Webflow MCP

Live

OAUTH 2.0

WEB CMS

Design

CMS collection items, page content, and site publishing controls your agent needs to manage your Webflow site live in Webflow MCP. Webflow MCP gives your website agent per-user OAuth access — no shared service account, no credential sprawl.

  • Acts as the user: Every CMS update and publish action runs under the authorizing editor's Webflow workspace permissions.
  • Credentials stay vaulted: AES-256, resolved at request time, never in LLM context.
  • Scoped before every call: User permissions enforced. 90-day audit trail on every site change.
Webflow MCP
agent · Acme Q3
Run
Update the meta descriptions for all blog posts published this month that are missing one, then publish the site.
S
webflow_cms_items_list
94ms
Website agent
8 blog posts found without meta descriptions. Generated and patched all 8 (avg 147 chars). Site published to production — changes live in 23 seconds.
Sources: Webflow CMS blog collection, site publish API
webflowmcp
8
18:29
Message Claude...

Tools your website agent reaches for on Webflow, scoped per editor.

CALL ANY TOOL
OAuth-scoped per editor. Every CMS update and site publish attributed to the authorizing workspace member.
webflowmcp_ask_webflow_ai
Ask webflow ai
Ask Webflow AI any question about the Webflow API and get a direct answer.
Parameters
Name
Type
Required
Description
context
string
Required
Description of what the user is trying to accomplish, used to select the right action.
message
string
Required
Your question about the Webflow API.
webflowmcp_asset_tool
Asset tool
webflowmcp_component_builder
Component builder
webflowmcp_data_agent_instructions_tool
Data agent instructions tool
webflowmcp_data_assets_tool
Data assets tool
webflowmcp_data_cms_tool
Data cms tool
webflowmcp_data_comments_tool
Data comments tool
webflowmcp_data_component_props_tool
Data component props tool
webflowmcp_data_component_tool
Data component tool
webflowmcp_data_component_variants_tool
Data component variants tool
webflowmcp_data_element_settings_tool
Data element settings tool
webflowmcp_data_element_tool
Data element tool
webflowmcp_data_enterprise_tool
Data enterprise tool
webflowmcp_data_forms_tool
Data forms tool
webflowmcp_data_localization_tool
Data localization tool
webflowmcp_data_pages_tool
Data pages tool
webflowmcp_data_sitemap_tool
Data sitemap tool
webflowmcp_data_sites_tool
Data sites tool
webflowmcp_data_style_tool
Data style tool
webflowmcp_data_webhook_tool
Data webhook tool
webflowmcp_data_whtml_builder
Data whtml builder
webflowmcp_de_component_tool
De component tool
webflowmcp_designer_tool
Designer tool
webflowmcp_element_builder
Element builder
webflowmcp_element_snapshot_tool
Element snapshot tool
webflowmcp_get_asset_preview
Preview get asset
webflowmcp_get_image_preview
Preview get image
webflowmcp_style_tool
Style tool
webflowmcp_variable_tool
Variable tool
webflowmcp_webflow_guide_tool
Webflow guide tool

For more tools, view docs.

Build your Agent
Drop the toolkit in, point it at the authorized editor, and your agent can manage Webflow CMS collections and pages from the first run.
Python · LlamaIndex
import { ScalekitClient } from "@scalekit-sdk/node";
import { DynamicStructuredTool } from "@langchain/core/tools";
import { createReactAgent } from "@langchain/langgraph/prebuilt";
import { z } from "zod";

const sk = new ScalekitClient(envUrl, clientId, clientSecret);

const { tools } = await sk.tools.listScopedTools("user_123", {
filter: { connectionNames: ["webflowmcp"], toolNames: ["webflow_cms_items_list", "webflow_cms_item_update", "webflow_page_settings_update"] },
pageSize: 100,
});

const lcTools = tools.map((t) => new DynamicStructuredTool({
name: t.tool.definition.name,
description: t.tool.definition.description,
schema: z.object({}).passthrough(),
func: async (args) => {
const { data } = await sk.tools.executeTool({
toolName: t.tool.definition.name,
identifier: "user_123",
params: args,
});
return JSON.stringify(data);
},
}));

const agent = createReactAgent({ llm, tools: lcTools });
import { ScalekitClient } from "@scalekit-sdk/node";
import OpenAI from "openai";

const sk = new ScalekitClient(envUrl, clientId, clientSecret);
const openai = new OpenAI();

const { tools } = await sk.tools.listScopedTools("user_123", {
filter: { connectionNames: ["webflowmcp"], toolNames: ["webflow_cms_items_list", "webflow_cms_item_update", "webflow_page_settings_update"] },
pageSize: 100,
});

const llmTools = tools.map((t) => ({
type: "function",
function: {
name: t.tool.definition.name,
description: t.tool.definition.description,
parameters: t.tool.definition.input_schema,
},
}));

const resp = await openai.responses.create({
model: "gpt-4o", input: prompt, tools: llmTools,
});
import { ScalekitClient } from "@scalekit-sdk/node";
import Anthropic from "@anthropic-ai/sdk";

const sk = new ScalekitClient(envUrl, clientId, clientSecret);
const anthropic = new Anthropic();

const { tools } = await sk.tools.listScopedTools("user_123", {
filter: { connectionNames: ["webflowmcp"], toolNames: ["webflow_cms_items_list", "webflow_cms_item_update", "webflow_page_settings_update"] },
pageSize: 100,
});

const llmTools = tools.map((t) => ({
name: t.tool.definition.name,
description: t.tool.definition.description,
input_schema: t.tool.definition.input_schema,
}));

const msg = await anthropic.messages.create({
model: "claude-sonnet-4-6", max_tokens: 1024,
tools: llmTools,
messages: [{ role: "user", content: prompt }],
});
import { Agent } from "@google/adk/agents";
import {
MCPToolset, StreamableHTTPConnectionParams,
} from "@google/adk/tools/mcp";

const toolset = new MCPToolset({
connectionParams: new StreamableHTTPConnectionParams({
url: "https://mcp.scalekit.com/webflowmcp",
headers: { Authorization: `Bearer ${userScopedToken}` },
}),
});

const agent = new Agent({
name: "agent", model: "gemini-2.0-flash",
tools: await toolset.getTools(),
});
Try these prompts
Paste any prompt into your website agent to start managing Webflow CMS collections and site content.
Search & recall
Copy the prompt
Copied
List all CMS collections in my [site name] Webflow site.
Copy the prompt
Copied
Get all items in the [collection name] collection with their published status.
Copy the prompt
Copied
List all pages on [site name] with their slugs and SEO titles.
Create & publish
Copy the prompt
Copied
Create a new item in the [collection] collection with name: [name] and fields: [fields].
Copy the prompt
Copied
Update the meta description for [item name] in the [collection] collection.
Copy the prompt
Copied
Publish all draft items in the [collection] collection and trigger a site deploy.
SEE HOW AUTH WORKS
Editors authorize Webflow once. Their OAuth token stays vaulted, every CMS update runs under their identity, and every change is logged.
1
Authorize
Your user connects
Webflow MCP
once. We tie it to their identity and the meetings they approved — no shared bot account, no org-wide access
Who:
user ‘A’
when:
Once per user
access:
Limited to user
2
Store
Their
Webflow MCP
token lives in a vault scoped to them. User A's meetings are never reachable by an agent acting for user B, even on the same connection
vault:
encrypted
scope:
per-user
tokens:
auto-refreshed
3
Resolve
When your agent calls a
Webflow MCP
tool, we fetch the right token server-side. It never touches your agent, never appears in the LLM context, never shows up in your logs
speed:
~40ms
check:
before every call
seen by:
nobody
4
Audit
Every
Webflow MCP
tool call is logged — who triggered it, which meeting was fetched, what came back. 90 days of history, tied to the user who authorized it
history:
90 days
export:
SIEM-ready
logged:
every call
Test other agents
Same per-user auth pattern across other website and CMS connectors.
Engineering Teams
DevOps assistant agent
Polls GitHub for failing checks and stale PRs, opens Linear issues for the ones that need work, and posts a daily digest to Slack. It acts as the engineer, not a shared service account.
Engineering Teams
Engineering standup agent
Pulls commits from GitHub and GitLab, tracks issue movement in Jira, and posts a per-engineer standup brief to Slack. Each engineer's activity is read on their own delegated OAuth.
Engineering Teams
Auto release notes agent
Reads merged GitHub PRs, groups them into structured release notes, publishes the page to Notion, and announces the release in Slack. Every call runs on the engineer's own delegated OAuth.
Engineering Teams
Slack triage
Polls Slack for new messages, classifies bugs and support requests with a LangGraph router, files GitHub issues or Zendesk tickets, and confirms in the thread.
Test other agents
Same per-user auth pattern across other website and CMS connectors.
ENGINEERING
DevOps assistant agent
Poll GitHub for failing checks and stale pull requests, open Linear issues for the ones that need work, and digest to Slack.
ENGINEERING
Engineering standup agent
Pull commits from GitHub and GitLab, track Jira issue movement, and post a per-engineer standup brief to Slack.
ENGINEERING
Auto-release notes agent
Group merged GitHub PRs into structured release notes, publish the page to Notion, and announce the release in Slack.
ENGINEERING
Slack triage agent
Classify new Slack messages as bugs or support requests, file the GitHub issue or Zendesk ticket, and reply in the thread.
Why Scalekit
Secure your agent's access. Connectors ship in minutes
01.
Shared tokens break per-user analytics
A shared token looks fine in a demo. In production every call looks like a service account. Scalekit resolves the real user credential so attribution, audit, and scope stay accurate.
// shared token
 audit → bot_service_account
 user_filter → broken

 // scalekit
 audit → user_abc
 scope → enforced ✓
02.
Authentication is not authorization
03.
Multi-tenancy is architectural
04.
Webflow MCP today. Others tomorrow.
“Our agents act across Salesforce, Gong, Google Drive, and more, on behalf of every customer. Scalekit behind the scenes meant we can keep adding tools without ever rebuilding how credentials or tool calling work.”
Venu Madhav Kattagoni
Head of Engineering / Von
FAQs
Frequently Asked Questions
Does the agent access Webflow as the user or a shared service account?
As the user. Each editor authorizes once via OAuth and Scalekit resolves their credential at request time. CMS updates and site publishes appear under that editor's Webflow identity, not a shared bot account.
Where is the Webflow OAuth token stored?
In Scalekit's AES-256 vault, namespaced per tenant. Refresh is automatic. Revocation is a single dashboard action. Tokens never appear in prompts, logs, or LLM completions.
Can I prevent the agent from publishing to the live site?
Yes. Use listScopedTools to allow CMS item reads and draft updates but block the webflow_site_publish tool. Editors can review AI changes in Webflow Studio before publishing goes live.
What happens when an editor revokes Webflow access?
The connection is invalidated on the next tool call for that editor. Subsequent requests fail closed. Other workspace members remain unaffected. The revocation event is logged for audit.
Can the agent update Webflow CMS and trigger a downstream SEO or analytics workflow?
Yes. A single agent can update Webflow CMS items, publish the site, and ping a Google Search Console reindex or PostHog event in the same workflow. Each connector resolves under the same editor identity with its own vaulted credential.
Start in your coding agent
Up and running in one command
Install the Scalekit skill in your editor of choice. Connector, auth, tools, prompt, all wired up
Claude Code REPL
/plugin marketplace add scalekit-inc/claude-code-authstack
/plugin install agentkit@scalekit-auth-stack
Cursor Code REPL
# ~/.cursor/mcp.json
{
""mcpServers"": {
""webflowmcp"": {
""url"": ""https://mcp.scalekit.com/webflowmcp"",
""headers"": { ""Authorization"": ""Bearer $SCALEKIT_TOKEN"" }
}
}
}
Codex Code REPL
# ~/.codex/config.toml
[mcp_servers.webflowmcp]
url = ""https://mcp.scalekit.com/webflowmcp""
auth_env = ""SCALEKIT_TOKEN""
Copilot Code REPL
# .vscode/mcp.json
{
""servers"": {
""webflowmcp"": {
""url"": ""https://mcp.scalekit.com/webflowmcp"",
""type"": ""http""
}
}
}