Webiny's MCP server for exposing Webiny-specific skills and development instructions to Claude, Cursor, Copilot, Windsurf, opencode, and other AI coding agents over stdio.
Webiny MCP is a guidance and skill-loading server; it does not directly manage a Webiny CMS deployment or execute Webiny admin actions., The configure command can update supported agent configuration, so review generated MCP config changes before committing or sharing them., The --skills and --additional-skills flags make the server recursively discover SKILL.md files from local directories; point them only at trusted project guidance., Agent-loaded skills can strongly steer code changes, architecture decisions, and generated commands; review outputs before applying them to production Webiny projects.
Privacy notes
Skill files can contain internal coding conventions, project architecture, extension patterns, package notes, and proprietary implementation guidance., Loaded skill content may be sent to MCP clients, model providers, chat transcripts, and logs when an agent requests it., Custom skill directories can reveal local repository structure and file paths through tool output or error messages., Keep credentials, customer data, private deployment details, and unpublished roadmap notes out of SKILL.md files exposed through the MCP server.
Author
Webiny Ltd
Submitted by
oktofeesh1
Claim status
unclaimed
Last verified
2026-06-06
Decision playbook
Review trust signals before you adopt
Signals are present but mixed. Use the checklist below to confirm the source and operational safety for your environment.
Compare context
Selected
0
Current score
63
Baseline
—
Delta
No baseline selected
No major trust-signal divergence detected in the current selection.
Source and provenance checks
Needs review
Confirm ownership and provenance before trusting install instructions.
Source link availableRequired
Open the canonical repository and verify ownership.
Done
Source provenance statusRequired
Marked as source-backed.
Done
Metadata reviewed
No reviewed flag detected in metadata.
Pending
Safety and privacy checks
Complete
Validate risk disclosures before installation or API wiring.
Safety notes presentRequired
Review the listed safety guidance before running commands.
Done
Privacy notes presentRequired
Review data handling notes before connecting accounts or secrets.
Done
Trust level risk gateRequired
Trust level does not block evaluation.
Done
Package and install checks
Needs review
Check package metadata and artifact integrity signals.
Install payload available
Install or copy payload is available for review.
Done
Package verification flag
No package verification flag provided.
Pending
Checksum metadata
No checksum provided for downloaded artifact.
Pending
Compare-driven decision checks
Needs review
Use compare context to validate trade-offs before adoption.
Compare tray has multiple entries
Add at least one more entry to compare trust differences.
4 safety and 4 privacy notes across 5 risk areas. Review closely: credentials & tokens, permissions & scopes, network access.
5 areas
SafetyPermissions & scopesWebiny MCP is a guidance and skill-loading server; it does not directly manage a Webiny CMS deployment or execute Webiny admin actions.
SafetyExecution & processesThe configure command can update supported agent configuration, so review generated MCP config changes before committing or sharing them.
SafetyLocal filesThe --skills and --additional-skills flags make the server recursively discover SKILL.md files from local directories; point them only at trusted project guidance.
SafetyExecution & processesAgent-loaded skills can strongly steer code changes, architecture decisions, and generated commands; review outputs before applying them to production Webiny projects.
PrivacyLocal filesSkill files can contain internal coding conventions, project architecture, extension patterns, package notes, and proprietary implementation guidance.
PrivacyNetwork accessLoaded skill content may be sent to MCP clients, model providers, chat transcripts, and logs when an agent requests it.
PrivacyLocal filesCustom skill directories can reveal local repository structure and file paths through tool output or error messages.
PrivacyCredentials & tokensKeep credentials, customer data, private deployment details, and unpublished roadmap notes out of SKILL.md files exposed through the MCP server.
Safety notes
Webiny MCP is a guidance and skill-loading server; it does not directly manage a Webiny CMS deployment or execute Webiny admin actions.
The configure command can update supported agent configuration, so review generated MCP config changes before committing or sharing them.
The --skills and --additional-skills flags make the server recursively discover SKILL.md files from local directories; point them only at trusted project guidance.
Agent-loaded skills can strongly steer code changes, architecture decisions, and generated commands; review outputs before applying them to production Webiny projects.
Privacy notes
Skill files can contain internal coding conventions, project architecture, extension patterns, package notes, and proprietary implementation guidance.
Loaded skill content may be sent to MCP clients, model providers, chat transcripts, and logs when an agent requests it.
Custom skill directories can reveal local repository structure and file paths through tool output or error messages.
Keep credentials, customer data, private deployment details, and unpublished roadmap notes out of SKILL.md files exposed through the MCP server.
Prerequisites
Node.js and npx available for running the @webiny/mcp package.
A Webiny project or Webiny-related repository where the agent should use Webiny guidance.
Review of the built-in skills and any custom SKILL.md directories before exposing them to a model.
Agreement on whether project conventions, extension architecture, package internals, or private implementation notes may be sent to the MCP client and model provider.
Webiny MCP Server is the official MCP package from Webiny for exposing Webiny
skills and development guidance to AI coding agents. It runs over stdio and
provides tools for listing available Webiny skills and loading the exact skill
content an agent needs for a task.
Use it when Claude, Cursor, Copilot, Windsurf, opencode, or another agent is
working in a Webiny codebase and needs project-specific guidance before editing
extensions, packages, configuration, or Webiny framework code.
These sources were reviewed on 2026-06-06. Prefer the live repository, MCP
package metadata, npm registry metadata, root license, CLI implementation, MCP
server implementation, agent configuration implementation, agent discovery,
instruction output, and sample MCP config for current behavior.
Features
Run a stdio MCP server with webiny-mcp serve or npx @webiny/mcp serve.
List available Webiny skills with list_webiny_skills.
Load a specific Webiny skill with get_webiny_skill.
Discover built-in package skills plus custom SKILL.md directories.
Override the base skills directory with --skills.
Add higher-priority custom skill directories with repeated
--additional-skills flags.
Configure supported agents with webiny-mcp configure <agent>.
Ask Claude to list available Webiny skills before making a Webiny code change.
Load Webiny extension guidance before editing extensions/ or
webiny.config.tsx.
Load Webiny package guidance before editing core framework packages.
Add a project-local SKILL.md directory for organization-specific Webiny
conventions.
Keep multiple coding agents aligned on the same Webiny development guidance.
Safety and Privacy
Webiny MCP Server exposes instructions rather than executing CMS operations,
but those instructions can still shape large code changes. Review loaded skills
and agent-generated edits before applying them to production Webiny projects.
Only expose trusted SKILL.md directories. Skills may contain private
architecture notes, repository conventions, extension patterns, deployment
assumptions, or proprietary guidance that will be sent to the MCP client and
model provider when requested.
The configure command can write agent-specific configuration. Review those
changes before committing config files or sharing them with a team.
Duplicate Check
No Webiny MCP Server, webiny/webiny-js MCP package, @webiny/mcp, or matching
Webiny MCP source URL was found in content/mcp.
Show that Webiny MCP Server is listed on HeyClaude. Paste this Markdown into your README — it renders the badge and links back to this page.
[](https://heyclau.de/entry/mcp/webiny-mcp-server)
How it compares
Webiny MCP Server side by side with 3 alternatives on trust, install, platform support, and disclosed safety notes — all from reviewed registry metadata.
Webiny's MCP server for exposing Webiny-specific skills and development instructions to Claude, Cursor, Copilot, Windsurf, opencode, and other AI coding agents over stdio.
MCP server that lets Claude install other MCP servers into Claude Desktop by writing MCP config entries for npm packages, uvx packages, or locally cloned Node-based MCP server projects.
✓Webiny MCP is a guidance and skill-loading server; it does not directly manage a Webiny CMS deployment or execute Webiny admin actions.
The configure command can update supported agent configuration, so review generated MCP config changes before committing or sharing them.
The --skills and --additional-skills flags make the server recursively discover SKILL.md files from local directories; point them only at trusted project guidance.
Agent-loaded skills can strongly steer code changes, architecture decisions, and generated commands; review outputs before applying them to production Webiny projects.
✓AI Game Developer can create, move, copy, modify, and delete Unity assets, scenes, GameObjects, components, scripts, packages, and generated project files.
Tools include dynamic C# script execution, C# reflection method lookup and calls, package installation/removal, Unity test execution, editor state changes, play mode control, screenshots, and profiler access.
The MCP server supports streamable HTTP and stdio; HTTP deployments should require a bearer token and stay bound to trusted interfaces.
Server variables include optional authorization and webhook settings; webhook endpoints can receive tool, prompt, resource, connection, and authorization events.
Unity runtime connections can expose compiled game state or in-game behavior to an MCP client, not just editor-only project data.
Use source control, backups, tool filtering, and explicit review before allowing destructive tools such as asset deletion, package removal, script execution, or reflection calls.
✓MCP Installer can write or update Claude Desktop MCP server configuration entries.
The install_repo_mcp_server tool can add npx or uvx based MCP server commands from package names the model supplies.
The install_local_mcp_server tool can run npm install in a local project with a package.json and configure Node to execute discovered package bins or main files.
Environment variables passed to the installer are written into the MCP configuration for the installed server.
Treat this as an administrative helper; review every package, version, local path, arg, and environment value before approving a tool call.
✓Unreal Engine MCP Server can create, import, duplicate, rename, move, delete, and modify project assets, actors, levels, Blueprints, Niagara systems, Sequencer tracks, materials, audio, tests, logs, console variables, and editor state.
The bridge exposes editor automation through native HTTP/SSE or WebSocket transports; keep listeners on loopback unless you intentionally enable and secure LAN access.
Capability-token authentication, TLS, command validation, path sanitization, rate limits, and loopback binding should be reviewed before using remote or multi-user setups.
Require confirmation before running console commands, Python execution, UnrealBuildTool tasks, Play-In-Editor sessions, asset deletion, level saves, plugin changes, imports, exports, or source-control-affecting operations.
Test against disposable projects before allowing an agent to automate production levels, gameplay systems, render settings, or content directories.
Privacy notes
✓Skill files can contain internal coding conventions, project architecture, extension patterns, package notes, and proprietary implementation guidance.
Loaded skill content may be sent to MCP clients, model providers, chat transcripts, and logs when an agent requests it.
Custom skill directories can reveal local repository structure and file paths through tool output or error messages.
Keep credentials, customer data, private deployment details, and unpublished roadmap notes out of SKILL.md files exposed through the MCP server.
✓Tool calls may expose Unity project paths, asset names, scene hierarchy, serialized object data, scripts, logs, screenshots, profiler metrics, test output, package metadata, and runtime state.
MCP config files and Unity plugin config can contain server URLs, connection modes, bearer tokens, authorization settings, enabled tool IDs, and cloud or local endpoint details.
Optional webhooks can receive tool, prompt, resource, connection, authorization, and token-bearing request data.
Screenshots from Game View, Scene View, cameras, or isolated GameObjects may include proprietary artwork, level design, UI, debug overlays, or unreleased game content.
Generated skills and AI-client configuration files can reveal available tools, project structure, installed packages, and local workflow assumptions.
✓MCP configuration files can contain API keys, tokens, local paths, package names, arguments, and environment variables.
The server reads and writes the user's Claude Desktop MCP config and may reveal existing MCP server names or config structure through tool results or logs.
Local project paths can reveal usernames, repository names, client names, or private workspace layout.
Do not ask the installer to write real secrets until you understand where the MCP client stores them and who can read the config file.
✓Project paths, asset names, level contents, screenshots, editor logs, test output, Blueprint graphs, console variables, and generated automation reports can be exposed to the MCP client.
Screenshot and viewport tools may capture unpublished game content, UI, debug overlays, local paths, or proprietary assets.
Native plugin logs, TypeScript bridge logs, metrics endpoints, and MCP transcripts can reveal project names, file-system paths, automation requests, and tool results.
Treat capability tokens, project paths, LAN listener settings, and generated screenshots as sensitive local configuration.
Keep automation output inside approved project or scratch directories and remove temporary artifacts before sharing traces or bug reports.
Prerequisites
Node.js and npx available for running the @webiny/mcp package.
A Webiny project or Webiny-related repository where the agent should use Webiny guidance.
Review of the built-in skills and any custom SKILL.md directories before exposing them to a model.
Agreement on whether project conventions, extension architecture, package internals, or private implementation notes may be sent to the MCP client and model provider.
Unity project using Unity 2022.3 or newer for the current package metadata.
Unity Hub or a local Unity Editor installation.
Node.js 20.19 or newer, or Node.js 22.12 or newer, for `unity-mcp-cli`.
An MCP client such as Claude Code, Claude Desktop, Codex, Cursor, Gemini CLI, GitHub Copilot, Cline, or another supported client.
Claude Desktop or another MCP client that can run stdio Node MCP servers.
Node.js and npx available for npm-hosted MCP servers.
uvx available before installing Python MCP servers through the uvx path.
Package names, local paths, args, and environment variables reviewed before asking Claude to install anything.
Unreal Engine 5.0 through 5.8 with a project that can load the included McpAutomationBridge plugin.
Node.js 18 or newer when using the TypeScript stdio bridge; native MCP transport can run inside the plugin without Node.js.
A code-enabled Unreal project or a prebuilt plugin package that matches the target Unreal Engine version.
Required Unreal plugins such as MCP Automation Bridge, Editor Scripting Utilities, and Niagara enabled before automation starts.