AI agents in your CMS, with a person in control
What AI agents can and can't do in CMS Orbit, how to connect Claude, Cursor or VS Code over MCP, and why nothing they draft goes live without a person's approval.
4 min read
On this page
AI assistants are good at first drafts. They can write a page, tidy up search descriptions or adapt a page for another country in minutes. What most organisations worry about is the next step: who checks the work, and what stops an assistant publishing something it shouldn't?
CMS Orbit answers both. Agents connect over the Model Context Protocol (MCP), work within the rights of the person who connected them, and nothing they draft goes live until another person approves it.
What an agent can do
Once connected, an agent works in CMS Orbit the way an editor does, using the same pages, components and checks:
- Find and read pages, menus and the website's schema
- Write new drafts and change existing ones
- Improve search titles and descriptions, and check SEO issues
- Copy pages to other regions
- Upload images and write their alt text
- Leave comments and send its drafts for review
- Move its own unused drafts and uploads to the bin
Ask it in plain words, such as 'Improve the SEO descriptions on our five weakest pages', and it gets to work.
What an agent can never do
An agent has no tools for publishing, unpublishing, scheduling, deleting other people's work, changing prices or promotions, managing people, roles, settings or schemas, or reading the audit trail. Those tools don't exist for it, and the permission checks refuse those actions too, so it can't reach them another way.
For banners, popups, landing pages and shop products, an agent can only change the wording, never schedules, targeting, prices or codes.
A person decides what goes live
Every page an agent creates or changes is marked Drafted by AI. A page with that mark can't be published until a person approves it in review. The person the agent acted for can't approve it themselves, because they count as its author: someone else must.
Agents also stay away from work that's with people. They can't change a page that's in review, scheduled to go live, part of a scheduled release or being edited by someone at that moment.
Rights that never grow
An agent acts for one person. It can only do what that person can do, and never more than a short list of drafting permissions. If the person can't edit a region or a content type, neither can their agent.
Administrators stay in charge of where agents work:
- Per organisation and website: Agents are allowed in the organisation by default, and switched on for each website by an Administrator.
- Staging first: Agents can read Production but only draft elsewhere, unless an Administrator allows drafts in Production.
- Regions: An agent key can be limited to some regions. It can still read the others, but not change them.
Connecting an assistant
The MCP server's address is https://app.bifrostorbit.com/cms/mcp, and CMS Orbit is listed in the official MCP Registry as com.bifrostorbit/cms. There are two ways to connect:
| Question | Sign in | Agent key |
|---|---|---|
| How it works | The assistant opens a browser and you sign in to Bifröst Orbit as usual | You create a key and add it to the client's settings |
| Best for | Claude, Claude Code, Cursor and VS Code | Clients that can't sign in, scripts and scheduled jobs |
| Regions | Every region you can change | Every region, or only the ones you choose |
| How long it lasts | Until revoked, as long as it's used at least once every 30 days | 7, 30 or 90 days, or 1 year |
On the AI agents screen, Add to Cursor and Add to VS Code set it up in one step, and there's a command to copy for Claude Code. In Claude, add a custom connector with the address above. Any other MCP client that supports Streamable HTTP works too. The guide to connecting an AI agent has the details.
Limits per plan
Your plan sets how many agent connections the organisation can have at once, counting active keys and sign-ins: 2 on Starter, 10 on Growth and no limit on Enterprise. Revoke a connection at any time to free a place.
Writing with AI inside the editor is separate. On Growth, it uses your organisation's own key from Anthropic, OpenAI, Mistral or OpenRouter, and Enterprise includes up to 5,000 requests a month without a key of your own.
Every change has a name
The audit trail records both the agent and the person it worked for, and every review shows which agent sent it. Anything an agent moves to the bin can be restored, exactly as if a person had deleted it.
An example
The head of marketing at a retailer asks Claude to copy the Pricing page to the Switzerland region and adapt the wording. Claude makes a linked copy, adapts the spelling and currency wording, leaves the regional prices untouched and sends it to a colleague for review. The page carries the Drafted by AI mark until the colleague approves it, and the audit trail shows Claude acting for the person who asked.
Try it
Start a trial, switch agents on for your website and connect the assistant you already use. Read more on the AI agents page, or see what editors see when an assistant drafts.