Skip to main content
Cactal treats agents as first-class operators, not a bolt-on integration. The built-in Cactal agent is already docked in every site’s studio with no setup; this page is for bringing an agent of your own. The MCP server exposes agent-safe public operations as tools, while REST remains the complete programmatic interface. Financial transactions stay in the dashboard or REST API rather than MCP. Connect Claude, Claude Code, Cursor, ChatGPT, Codex, or any other MCP client with OAuth. Agents that prefer raw HTTP can use the REST API with an API key.

​
One platform, three interfaces

Every operation runs through the same authorization, rate limits, and audit pipeline, whichever interface invokes it. The interfaces share one operation vocabulary. websites.create is the operation behind the dashboard’s create button, the POST /v1/websites endpoint, and the websites_create MCP tool.

​
What an agent can do end to end

An agent holding a suitably scoped API key can run the full website lifecycle without a human touching the dashboard.
  • Create a website — POST /v1/websites creates a website in your organization with a draft head version.
  • Edit source code: acquire an edit lease with POST /v1/websiteSourceCode/lease/acquire, then write pages, components, reusable modules, global CSS, and custom head or body snippets with PUT /v1/websiteSourceCode/files. TypeScript source can also import pinned npm packages. See Source code.
  • Model and manage content — create collections and fields, then create, publish, and query items through the /v1/cms/* endpoints. See CMS.
  • Upload assets and set the favicon — POST /v1/websiteAssets begins a presigned upload with a one-line description and image category so the asset stays searchable; finalize it, then select it with PUT /v1/websites/{websiteId}/favicon. The favicon changes immediately on every site host and does not require publishing. See Assets.
  • See the result — POST /v1/websitePreview/capture renders a page in a real browser and returns the image, so an agent without a browser can still check layout and responsive behavior. See Preview drafts and versions.
  • Publish — validate the draft with POST /v1/websiteSourceCode/head/check, then ship it with POST /v1/websiteSourceCode/head/publish. See Publishing.
  • Operate the live website — add and verify custom domains, read analytics, and roll back with POST /v1/websiteSourceCode/published/rollback-version when needed. See Domains.
Drafts, publishing, platform-domain serving, and the full API are available on every plan, including Free. A site counts toward your plan when an organization owner enables custom domains for it. Sites on Cactal domains are unlimited and free. See Plans and limits.

​
A concrete run

The same lifecycle, named in both interfaces. An agent on MCP and a script on REST perform identical operations.

​
The human stays in control

Agent access is broad by design, so the platform bounds it with three mechanisms you configure once and audit continuously.

​
Scoped API keys

A key carries explicit access: the whole organization or a fixed list of websites, with a role of admin, full_editor, or content_editor. The owner role is not grantable to keys. The MCP server even filters tools/list to what the key can call, so an agent never sees operations it cannot use. See Access control. OAuth connections instead inherit the signed-in user’s existing organization and website grants. Use OAuth for interactive clients and a narrowly scoped API key for unattended automation.

​
Draft-first editing

Source edits land on the website’s head, the draft version. Nothing reaches the live website until an explicit publish, and you can review the draft on its preview URL first. A wrong draft costs nothing: discard it with POST /v1/websiteSourceCode/head/restore and { "to": "published" }.

​
The audit log

Lifecycle and access operations — websites, editors, API keys, domains, members, billing — write organization audit events with actor attribution, so agent actions are distinguishable from human actions. Filter GET /v1/organizations/{organizationId}/audit-log by actorKind=api_key to review them, and review content work through the changed-file list, targeted diffs, and preview. Agent-safe publishing turns these mechanisms into a working process.

​
Set up your agent

Connect over MCP

Endpoint, authentication, client setup for Claude Code, Cursor, and generic MCP clients, and a first-session walkthrough.

Agent-safe publishing

Scope keys, keep work on drafts, gate publishes on checks and human approval, watch the audit log, and recover fast.

AI-readable docs

llms.txt, Markdown variants of every page, and the docs-search MCP server — how agents read this documentation.

Submit product feedback

Send a report to Cactal when the user explicitly asks you to share product feedback.

Create an API key

Create a scoped credential for REST clients and unattended MCP automation.