We’re excited to announce that Craft 5.12 is here! This release makes it possible for AI agents work with your Craft install through new built-in MCP servers, opens up the GraphQL API to authenticated users, and brings other authoring and development improvements across the board.
MCP Servers
Craft 5.12 adds built-in Model Context Protocol (MCP) servers, so AI agents and tools like Claude, ChatGPT, and Cursor can connect directly to your Craft install.
Authenticated MCP server. Connect your agents to Craft by authorizing with our new OAuth service. MCP clients can then act on behalf of that user, within their existing permissions and a specific access level granted during authorization.
Public MCP server. You can also expose a public MCP server, which doesn’t require signing in. It only exposes the capabilities and content you’ve explicitly approved, so you decide exactly what agents can find out about your site.
Both servers are disabled by default, but can be enabled and configured from the new Settings → MCP screen.
There’s also a new mcp/serve command, which runs a local authenticated MCP server. Agents running on your machine can connect to that, acting as a given user, and use it to make content changes, or even safely make project config changes without needing to edit the YAML directly!
Plugins can register their own MCP capabilities too, so they can expose their own content and capabilities to agents.
Authenticated GraphQL
Craft’s GraphQL API has historically been schema-based: you define “schemas” that grant access to specific queries and mutations, API requests specify which schema to use via a token, and the requests have full access to all the queries and mutations included in that schema.
That works great if the client is an application with gated access to the API, or if everything in the schema is safe for public consumption. But it’s not great for querying/updating user-specific data, like account details or entry drafts.
Craft 5.12 changes that. GraphQL requests can now be authenticated as an actual user, and get a schema built on the fly based on that user’s permissions. They can query and mutate anything the user is allowed to, and nothing more.
Like the authenticated MCP server, the authenticated GraphQL API is built on an OAuth application authorization flow. We’ve also added support for personal tokens, which can access the authenticated GraphQL API, or other plugin-defined scopes.
Other Highlights
Craft 5.12 is packed with smaller improvements across the system. A few highlights:
- Files can be uploaded to Assets fields by pasting them from the clipboard.
- Markdown files can be uploaded and previewed with syntax highlighting.
- Element edit screens get a new “Sites” pane, for toggling per-site statuses and navigating between sites.
- Icon fields, entry types, and option fields can now include custom icon sets.
- Color fields now support translucent colors.
See the release on GitHub for the full release notes.
Happy developing!