AEM 6.5 MCP Server

Standalone Node.js Model Context Protocol server for Adobe Experience Manager 6.5 Author. It does not install anything on AEM.

Status: pre-production. Use the capability matrix as the list of supported operations. Release gates are in docs/adr/0001-standalone-http-mcp.md.

This project is AGPL-3.0 for open source use. Commercial licensing is described in COMMERCIAL_LICENSE.md.

AEMaaCS is a different product: see aemaacs-mcp-server. AEM 6.5 LTS is out of scope.

What this is

• MCP stdio for IDE clients (primary).
• Optional MCP Streamable HTTP (POST /mcp) with API key or HTTP Basic. OAuth is out of scope.
• One typed tool catalog driving both transports.
• Documented AEM 6.5 HTTP only: Granite CSRF, /bin/wcmcommand, /bin/replicate.json, QueryBuilder, Assets createasset.html, Workflow REST.

What this is not

• Production-ready until CI gates and live Author contract tests pass.
• An AEM package, OSGi service, or RepoInit installer.
• Atomic bulk rollback, JCR-SQL2, MSM rollout, tree activation, or .infinity.json dumps.
• An OpenAI/Anthropic/Telegram bot.

Requirements

• Node.js 20 or 22
• AEM 6.5 Author SP17+ reachable over HTTP(S)
• A technical user that already exists in AEM User Admin (ACL checklist)

Quick start (stdio)

cp .env.example .env
# set AEM_HOST, AEM_SERVICE_USER, AEM_SERVICE_PASSWORD
npm ci
npm run build
npm run mcp

Cursor / Claude desktop config:

{
  "mcpServers": {
    "aem-65": {
      "command": "node",
      "args": ["/absolute/path/to/dist/mcp/stdio.js"],
      "env": {
        "AEM_HOST": "http://localhost:4502",
        "AEM_SERVICE_USER": "mcp-technical",
        "AEM_SERVICE_PASSWORD": "<secret>"
      }
    }
  }
}

Optional HTTP gateway

export MCP_API_KEY=replace-me
export HTTP_ENABLED=true
npm start

• Liveness (no auth): GET /health/live
• Readiness (auth): GET /health/ready
• MCP: POST /mcp (SDK Streamable HTTP)
• Convenience REST: GET /api/methods, POST /api/methods/:name (same auth; not a substitute for MCP)

Put TLS in front. Bind HOST=127.0.0.1. Set ALLOWED_HOSTS and CORS_ORIGINS.

curl -sS -H "X-API-Key: $MCP_API_KEY" http://127.0.0.1:3001/api/methods

Configuration

See .env.example. Required: AEM_HOST, AEM_SERVICE_USER, AEM_SERVICE_PASSWORD. Production/staging refuse admin/admin and refuse HTTP without API key or Basic.

Default page resource type is core/wcm/components/page/v3/page. Override with AEM_DEFAULT_PAGE_RESOURCE_TYPE and AEM_DEFAULT_CONTAINER for your project.

Architecture

MCP client → stdio or Streamable HTTP → typed tool catalog
  → validation / path policy / audit → AEM 6.5 HTTP adapter → Author

Details: capability matrix, tool reference, operations, threat model, 1.x migration.

Development

npm ci
npm run lint
npm test
npm run build

Live Author tests (optional): AEM_INTEGRATION=1 npm test.

License

AGPL-3.0-or-later. Contact via LinkedIn for commercial licensing.