Sanity CMS MCP Server: Setup and Safe Use

Q: What is Sanity MCP?

It's Sanity's hosted MCP server at https://mcp.sanity.io. It lets an AI agent run GROQ queries, read your schema, draft and publish documents, manage releases and change project settings. Nothing runs on your machine.

Q: Is there an official Sanity MCP server?

Yes. Sanity hosts it at https://mcp.sanity.io, and it became generally available in December 2025. It replaced the local @sanity/mcp-server package, which is now deprecated.

Q: How do I connect Sanity to Claude Code?

Run claude mcp add Sanity -t http https://mcp.sanity.io --scope user, start Claude Code and sign in when prompted. For read-only use, add an Authorization header with a Viewer token instead of signing in.

Q: How do I set up the Sanity MCP server in Cursor or VS Code?

Run npx sanity@latest mcp configure. It detects your editors and adds the server with no token, and your editor then asks you to sign in with OAuth. To do it by hand, add https://mcp.sanity.io as an http server in Cursor's mcp.json or VS Code's MCP user configuration.

Q: Can the Sanity MCP server publish content?

Yes, with publish_documents, if your role allows it. Edits normally go to drafts first, but document types with liveEdit enabled are written straight to published. Keep publish behind an approval prompt.

On this page

Sanity MCP Server: Setup, Permissions and What It Can Publish (Nov 2026)

The Sanity CMS MCP server is Sanity's own hosted server at https://mcp.sanity.io. There is nothing to install: add the URL to Claude Code, Cursor or VS Code and sign in with OAuth. Sign-in gives the agent your full Sanity role, so use a Viewer token for read-only work. TrustedMCP grades it B.

What the Sanity CMS MCP server does

It lets an agent work on your Sanity projects directly. The agent can run GROQ queries (GROQ is Sanity's query language), read your schema, draft and publish documents, manage releases and change project settings. Sanity's MCP server docs listed 60 tools when we checked on 2026-11-05, two of them deprecated:

Area	Example tools	What they do
Read content	`query_documents`, `get_document`, `semantic_search`	Run GROQ queries and fetch documents
Write content	`create_documents`, `patch_documents`, `create_version`	Create and edit drafts or release versions
Go live	`publish_documents`, `unpublish_documents`	Publish drafts, or take documents down
Throw away	`discard_drafts`, `version_discard`	Delete drafts or release versions
Releases	`create_release`, `list_releases`	Group changes into a Content Release
Schema	`get_schema`, `deploy_schema`, `schema_fields_patch`, `schema_types_delete`	Read and change your content model
Studio	`deploy_studio`, `get_project_studios`	Deploy a hosted Studio and list Studios
Projects	`create_project`, `create_dataset`, `update_dataset`, `add_cors_origin`	Create projects and datasets, change visibility and CORS
Assets	`dataset_assets_upload_from_url`, `media_library_*`	Upload files and manage the Media Library
AI images	`generate_image`, `transform_image`	Generate or edit images, using AI credits
Usage	`usage_snapshot_get`, `usage_history_get`	Read metered usage
CLI	`run_sanity_cli`	Run a limited set of Sanity CLI commands
Help	`whoami`, `search_docs`, `read_docs`, `get_sanity_rules`	Check who you are, read docs and best-practice rules

We read Sanity's docs, changelog, repos and public OAuth metadata for this guide. We did not sign in or run any tools, so the tool behaviour below is what Sanity documents.

The official server and the old npm package

The old local package, @sanity/mcp-server, is deprecated, and its GitHub repo was archived in February 2026. Its latest version is a 1.5 KB stub that says to use the hosted server, yet it still had 788 npm downloads in October 2026. Don't install it.

The MCP Registry lists the official server as io.sanity.www/mcp (version 2.46.0, published 2026-11-03). Community servers exist, such as Purple-Horizons/sanity-mcp with one GitHub star, but we found no reason to pick one over Sanity's own. We have not graded them.

Sanity MCP setup in Claude Code, Cursor and VS Code

You need a Sanity account and an MCP client. Nothing runs on your machine.

Quickest: the Sanity CLI. This detects your editors and configures them:

npx sanity@latest mcp configure

For Claude Code, Codex CLI, Cursor, OpenCode and VS Code it adds the server with no token, and your editor asks you to sign in with OAuth. For other editors, such as Gemini CLI and Zed, it writes an API token tied to your logged-in CLI user into the editor's config file. Logging out of the CLI revokes that token.

Claude Code. This is the command from Sanity's docs:

claude mcp add Sanity -t http https://mcp.sanity.io --scope user

Sign in on your next run. Open /mcp in a session if it doesn't prompt you. Scopes and other options are in our Claude Code MCP setup guide.

Cursor. Open the Command Palette, run View: Open MCP Settings, select + New MCP Server, and add this to mcp.json:

{
  "mcpServers": {
    "Sanity": {
      "type": "http",
      "url": "https://mcp.sanity.io"
    }
  }
}

VS Code. Run MCP: Open User Configuration from the Command Palette and add:

{
  "servers": {
    "Sanity": {
      "type": "http",
      "url": "https://mcp.sanity.io"
    }
  }
}

Workspace versus user config is covered in our VS Code MCP server guide.

Claude Desktop and claude.ai. Sanity's setup docs have no section for these, though its v2.8.0 changelog fixed connecting from both. Add the URL as a custom connector under Settings > Connectors.

Clients without remote MCP support. Sanity's docs suggest the mcp-remote proxy. It runs locally through npx, and versions 0.0.5 to 0.1.15 have a command injection flaw (CVE-2025-6514), so stay on 0.1.16 or later. It adds a local process you don't otherwise need, so use a client with native support if you can.

The plugin is optional. Sanity's agent-toolkit also offers a plugin for Claude Code and Cursor. It bundles this same server with agent skills and slash commands. The skills are best-practice notes for your agent, and they are a separate thing from the server. In Claude Code the install is /plugin install sanity@claude-plugins-official.

Make a read-only Sanity token

You can't narrow an OAuth sign-in. The server's OAuth metadata lists a single scope, global, and the docs say OAuth acts "on your behalf". If you're an Administrator, the agent is too. The hosted server has no read-only switch.

An API token is the way to limit it. Sanity's docs say that when you set the Authorization header, "Tool calls use the API token and are limited to its role and permissions."

1. Create a Viewer token for one project. In sanity.io/manage, go to Settings > API > Tokens, or use the Sanity CLI tokens command:

npx sanity@latest tokens create "Claude read-only" -p <project-id> --role viewer --expires-at 2027-02-01

Viewer means "read-only access to all datasets, with no access to project settings", and it is on every plan. That includes your private datasets, so don't treat it as a filter on content. Narrower custom roles need an Enterprise plan. Robot tokens never expire unless you set a date, so set one.

2. Keep it out of the file you commit. In Claude Code, a project .mcp.json can read the token from your environment:

{
  "mcpServers": {
    "Sanity": {
      "type": "http",
      "url": "https://mcp.sanity.io",
      "headers": {
        "Authorization": "Bearer ${SANITY_MCP_TOKEN}"
      }
    }
  }
}

Set SANITY_MCP_TOKEN in your shell. More patterns are in how to keep API keys out of your MCP config.

3. Don't use a personal token here. Sanity's auth docs say a personal token "gives complete access to the Sanity API as your user". It has the same reach as OAuth, in a form that sits in a file and lasts a year.

Want the agent to draft but not publish? Use the Contributor role instead of Viewer. Sanity's roles docs say a Contributor "can write but not publish documents". It's on Growth and Enterprise plans. Editor and Developer tokens have full read and write access to all datasets, so those need the approval rules below.

What the Sanity MCP server can change

Drafts are the default, with exceptions. The docs say patch_documents edits are "saved to the draft or release version, never directly to published content". That is a good default, but these go around it or past it:

publish_documents is one tool call away. With write access, the agent can draft and publish in the same turn unless your client stops it.
Live-edit types write straight to published. create_documents creates "published documents for types with liveEdit enabled", and the v2.45.0 changelog says patches on those types also go directly to their published IDs. Check your schema for liveEdit if you rely on drafts as a safety net.
unpublish_documents takes content down by moving it back to drafts.
Some Media Library edits are immediate. A cdnAccessPolicy change "takes effect immediately", and collections are edited directly.

Project settings are in scope too:

update_dataset can make a private dataset public. The tool description says "Public datasets allow unauthenticated reads." This is the one to block first.
add_cors_origin lets client-side code on a new origin call your project.
create_project makes a project with a dataset and API tokens.
deploy_schema and schema_types_delete change the content model that Studio and your validation use.
deploy_studio puts a hosted Studio online.

Uploads are public on the CDN. Sanity's data safety docs warn that dataset assets are public on the asset CDN "even when the dataset is private". The URL is hard to guess, but it isn't protected. Don't let an agent upload anything confidential.

MCP validation is looser than Studio's. The docs say custom validation rules "are currently skipped when run via MCP". A document can pass here and break a rule your editors would hit in Studio.

Some things it can't do. The docs list no tool for deleting a published document. Scheduling, publishing, archiving and deleting a release "must be done in Sanity Studio or via the HTTP Actions API". run_sanity_cli runs without a shell and can't touch your files or change authentication, but the docs don't list which commands it allows, so we block it until you need it.

Limits to plan around:

patch_documents takes at most 25 documents per call.
Query results over 64 KiB are rejected rather than cut off, so page large sets.
Direct file uploads stop at 50 MiB.
OAuth sessions typically expire after 7 days.
generate_image and transform_image use AI credits ($0.05 a credit). The toolkit README adds create_version with an instruction to that list.
Sanity publishes no rate limit figures for the server. A request we sent without signing in came back with a 10-in-1sec rate limit header, and the tool descriptions say to honor Retry-After.

How to limit what the Sanity MCP can do

Start with a Viewer token, and move to Contributor only for the project where you want drafting.
Name a non-production dataset for schema and migration work. The built-in roles reach every dataset in the project, so nothing on the server enforces this. Say which dataset to use in your prompt, and check each write before you approve it.
Use Claude Code permission rules. Tool names follow mcp__<server>__<tool>, so with the server named Sanity:

{
  "permissions": {
    "allow": [
      "mcp__Sanity__whoami",
      "mcp__Sanity__list_projects",
      "mcp__Sanity__list_datasets",
      "mcp__Sanity__list_releases",
      "mcp__Sanity__get_schema",
      "mcp__Sanity__query_documents",
      "mcp__Sanity__get_document",
      "mcp__Sanity__search_docs",
      "mcp__Sanity__read_docs"
    ],
    "ask": [
      "mcp__Sanity__create_documents",
      "mcp__Sanity__patch_documents",
      "mcp__Sanity__create_version",
      "mcp__Sanity__create_release",
      "mcp__Sanity__discard_drafts",
      "mcp__Sanity__version_discard",
      "mcp__Sanity__publish_documents",
      "mcp__Sanity__unpublish_documents"
    ],
    "deny": [
      "mcp__Sanity__update_dataset",
      "mcp__Sanity__add_cors_origin",
      "mcp__Sanity__cors_origins_delete",
      "mcp__Sanity__create_project",
      "mcp__Sanity__create_dataset",
      "mcp__Sanity__deploy_schema",
      "mcp__Sanity__undeploy_schema",
      "mcp__Sanity__schema_fields_patch",
      "mcp__Sanity__schema_types_delete",
      "mcp__Sanity__deploy_studio",
      "mcp__Sanity__run_sanity_cli",
      "mcp__Sanity__generate_image",
      "mcp__Sanity__transform_image"
    ]
  }
}

Reads run freely, content changes ask first, and settings changes are blocked until you lift the rule. Sanity also added tool annotations in v2.14.0 so clients can tell read-only tools from destructive ones, but treat those as hints. 4. Treat your content as untrusted input. query_documents hands the agent text that editors, imports and web forms put in your dataset. A document can carry instructions aimed at the agent, so read our prompt injection guide before you give one agent both read access and publish rights. 5. Know the separate read-only product. For an agent that answers users from your content, Sanity's Context MCP is a different hosted server. It "can't write back to your data" and can limit documents with a GROQ filter. It isn't what this guide sets up, and we haven't graded it.

Why the Sanity MCP server grades B

Scored against our trust scoring rubric:

Authentication, 18 of 30. OAuth is the default, with PKCE and a revocation endpoint, and a request with no token gets a 401. But the only scope is global, so sign-in carries your whole Sanity role. Scoped tokens exist, but you have to set them up. This is the biggest deduction, and the same score Notion's server gets for the same reason.
Maintenance, 18 of 25. Very active: 10 changelog entries in October 2026, and version 2.46.0 on 3 November. But the server's source isn't public. The agent-toolkit repo holds skills and plugin files, not the server, so we can't see who maintains it. Closed-source hosted servers score one band lower here.
Known CVEs, 25 of 25. OSV, GitHub advisories and the agent-toolkit repo showed nothing for this server or the old npm package on 2026-11-05.
Transport, 20 of 20. Streamable HTTP over TLS, and plain HTTP redirects to HTTPS. Sanity says run_sanity_cli commands run without a shell.

Overall: grade B. More detail is on the Sanity MCP listing, and our guide to MCP authentication explains what scopes should do.

A B here doesn't mean the server is careless. Its problem is what a sign-in hands over, and a Viewer token plus the rules above fix most of that.

Building something on Sanity that needs tighter limits than a Viewer token gives? Tell us what you need to connect.

Frequently asked questions

What is Sanity MCP?

It's Sanity's hosted MCP server at https://mcp.sanity.io. It lets an AI agent run GROQ queries, read your schema, draft and publish documents, manage releases and change project settings. Nothing runs on your machine.

Is there an official Sanity MCP server?

Yes. Sanity hosts it at https://mcp.sanity.io, and it became generally available in December 2025. It replaced the local @sanity/mcp-server package, which is now deprecated.

Is the Sanity MCP server free?

Sanity's MCP docs list no separate price for it; you need a Sanity account. Most tools are standard API calls that don't use AI credits. generate_image and transform_image do, at $0.05 a credit, and every organization gets some free credits each month. Check your plan's limits on the pricing page.

How do I connect Sanity to Claude Code?

Run claude mcp add Sanity -t http https://mcp.sanity.io --scope user, start Claude Code and sign in when prompted. For read-only use, add an Authorization header with a Viewer token instead of signing in.

How do I set up the Sanity MCP server in Cursor or VS Code?

Run npx sanity@latest mcp configure. It detects your editors and adds the server with no token, and your editor then asks you to sign in with OAuth. To do it by hand, add https://mcp.sanity.io as an http server in Cursor's mcp.json or VS Code's MCP user configuration.

Can the Sanity MCP server publish content?

Yes, with publish_documents, if your role allows it. Edits normally go to drafts first, but document types with liveEdit enabled are written straight to published. Keep publish behind an approval prompt.

Does the Sanity MCP server have a read-only mode?

There's no switch on the server. Use an API token with the Viewer role, which limits tool calls to read-only access on that project's datasets. For a production agent that only reads, look at Sanity's separate Context MCP.

Should I use @sanity/mcp-server from npm?

No. It's deprecated and its repo is archived. The latest version is only a stub pointing to https://mcp.sanity.io.

Why do I get a 401 from the Sanity MCP server?

An OAuth session has probably expired, which typically happens after 7 days. Your client should ask you to sign in again. If it gets stuck, run Authentication: Remove Dynamic Authentication Providers in VS Code, or Cursor: Clear All MCP Tokens in Cursor. If the CLI wrote a token, rerun npx sanity@latest mcp configure.

Why are some Sanity tools missing?

Sanity's docs say to check that your account has the right permissions for that project and dataset. The tool list also changes between releases, and this server ships often.