# Hugo Mcp Go

> Native Go MCP server for Hugo content, tools, SRI checks, chunked assets, and Claude-compatible tool metadata.

- **Type:** MCP server
- **Install:** `agentstack add mcp-jmrgrav-hugo-mcp-go`
- **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior
- **Seller:** [jmrGrav](https://agentstack.voostack.com/s/jmrgrav)
- **Installs:** 0
- **Category:** [Security](https://agentstack.voostack.com/c/security)
- **Latest version:** 0.1.0
- **License:** MIT
- **Upstream author:** [jmrGrav](https://github.com/jmrGrav)
- **Source:** https://github.com/jmrGrav/hugo-mcp-go

## Install

```sh
agentstack add mcp-jmrgrav-hugo-mcp-go
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

# hugo-mcp-go

[](https://go.dev)
[](https://github.com/jmrGrav/hugo-mcp-go/releases/latest)
[](https://github.com/jmrGrav/hugo-mcp-go/actions/workflows/ci.yml)
[](LICENSE)

`hugo-mcp-go` is the Go implementation of the Hugo MCP backend used behind `mcp-runtime-go`.

It is operator-controlled, single-tenant, and designed to serve Hugo content tooling with a native HTTP backend while preserving the older stdio path for rollback.

## Architecture

```text
Claude / ChatGPT / Gemini / other MCP clients
  -> mcp-runtime-go (OAuth, gateway, public MCP surface)
  -> hugo-mcp-go (native HTTP backend)
  -> Hugo site content, assets, and build pipeline

Rollback paths preserved:
  -> hugo-mcp-shim
  -> legacy Python backend
```

`mcp-runtime-go` stays as the public OAuth and connector compatibility layer.
`hugo-mcp-go` provides the backend transport and tool execution.

## Tools

Read and chunked content tools:

- `list_pages`
- `get_page`
- `get_page_chunk`
- `list_assets`
- `get_asset_chunk`

Mutation and operational tools:

- `create_page`
- `update_page`
- `delete_page`
- `upload_asset`
- `build_site`
- `check_sri_versions`
- `generate_featured_image`

## Transport

- Native HTTP mode is explicitly enabled with `HUGO_MCP_TRANSPORT=http`
- `POST /mcp` is the compatibility endpoint
- stdio mode remains available for rollback and local use
- backend-only streaming events are available on `/mcp/events`
- tool catalogs now expose MCP `title` and tool annotations for classification

Example native backend URL:

- `http://127.0.0.1:18181/mcp`

## Configuration

Common required roots:

- `HUGO_ROOT`
- `HUGO_CONTENT_ROOT`
- `HUGO_STATIC_ROOT`

Native HTTP settings:

- `HUGO_MCP_TRANSPORT=http|stdio`
- `HUGO_MCP_HTTP_BIND_ADDR`
- `HUGO_MCP_HTTP_BIND_PORT`
- `HUGO_MCP_HTTP_TOKEN_FILE`
- `HUGO_MCP_STREAMING_ENABLED`
- `HUGO_MCP_MAX_CHUNK_BYTES`
- `HUGO_MCP_MAX_RESPONSE_BYTES`

## Security Model

- file-backed secrets only
- no shell execution
- bounded payload sizes
- traversal and symlink escape rejection
- explicit tool annotations for read-only versus destructive actions
- OAuth remains delegated to `mcp-runtime-go`

See:

- [`docs/ABOUT.md`](docs/ABOUT.md)
- [`SECURITY.md`](SECURITY.md)
- [`docs/KNOWN_ISSUES.md`](docs/KNOWN_ISSUES.md)

## Schema Compatibility

All MCP tool `inputSchema` and `outputSchema` fragments are validated in the test suite to ensure they carry an explicit JSON Schema keyword (`type`, `oneOf`, `anyOf`, `allOf`, `$ref`, `enum`, or `const`). Empty fragments (`{}`) are rejected by the Claude Code MCP validator; the test `TestAllToolSchemasHaveNoEmptyFragments` catches any regression of this kind before it reaches production.

## Validation

The current release has been validated with:

- `go test ./...`
- `go test -race ./...`
- `go vet ./...`
- `scripts/native-http-smoke.sh`

The native backend is live in controlled production, while the shim and Python backend remain preserved for rollback.

License: MIT

## Source & license

This open-source MCP server is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [jmrGrav](https://github.com/jmrGrav)
- **Source:** [jmrGrav/hugo-mcp-go](https://github.com/jmrGrav/hugo-mcp-go)
- **License:** MIT

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** no
- **Filesystem access:** no
- **Shell / process execution:** no
- **Environment & secrets:** no
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: passed — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/mcp-jmrgrav-hugo-mcp-go
- Seller: https://agentstack.voostack.com/s/jmrgrav
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.