# Hugo Public Mcp

> [DEPRECATED] Superseded by mcp-hugo-server-go

- **Type:** MCP server
- **Install:** `agentstack add mcp-jmrgrav-hugo-public-mcp`
- **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior
- **Seller:** [jmrGrav](https://agentstack.voostack.com/s/jmrgrav)
- **Installs:** 0
- **Category:** [Cloud & Infrastructure](https://agentstack.voostack.com/c/cloud-infrastructure)
- **Latest version:** 0.1.0
- **License:** MIT
- **Upstream author:** [jmrGrav](https://github.com/jmrGrav)
- **Source:** https://github.com/jmrGrav/hugo-public-mcp
- **Website:** https://github.com/jmrGrav/hugo-public-mcp

## Install

```sh
agentstack add mcp-jmrgrav-hugo-public-mcp
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

# hugo-public-mcp

`hugo-public-mcp` is a strict read-only MCP server for published Hugo sites.

It builds an in-memory index from a Hugo `public/` tree at startup and exposes only safe discovery and read tools:

- `list_pages`
- `get_page`
- `search_pages`
- `get_recent_posts`
- `list_tags`
- `list_categories`
- `get_sitemap`
- `get_feed`
- `get_site_information`

## Current status

This repository is at release-candidate quality for the MVP scope:

- startup indexing from `public/`
- read-only MCP tools
- request-path validation
- symlink and traversal rejection
- security-oriented HTTP transport guards
- unit, integration, and scale tests
- CI and lint configuration
- deployment examples for systemd, nginx/openresty, Caddy, Traefik, and Cloudflare
- GitHub repository hardening files, templates, and automated security scans

## Security posture

The public server is intentionally narrow:

- read-only strict
- no shell
- no rebuild
- no writes
- no access to the Hugo source repo
- no direct file paths in the public API
- no draft content
- no runtime HTML scraping for search
- no disk access during requests when the in-memory index is sufficient
- no mutation-capable MCP tools

## Repository governance

The repository includes:

- branch protection rules for `main`
- GitHub Actions CI, lint, CodeQL, and secret scanning
- Dependabot updates
- issue and pull request templates
- a CODEOWNERS file and support guidance

## Configuration

See `examples/arleo.eu/config.example.yaml` for a concrete published-site example.
The binary reads its YAML config from `HUGO_PUBLIC_MCP_CONFIG` and supports `stdio` or `http` transport.

## Documentation

- `docs/installation.md`
- `docs/deployment.md`
- `docs/cloudflare.md`
- `docs/api-shield.md`
- `docs/dns-aid.md`
- `docs/openapi.md`
- `docs/oauth-runtime-evaluation.md`
- `docs/architecture.md`
- `docs/threat-model.md`
- `docs/mvp-validation.md`
- `docs/security-tests.md`
- `docs/go-interfaces.md`
- `docs/deployment-pattern.md`
- `docs/release-readiness.md`

## Development

Run the test suite:

```bash
go test ./...
```

Run lint:

```bash
golangci-lint run ./...
```

## Project goal

Provide a reusable, secure, Hugo-oriented MCP surface that improves agent discoverability and content reading without creating an execution platform.

Is Your Site Agent-Ready? https://isitagentready.com/www.arleo.eu

## Source & license

This open-source MCP server is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [jmrGrav](https://github.com/jmrGrav)
- **Source:** [jmrGrav/hugo-public-mcp](https://github.com/jmrGrav/hugo-public-mcp)
- **License:** MIT
- **Homepage:** https://github.com/jmrGrav/hugo-public-mcp

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** no
- **Filesystem access:** no
- **Shell / process execution:** no
- **Environment & secrets:** no
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: passed — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/mcp-jmrgrav-hugo-public-mcp
- Seller: https://agentstack.voostack.com/s/jmrgrav
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.