Ghost Publisher MCP v0.4.0
Ghost Publisher MCP v0.4.0 is the consolidated production release for safer onboarding, editorial post management, scheduling, and Pages.
Highlights
- One-command setup for Codex, Cursor, and Claude Desktop with hidden key input, exact version pinning, redacted previews, atomic configuration writes, and rollback.
- Bounded author, date, status, title, and ordering discovery without arbitrary Ghost queries.
- Approval-gated post scheduling and unscheduling without newsletter or email parameters.
- Complete safe Pages workflow: browse, read, create drafts, patch drafts, update published metadata, publish, unpublish, and verify public output.
- Metadata clearing, feature-image replacement, optimistic locking, revision saving, and explicit body-replacement acknowledgement.
Security hardening
- Ghost keys stay out of Codex process arguments.
- Configured URLs reject embedded credentials; deploy hooks reject redirects.
- Public URL templates require
{slug}in the path. - Ghost-returned Page URLs reject private and loopback targets outside explicit local development.
- Live-check responses are capped at 2 MB and symlinked client configurations are refused.
- Release OIDC is isolated to publication and release actions are pinned to immutable commits.
Install
npx -y ghost-publisher-mcp@0.4.0 setup --url https://your-ghost.example.comValidated against Ghost 5 and Ghost 6, Linux Node 22/24, and Windows Node 22 setup tests. Published to npm with provenance and to the official MCP Registry.
Full changelog: v0.1.1...v0.4.0