KilnAn API and MCP server for the site your AI built.
The fields people edit by clicking can also be read and written by scripts and AI assistants: limited to the pages and fields you allow, checked on the server, and saved as a commit in your own GitHub repository, where you can review or undo it. It works on plain HTML pages; the content files of a site Astro builds are not reachable through it yet.
Two ways in. Same content, no new database.
Your page already declares what's editable, with data-cms tags. That doubles as the schema, so there's nothing extra to model. Point either interface at a plain HTML page and you get its fields.
The REST API
Read a page’s fields as JSON and write field-level edits back. Authenticated with an owner-minted token scoped by path, section keys, read-only, and expiry. Wire it into a script, a cron job, or a form handler. Every write is sanitized and committed with attribution.
kiln-mcp
Connect Kiln to Claude or any MCP client. The agent can list pages, read fields and apply edits. That is all it can do. “Mark us closed on the 4th” becomes a real edit to your hours, and every write returns its commit.
The page is the interface.
Three endpoints on the same worker the editor already uses. Read the fields, change one, and the write becomes a commit that your host redeploys: the same path every change made by clicking already takes. Send a Bearer token the site owner minted.
# List pages this token can see GET /api/v1/pages # Read what's editable on a page GET /api/v1/fields?path=/ → { "path": "index.html", "fields": { "hero_headline": { "value": "Fresh sourdough daily", "kind": "field" }, "hours": { "value": "Mon to Sat, 7 to 3", "kind": "field" } } } # Change one field: it becomes a Git commit PATCH /api/v1/edits { "path": "/", "edits": [{ "key": "hours", "html": "Closed July 4th" }] }
Worker: auth.kilncms.com on Kiln Cloud, or your own worker if you self-host. Owner-minted tokens via POST /admin/api-tokens.
What it is for.
The common thread: small, recurring content changes that are too minor to hire for and too frequent to do by hand.
Set-and-forget updates
"Every Monday, update the specials from this spreadsheet." An agent reads the sheet, writes one field, and commits. You review it, or let it publish.
Sync from a source of truth
Pull events from a calendar or products from a database into the page. Kiln stays the presentation layer, with no build step and nothing to keep in sync by hand.
Edit with your AI assistant
Tell Claude or any MCP client to change the copy or swap a photo caption. kiln-mcp edits the real page and returns the commit.
The same change on many pages
A script updates a phone number on every page that shows it: one request and one commit per page, each one in History with its own way back.
Publish from other tools
A form submission, a webhook, or a CI step updates a field. Kiln becomes something the rest of your stack can write to.
Read your content elsewhere
A server, a script or an app reads a page's fields as JSON, so a newsletter or a second site can show the same words. A web page on another address can read them only if your sign-in service allows that address.
Write access you can actually trust.
Giving a script or an AI the keys to your website is only sensible if it's boxed in. Kiln's API inherits every guardrail the editor already enforces.
Only the fields you allow
A token can be limited to certain pages, or to certain fields on them, and to reading only. Limit it, and an agent cannot touch the rest. A token made without limits can edit every field on every page. No token can change the host’s settings, GitHub workflows or any script.
No scripts, ever
Every write is checked on the server, not just in a browser. Whatever an agent sends, it cannot add a <script>, an event handler, a javascript: link, a frame or a form to a page. Pictures from other addresses are allowed, as in any edit.
Every change is a commit
Nothing is a silent database write. Each edit is a Git commit with a name on it, so you can review it, diff it, or roll it back in one click.
Shipped in v0.4.0.
REST, scoped tokens, and kiln-mcp are live. A few conveniences are still to come.
REST API + scoped tokens
GET /api/v1/pages, GET /api/v1/fields, PATCH /api/v1/edits. Owner-minted tokens scoped by path, section keys, read-only, and expiry.
kiln-mcp
An MCP server over that API. Point Claude or any MCP client at your site; every edit returns its commit. Runs from a clone of the repo today: node kiln/mcp/index.mjs.
SDKs & recipes
Small JavaScript and Python clients, plus ready-made recipes (sync from a sheet, sync from a calendar) are not shipped yet.
Dashboard tokens & a recipe library
Minting from a dashboard, scheduled syncs, Zapier, and a shareable recipe library are still ahead. Tokens today are minted against the worker.
What it costs.
auth.kilncms.com. If you self-host, it runs on your worker, with nothing extra to deploy. kiln-mcp is open source. There is no separate API plan and no new price on today’s plans.
Questions.
Is any of this available now?
Yes. The REST API, scoped tokens, and kiln-mcp shipped in v0.4.0 on 19 August 2026. Editing by clicking the page, inviting editors, and the members area were already there.
Is it safe to let an AI edit my live site?
It is built for it. Give the token only the pages and fields the job needs. Every write is checked on the server so scripts cannot get in, and each change is a Git commit you can review or undo.
How fast do changes go live?
A write is a commit, and your host rebuilds from it, usually within about a minute. It's built for content that changes through the day or the week, not for a live data feed that updates every second.
Do I need a database or a schema?
No. On a plain HTML page, the data-cms marks already say what is editable, and that is what the API reads and writes. Same content, same repository.
Will it work if I self-host?
Yes. Kiln is open source, so the API runs on your own worker. You bear the compute, so there's nothing for us to meter.
How do I connect kiln-mcp?
Mint a scoped token against the worker, then grab the server: git clone https://github.com/kilncms/kiln && npm --prefix kiln/mcp install. Point your MCP client at node kiln/mcp/index.mjs with KILN_WORKER_URL and KILN_API_TOKEN set. Setup notes live in the kiln-mcp README.
AI builds the site. Kiln keeps it current.
If you need a safe place for a script or an agent to write to a real website, the API is the same fields your editors already click.
Set up kiln-mcp