
``
AI writes file → kode_push → kode_deploy
Do NOT pass content to kode_create_script or kode_update_script - these only handle metadata.
kode_promote requires explicit confirmation to prevent accidental production deployments:
`typescript
// This will fail:
kode_promote()
// This works:
kode_promote({ confirmed: true })
`
New sites start with production disabled. Must explicitly enable:
`typescript`
kode_production_enable()
// Then can promote
kode_promote({ confirmed: true })
`
1. "Create a new script called tracking.js"
→ kode_create_script({ name: "tracking", slug: "tracking", type: "javascript" })
2. Write the file locally
→ Write to .cure-kode-scripts/tracking.js
3. "Push the changes"
→ kode_push()
4. "Deploy to staging"
→ kode_deploy()
5. "Promote to production"
→ kode_promote({ confirmed: true })
`
`
1. "Analyze the homepage"
→ kode_fetch_html_smart({ url: "https://mysite.com" })
→ kode_refresh_page({ url: "https://mysite.com" })
2. "What sections are on this page?"
→ kode_get_page_context({ url: "https://mysite.com" })
3. "Add a script to animate the hero section"
→ Create script, write file, push, deploy
`
``
┌─────────────────┐ ┌─────────────────┐ ┌─────────────────┐
│ AI Agent │ MCP │ Kode MCP │ REST │ Cure Kode API │
│ (Claude/etc) │─────▶│ Server │─────▶│ (app.cure.no) │
└─────────────────┘ └─────────────────┘ └─────────────────┘
│
▼
┌─────────────────┐
│ Local Scripts │
│(.cure-kode-scripts/)│
└─────────────────┘
- Hashed Storage: API keys are SHA256/HMAC hashed before server storage
- Site-scoped: Each API key is bound to a specific CDN site
- Permission-based: Granular permissions (read, write, deploy, delete)
- Expiration: Keys can have optional expiration dates
Script endpoints restrict CORS to configured domains:
- Site's domain, staging_domain, production_domain
- Webflow preview domains (*.webflow.io)
- Localhost for development
- No wildcard CORS on script endpoints
HTML fetch endpoints block:
- Private IP ranges (127.0.0.0/8, 10.0.0.0/8, etc.)
- Cloud metadata endpoints (169.254.169.254)
- Internal hostnames
Run kode init in your project directory to create configuration.
- Check key starts with ck_
- Verify key hasn't expired
- Ensure key has required permissions
Use kode_production_enable() before promoting.
Add confirmed: true parameter:`typescript`
kode_promote({ confirmed: true })
1. Restart Claude Code after config changes
2. Check .mcp.json syntaxnpx @curenorway/kode-mcp`
3. Verify MCP server runs:
- Node.js 18 or later
- Cure Kode API key (from https://app.cure.no/tools/kode)
MIT