AI Access for your website (MCP): Documentation

At a glance

Endpoint

https://www.webentwickler.io/mcp

Transport

Streamable HTTP, JSON-RPC 2.0, stateless

Authentication

OAuth 2.1 (connector) or key wio_mcp_…

Protocol versions

2025-06-18, 2025-03-26, 2024-11-05

Tools

42: 28 read, 13 edit, 1 publish

Location

Our server in Germany

The one rule: content yes, technology never

AI Access may change what your site says: texts, page titles and descriptions for Google. It may never change how your site works. This boundary does not rely on asking the AI nicely; it is built into the server code:

Setup

Without a key: sign in as a connector

claude.ai and Claude Desktop: Settings → Connectors → “Add custom connector”. Enter https://www.webentwickler.io/mcp as the URL and choose “Connect”. The webentwickler.io CRM sign-in opens (a login link by email if you are not signed in). Choose website, permission and how long the connection lasts, then confirm.

Claude Code: add without a key, then type /mcp in Claude Code and choose “Authenticate”:

claude mcp add --transport http webseite https://www.webentwickler.io/mcp

The connection appears in the “KI-Zugang für Ihre Website (MCP)” tab as “Anmeldung (OAuth)” and can be disconnected there at any time. If you did not start the connection yourself, choose “Ablehnen” (decline) on the consent page.

With a key

For clients without OAuth or for scripts, keys remain available.

1. Create a key

In the webentwickler.io CRM, open the tab “KI-Zugang für Ihre Website (MCP)” and click “Neuer Schlüssel” (new key). Choose name, permission, validity and limit (see Keys and permissions). The key starts with wio_mcp_ and is shown exactly once.

2. Connect your AI assistant

Claude Code: one terminal command, insert your key:

claude mcp add --transport http webseite https://www.webentwickler.io/mcp --header "Authorization: Bearer wio_mcp_…"

Claude Desktop: under Settings → Developer → “Edit Config” add this entry (requires Node.js) and restart Claude Desktop:

{
  "mcpServers": {
    "webseite": {
      "command": "npx",
      "args": ["-y", "mcp-remote", "https://www.webentwickler.io/mcp",
               "--header", "Authorization:${AUTH}"],
      "env": { "AUTH": "Bearer wio_mcp_…" }
    }
  }
}

Other clients: Any client that speaks MCP over “Streamable HTTP” (e.g. Cursor) works with the address above, using sign-in (OAuth) or the header Authorization: Bearer wio_mcp_…. Where a firewall strips that header, use X-Api-Token: wio_mcp_… instead.

3. Try it

Example prompts to copy:

• “Which pages does my website have, and which of them lack a description for Google?”
• “Where does the old phone number 04103 123456 still appear?”
• “Change the headline on the home page to ‘Your estate agent on the Elbe’. Show me the preview first.”
• “In the bullet list on /services, add ‘On-site consultation’ after the second item.”
• “Which search terms bring visitors to /services, and does the page title match them?”
• “Which images on the home page lack a good alt text? Suggest better ones.”
• “What is currently in draft and not yet live?”
• “Publish the changes.”

Keys and permissions

Draft, publish, undo

1. Find: use seite_texte, text_suchen or seite_gliederung to locate the right field.
2. Edit: every editing tool creates a draft. The website does not show it yet. The server makes a backup first.
3. Review: vorschau shows old and new side by side, entwurf_stand lists everything pending.
4. Publish: veroeffentlichen publishes all AI Access drafts at once. If something was changed directly on the website in the meantime, the server refuses so nothing is overwritten. Drafts someone started in the webentwickler.io CRM are not included.
5. Undo: rueckgaengig reverts one change (number from aenderungen) or everything since a backup; if the old version was already live, publish again afterwards. entwurf_verwerfen discards drafts without touching the website.

Block pages (e.g. service pages built from blocks) are drafts too. On publishing, the server writes block pages first, each backed up beforehand, then texts, and checks those pages afterwards. You see the same drafts in the admin bar and the editor of the webentwickler.io CRM.

The 42 tools

Tool and parameter names are German and fixed; this is how the assistant calls them. The list matches what the server returns for tools/list.

Orientation

Reading pages and texts

SEO, Google, AI visibility, accessibility and monthly report

Drafts, history and requests

Changing content (draft)

Undo and discard

Online booking

Requests and feedback to our team

Approval and publishing

Outline: headings, lists, cards

• Bullet lists can be edited item by item, at most 30 items, no sub-items. Whether a list is editable is shown by seite_gliederung (bearbeitbar).
• New list under a paragraph: seite_gliederung lists free slots under steckplaetze; liste_bearbeiten with aktion: anlegen inserts a list there.
• Heading levels: the look stays the same, only the level changes, in all languages. The server rejects an H3 before the first H2 or skipped levels, with a reason.
• Cards and entries: when adding, provide every field in every language; at least one entry remains, at most as many as seite_gliederung reports as hoechstens.
• Multilingual pages: lists change only the chosen language; heading levels and the number of cards apply to all languages.
• Pages not yet converted: if seite_gliederung shows nothing switchable, our team converts the template once, via anpassung_beauftragen.

Protocol and error codes

Every request is a POST with JSON-RPC 2.0; the response is application/json. No persistent connection, no session ID, no server-sent event stream. Batches (JSON arrays) from older protocol versions are accepted.

Authorization (OAuth 2.1)

Implemented per the MCP “Authorization” specification (2025-06-18). Without credentials /mcp answers 401 with WWW-Authenticate: Bearer resource_metadata=…, which tells the client where to sign in.

• Redirects only to https://claude.ai/api/mcp/auth_callback, https://claude.com/api/mcp/auth_callback and the local device (http://localhost, 127.0.0.1, [::1]). We enable other clients on request.
• The resource parameter must be https://www.webentwickler.io/mcp. The scope is mcp; website and permission are chosen by the human on the consent page.
• If a code or refresh token is used a second time, the server disconnects the whole connection.

Example

curl https://www.webentwickler.io/mcp \
  -H "Authorization: Bearer wio_mcp_…" \
  -H "Content-Type: application/json" \
  -H "Accept: application/json, text/event-stream" \
  -d '{"jsonrpc":"2.0","id":1,"method":"initialize",
       "params":{"protocolVersion":"2025-06-18","capabilities":{},
                 "clientInfo":{"name":"test","version":"1.0"}}}'

curl https://www.webentwickler.io/mcp \
  -H "Authorization: Bearer wio_mcp_…" \
  -H "Content-Type: application/json" \
  -d '{"jsonrpc":"2.0","id":2,"method":"tools/call",
       "params":{"name":"text_suchen","arguments":{"begriff":"04103 123456"}}}'

Response to tools/call:

{
  "jsonrpc": "2.0",
  "id": 2,
  "result": {
    "content": [{ "type": "text", "text": "{ … }" }],
    "structuredContent": { … },
    "isError": false
  }
}

HTTP status and JSON-RPC errors

What AI Access never does

• Code: PHP, JavaScript, CSS, templates, .htaccess, not even “just one line”.
• Forms: Fields, required fields, recipients, spam protection, confirmation texts.
• Tracking and consent: Counters, Tag Manager, cookie banner, embedded services.
• URLs and indexing: Redirects, robots.txt, sitemap, noindex, canonical, language paths.
• Page structure: Creating or deleting pages, rebuilding sections, reordering the menu. Only what the template provides for is allowed: list items, lists in free slots, heading levels, cards in card rows, blocks on block pages.
• Access: Server access, database, files, websites other than the key's own.

Also locked in stage 1: legal texts (imprint, privacy policy), business details (phone, address, links), FAQ entries, menu labels and images themselves. Alt texts are allowed via alt_text_setzen. For everything else the AI files a request via anpassung_beauftragen; our team reviews and implements it, and anpassungen_liste shows the status.

Messages

Messages from the server are in German. The most important ones:

Privacy

• AI Access runs on our server in Germany.
• For each call we log: time, key, tool, affected field, old and new text and the caller's IP address. You can see the log in the tab.
• What you write to the AI assistant is processed by its provider (e.g. Anthropic) under their own terms. We only receive the tool calls.
• How our servers, connections and backups fit together is described by the datenwege tool and the “Datenwege” tab in the webentwickler.io CRM.

Disconnecting and revoking

If a device is lost or someone leaves the team: click “Widerrufen” (revoke) next to the key or connection in the tab. It takes effect immediately, including for tokens already issued. A key or connection also stops working automatically when it expires or when the person who created it no longer has access to your website.