KilnKiln
Available now · v0.4.0

An API and MCP server for the site your AI built.

Kiln already lets people edit a static site by clicking it. The same fields are now writable by tools and AI agents. Scoped to the exact fields you allow, sanitized on the server, and every change committed to your own GitHub repo where you can review or undo it. The worker is live at auth.kilncms.com.

See the endpoints kiln-mcp on GitHub

Two ways in. Same content, no new database.

Your page already declares what's editable, with data-cms tags. That doubles as the schema, so there's nothing extra to model. Point either interface at a page and you get its fields.

For code

The REST API

Read a page’s fields as JSON and write field-level edits back. Authenticated with an owner-minted token scoped by path, section keys, read-only, and expiry. Wire it into a script, a cron job, or a form handler. Every write is sanitized and committed with attribution.

For AI

kiln-mcp

Connect Kiln to Claude or any MCP client. The agent can list pages, read fields, and apply edits — and that is all it can do. “Mark us closed on the 4th” becomes a real edit to your hours, and every write returns its commit.

The page is the interface.

Three endpoints on the same worker the editor already uses. Read the fields, change one, and the write becomes a commit that your host redeploys — the same pipeline every click-to-edit change already flows through. Send a Bearer token the site owner minted.

# List pages this token can see
GET  /api/v1/pages

# Read what's editable on a page
GET  /api/v1/fields?path=/
→ { "hero_headline": { "value": "Fresh sourdough daily", "kind": "text" },
    "hours":         { "value": "Mon–Sat 7–3",         "kind": "text" } }

# Change one field — it becomes a Git commit
PATCH /api/v1/edits
      { "path": "/", "edits": [{ "key": "hours", "html": "Closed July 4th" }] }

Worker: auth.kilncms.com on Kiln Cloud, or your own worker if you self-host. Owner-minted tokens via POST /admin/api-tokens.

What people use it for.

The common thread: small, recurring content changes that are too minor to hire for and too frequent to do by hand.

1

Set-and-forget updates

"Every Monday, update the specials from this spreadsheet." An agent reads the sheet, writes one field, and commits. You review it, or let it publish.

2

Sync from a source of truth

Pull events from a calendar or products from a database into the page. Kiln stays the presentation layer, with no build step and nothing to keep in sync by hand.

3

Edit with your AI assistant

Tell Claude or any MCP client to change the copy or swap a photo caption. kiln-mcp edits the real page and returns the commit.

4

Bulk changes across pages

Add a seasonal banner to forty location pages, or update a phone number everywhere, in one reviewable batch instead of forty clicks.

5

Publish from other tools

A form submission, a webhook, or a CI step updates a field. Kiln becomes something the rest of your stack can write to.

6

Read your content anywhere

A native app, a second site, or an email newsletter reads a page's fields as JSON. The page is both the website and the data source.

Write access you can actually trust.

Giving a script or an AI the keys to your website is only sensible if it's boxed in. Kiln's API inherits every guardrail the editor already enforces.

Scoped

Only the fields you allow

A token can be limited to a single field on a single page. Even a confused or misused agent can't touch the rest of your site, your menu, or your config.

Sanitized

No scripts, ever

Every write is checked on the server, not just in a browser. An agent can't slip a <script> or a tracking pixel into a page, no matter what it sends.

Reversible

Every change is a commit

Nothing is a silent database write. Each edit is a Git commit with a name on it, so you can review it, diff it, or roll it back in one click.

Shipped in v0.4.0.

REST, scoped tokens, and kiln-mcp are live. A few conveniences are still ahead — we are honest about that.

Now

REST API + scoped tokens

GET /api/v1/pages, GET /api/v1/fields, PATCH /api/v1/edits. Owner-minted tokens scoped by path, section keys, read-only, and expiry.

Now

kiln-mcp

An MCP server over that API. Point Claude or any MCP client at your site; every edit returns its commit. Runs from a clone of the repo today: node kiln/mcp/index.mjs.

Later

SDKs & recipes

Small JavaScript and Python clients, plus ready-made recipes (sync from a sheet, sync from a calendar) are not shipped yet.

Later

Dashboard tokens & a recipe library

Minting from a dashboard, scheduled syncs, Zapier, and a shareable recipe library are still ahead. Tokens today are minted against the worker.

What it costs.

The API runs on the same worker as the editor. On Kiln Cloud that is auth.kilncms.com. If you self-host, it runs on your worker — nothing extra to deploy. kiln-mcp is open source. There is no separate API plan and no new price on today’s plans.

Questions.

Is any of this available now?

Yes. The REST API, scoped tokens, and kiln-mcp shipped in v0.4.0 on 19 August 2026. Editing by clicking the page, inviting editors, and the members area were already there.

Is it safe to let an AI edit my live site?

That's the whole design. A token is scoped to specific pages and fields, every write is sanitized on the server so scripts can't get in, and each change is a Git commit you can review or undo. An agent can't reach anything you didn't hand it.

How fast do changes go live?

A write is a commit, and your host rebuilds from it, usually within about a minute. It's built for content that changes through the day or the week, not for a live data feed that updates every second.

Do I need a database or a schema?

No. Your page's data-cms tags already say what's editable, and that's what the API reads and writes. Same content, same repo, no new moving parts.

Will it work if I self-host?

Yes. Kiln is open source, so the API runs on your own worker. You bear the compute, so there's nothing for us to meter.

How do I connect kiln-mcp?

Mint a scoped token against the worker, then grab the server: git clone https://github.com/kilncms/kiln && npm --prefix kiln/mcp install. Point your MCP client at node kiln/mcp/index.mjs with KILN_WORKER_URL and KILN_API_TOKEN set. Setup notes live in the kiln-mcp README.

AI builds the site. Kiln keeps it current.

If you need a safe place for a script or an agent to write to a real website, the API is the same fields your editors already click.

Set up kiln-mcp