API Website World

Website World provides a secure Model Context Protocol (MCP) service that lets compatible AI assistants retrieve website information, run reports and perform controlled product updates.

Website World MCP server:
https://api.cms-tool.net/api/mcp

For most users, this is the only address you need. Add it as a remote MCP server in your preferred AI assistant. The assistant should discover the authentication service, open the Website World authorization page and guide you through connecting your account.

What You Can Do

The Website World MCP provides tools for:

retrieving the current database schema and planning instructions;
retrieving website-specific information such as categories, pages and site metadata;
looking up individual members, products and other records;
running detailed or aggregated reports;
previewing bulk product updates with before-and-after values; and
executing an approved product-update plan.

The detailed schemas and planning instructions are supplied to the AI assistant when required. They do not need to be copied into the assistant's configuration.

Before You Connect

You need a Website World account with API access.
Your AI assistant must support remote MCP servers using Streamable HTTP and OAuth.
Your organisation may need to enable custom MCP servers or connectors.
You must have permission to access the website you select.
You should understand whether the assistant needs read access, product-update access or both.

Never give an AI assistant your Website World password, API key, access token or refresh token. Authentication should take place only through the Website World OAuth page.

How the Connection Works

You add https://api.cms-tool.net/api/mcp to a compatible AI assistant.
The assistant contacts the MCP server and discovers that authorization is required.
The assistant discovers the Website World OAuth authorization server.
The assistant identifies itself using an approved OAuth client ID method.
Your browser opens the authorization page on www.cms-tool.net.
If you already have an active Website World session, you may not need to log in again.
You review the identity of the connecting application.
You choose the Website World website it may access.
You review and approve the requested scopes.
The assistant receives an authorization code and exchanges it for tokens.
The assistant uses its access token when calling the MCP server.
The MCP server exposes the tools available within the website and scopes you approved.

What You Must Review During Authorization

The authorization page is the point where you decide what the AI application is allowed to access. Review the following information before approving the connection.

1. The Connecting Application

Check the application name and the domain associated with its OAuth client ID. Only continue if you recognise and trust the AI assistant or integration.

Where a Client ID Metadata Document is used, Website World may display information obtained from that document, including the client name, client website and redirect destination.

2. The Redirect Destination

The redirect URI is where the authorization code will be returned. Check that its hostname belongs to the AI assistant or application you intended to connect.

Take particular care with redirect addresses using localhost or 127.0.0.1. These are common for installed desktop applications and command-line tools, but you should approve them only when you initiated the connection from that application.

3. The Website

If your account can access more than one Website World website, choose the website the assistant should use.

The resulting OAuth connection is bound to the selected website. Supplying a different website ID in a tool request does not grant access to that website.

To connect a different website, create another authorization connection and select that website during authorization.

4. The Requested Scopes

Scopes determine what the assistant may do. Approve only the access required for your intended use.

The MCP service may request scopes such as:

metadata:read — retrieve schema, planning and website metadata;
reports:run — perform lookups and run reports; and
products:update — preview and execute product updates.

An assistant used only for reporting should not need product-update permission. If an operation later requires an additional scope, the assistant may ask you to authorize the additional permission at that time.

Client Identification

Before OAuth can begin, the AI assistant must have a client ID. Website World supports the following approaches.

Pre-registered Client

A well-known AI platform may already have a client ID registered with Website World. In that case, the platform uses its existing client information and the user does not need to configure a client ID.

Client ID Metadata Document (CIMD)

CIMD is the recommended approach when an MCP client and Website World do not already have a registration relationship.

The client publishes a JSON metadata document at a stable public HTTPS URL and uses that exact URL as its client_id. Website World retrieves the document, checks that its contents are valid and verifies that the authorization request uses one of its registered redirect URIs.

A CIMD client ID must:

use HTTPS;
include a path, rather than being only a domain name;
be publicly retrievable as JSON;
contain a client_id exactly matching the document URL;
identify the client with a client_name; and
list every permitted redirect URI in redirect_uris.

Example:

{
  "client_id": "https://agent.example.com/oauth/client-metadata.json",
  "client_name": "Example AI Agent",
  "client_uri": "https://agent.example.com",
  "logo_uri": "https://agent.example.com/logo.png",
  "redirect_uris": [
    "https://agent.example.com/oauth/callback"
  ],
  "grant_types": [
    "authorization_code",
    "refresh_token"
  ],
  "response_types": [
    "code"
  ],
  "token_endpoint_auth_method": "none"
}

The metadata document should be served with an appropriate JSON content type and sensible HTTP cache headers.

Website World advertises CIMD support through its authorization-server metadata:

"client_id_metadata_document_supported": true

Using CIMD removes the need for a separate manual client-registration request, but it does not bypass user approval. The user must still select a website and approve the requested scopes.

Manually Registered Client

If the application cannot publish a CIMD document, it can use a client ID registered directly with Website World.

The application developer must provide:

the application name;
the application or developer website;
all redirect URIs;
the expected OAuth grant types; and
contact details for the integration owner.

The redirect URI supplied during authorization must exactly match a URI registered for that client.

OAuth and MCP Discovery Information

MCP clients should discover this information automatically. It is provided here for developers and troubleshooting.

Protected MCP Resource

https://api.cms-tool.net/api/mcp

Protected Resource Metadata

https://api.cms-tool.net/.well-known/oauth-protected-resource/api/mcp

The protected-resource metadata identifies the MCP resource, supported scopes and Website World authorization server.

OAuth Authorization Server

https://www.cms-tool.net/api/auth

The authorization service is hosted on the human-facing Website World application so an existing browser login session can be used.

Authorization Server Metadata

https://www.cms-tool.net/.well-known/oauth-authorization-server/api/auth

Authorization Endpoint

https://www.cms-tool.net/api/auth/authorize

Token Endpoint

https://www.cms-tool.net/api/auth/token

OAuth Requirements for Client Developers

Website World uses OAuth Authorization Code with PKCE for interactive MCP connections.

The authorization request includes:

client_id
redirect_uri
response_type=code
code_challenge
code_challenge_method=S256
resource=https://api.cms-tool.net/api/mcp
state
scope

The resource value must identify the protected MCP resource exactly:

https://api.cms-tool.net/api/mcp

The same resource value must be included when exchanging the authorization code at the token endpoint.

Authorization-Code Exchange

The client sends the authorization code to:

https://www.cms-tool.net/api/auth/token

with values including:

grant_type=authorization_code
client_id=CLIENT_ID
code=AUTHORIZATION_CODE
redirect_uri=REGISTERED_REDIRECT_URI
code_verifier=PKCE_CODE_VERIFIER
resource=https://api.cms-tool.net/api/mcp

The client must verify the OAuth state value before exchanging the code.

Using the Access Token

The access token must be sent to the MCP resource in the HTTP header:

Authorization: Bearer ACCESS_TOKEN

Tokens must not be placed in URLs, prompts, chat messages, client-side logs or tool arguments.

Refreshing the Connection

Access tokens expire. A client can use its current refresh token to obtain a replacement access token without asking the user to authorize the connection again.

The refresh request is sent to:

https://www.cms-tool.net/api/auth/token

with values including:

grant_type=refresh_token
client_id=CLIENT_ID
refresh_token=CURRENT_REFRESH_TOKEN
resource=https://api.cms-tool.net/api/mcp

Website World rotates refresh tokens. After a successful refresh, the client must securely store the new refresh token and discard the previous one.

Scope Discovery and Additional Authorization

The MCP server may include the scopes required for initial access in its HTTP authorization challenge. If it does not, the client can use the scopes advertised by the protected-resource metadata.

Website World may keep the initial scope set small and request additional authorization only when the user asks for an operation requiring more access.

For example:

A user initially approves metadata and reporting access.
The assistant successfully runs reports.
The user later asks to update products.
The MCP server reports that product-update scope is required.
The assistant opens the Website World authorization page again.
The user reviews and approves or refuses the additional scope.
The assistant retries the operation only after authorization succeeds.

A client should limit repeated authorization attempts and must not continuously retry an operation the user has refused.

How the MCP Tools Work

Planning Instructions and Database Metadata

Before constructing a report or update plan, the assistant retrieves the complete current planning instructions and relevant database schema from the MCP service.

This allows Website World to improve its reporting and update features without requiring every MCP client to be reconfigured.

Website Metadata

The assistant can separately retrieve website-specific information such as category IDs, page details and top-level website metadata.

This information is limited to the website selected during OAuth authorization.

Reports and Lookups

A report plan may represent:

a lookup for one member by email address;
a lookup for one product by product code;
a list of matching records;
a detailed operational report; or
aggregated order or sales information over time.

The assistant constructs a structured plan using the instructions supplied by Website World. The server validates and executes that plan.

Product Updates

Product updates use a preview-and-execute process:

The assistant retrieves the current update-planning instructions.
The assistant constructs a structured update plan.
Website World validates the plan.
The preview shows affected products and before-and-after values.
The user reviews the preview.
The approved plan is sent for execution.

Do not approve an update unless the preview matches your intended changes.

Rate Limiting and Long-Running Requests

The Website World MCP service is rate limited to protect website performance and provide fair access.

The service communicates rate-limit information to the MCP client. If a limit is reached, the client is told when it may retry.

Complex reports and bulk updates can take several seconds to complete. Do not repeatedly submit the same request while it is still running.

Connect a Supported AI Assistant

In your assistant, look for settings named MCP servers, Connectors, Apps, Tools or Integrations.

Add the following remote server:

https://api.cms-tool.net/api/mcp

Then choose Connect or Authenticate and complete the Website World authorization process.

ChatGPT

Custom MCP availability depends on your ChatGPT plan and workspace settings. A workspace administrator may need to enable developer mode, create the custom app and publish it to users.

ChatGPT MCP documentation

Claude

Open Settings > Connectors, add a custom connector and enter the Website World MCP address. Team and Enterprise organisations may require an owner to add the organisation connector first.

Claude remote MCP documentation

Cursor

Add Website World through Cursor's MCP settings or configure it in mcp.json:

{
  "mcpServers": {
    "website-world": {
      "url": "https://api.cms-tool.net/api/mcp"
    }
  }
}

Cursor MCP documentation

GitHub Copilot in Visual Studio Code

Add a remote HTTP MCP server named website-world, enter the Website World MCP address and use the displayed Auth action to authenticate.

GitHub Copilot MCP documentation

Gemini CLI

gemini mcp add --transport http --scope user website-world https://api.cms-tool.net/api/mcp

Then run:

/mcp auth website-world

Gemini CLI MCP documentation

Microsoft Copilot Studio

Use the MCP onboarding wizard, select Streamable HTTP and enter the Website World MCP address. An administrator may need to configure or approve the OAuth connection.

Copilot Studio MCP documentation

Test the Connection

After connecting, try:

Confirm that Website World is connected and briefly describe its available capabilities. Do not change any data.

You can then request something such as:

“Find the member with this email address.”
“Find the product with this product code.”
“Show sales by month for the past year.”
“Show the categories available on this website.”
“Preview an increase to member prices.”

Disconnecting or Changing Access

You can disconnect Website World through the connector settings in your AI assistant or through the Website World account interface.

Reconnect if you need to:

select a different website;
use a different Website World account;
approve additional scopes; or
replace a revoked or expired connection.

Troubleshooting

The Assistant Cannot Connect

Confirm that the MCP address is exactly:

https://api.cms-tool.net/api/mcp

The client must support remote MCP servers using Streamable HTTP. Support for local command-based MCP servers alone is not sufficient.

No Authorization Page Opens

Look for a Connect, Authenticate or Auth action beside the configured MCP server. Check that browser pop-ups and OAuth redirects are allowed.

The Application Is Not Accepted

The client may need to use CIMD or obtain a manually registered client ID. Confirm that its redirect URI exactly matches the URI in its metadata document or registration.

The Requested Website Is Missing

Only websites available to the signed-in Website World account can be selected. Confirm that you are signed in with the correct account and that it has the necessary website permissions.

An Operation Is Not Permitted

The selected website or approved scopes may not allow the operation. The assistant may offer to request additional authorization. Review the new permission request before approving it.

A Request Is Rate Limited

Wait for the retry interval supplied to the assistant. Do not immediately repeat the request.

Security Recommendations

Connect only MCP clients and AI assistants you trust.
Review the client name, client domain and redirect destination.
Select only the website the assistant needs.
Approve the smallest useful permission set.
Use read-only access unless changes are required.
Review product-update previews before execution.
Do not place tokens, passwords or API keys in prompts.
Revoke connections that are no longer required.
Keep the AI assistant and MCP client software up to date.

Technical Standards

The Website World MCP authorization flow is based on OAuth 2.1 security practices, OAuth Protected Resource Metadata, OAuth Authorization Server Metadata, OAuth Resource Indicators, Authorization Code with PKCE and OAuth Client ID Metadata Documents.

MCP authorization specification

AI Agent Integration