---
title: "MCP Hugo Server Is Now Public: npm and Claude Desktop"
description: "The MCP server running this blog is now public on npm and Claude Desktop, after weeks of adversarial security audits."
url: "https://www.arleo.eu/en/posts/mcp-hugo-server-go-public/"
language: "en"
datePublished: "2026-08-02T09:35:51Z"
dateModified: "2026-08-02T09:35:51Z"
tags: ["mcp","claude","homelab","open-source","security"]
categories: ["infrastructure"]
contentSignal: "ai-train=no, search=yes, ai-input=yes"
---

# MCP Hugo Server Is Now Public: npm and Claude Desktop
The MCP server running this blog is now public on npm and Claude Desktop, after weeks of adversarial security audits.



## In short

This blog has been run for months by [mcp-hugo-server-go](https://github.com/jmrGrav/mcp-hugo-server-go), a Go MCP server.

It gives Claude direct, secure access to arleo.eu's Hugo content: creating, editing, publishing, taxonomy management, images, and more.

It's the successor to the [6-tool FastAPI/Python server](/en/posts/hugo-mcp-server/) documented here back in May.

This post explains why a project originally built for strictly personal use is now something anyone running a Hugo site can install.

## Why this isn't just "a script that happens to work"

Most content-management MCP tools I've come across handle the happy path and stop there.

This one has been through repeated functional audits over several weeks, plus a genuine adversarial red-team pass — not replaying the same scenarios that originally found bugs, but actively trying to break it.

Some concrete results from that testing:

- **File uploads** — the declared extension isn't trusted, actual content is inspected via magic-byte sniffing. A PHP payload renamed to `.png` gets rejected, not just a bare `.php` file.

- **SVG** — a strict element-level allowlist, not just a `<script>` blocklist. `<animate onbegin=...>`, `<foreignObject>`, and XXE attempts via `<!DOCTYPE>` are all rejected outright.

- **Idempotency** — replaying a used key with a different payload is detected and rejected rather than silently served from cache. A class of cache-confusion bug that affects a lot of MCP implementations.

- **Test-content bypass** — the marker that protects a throwaway test page from accidental publication is locked down at three independent layers (logic validation, schema rejection, field allowlist). I specifically tried to defeat each one.

- **HTML/SQL injection** — injection attempts against the search engine and the Markdown body were neutralized with no information leakage.

None of this hardening is decorative — each protection maps to a real attack vector I tested myself.

### What really sets it apart for an AI agent

What makes this MCP stand out isn't the raw tool count. It's the combination of guarantees that are rarely found together in a Hugo MCP:

- **Safe writes**, protected by page-revision and bundle-revision guards.
- **Idempotency and mutation-status recovery** after a timeout or uncertain response.
- **Atomic bilingual bundle plans with rollback**, so every translation can be applied or restored as one editorial unit.
- **Isolated previews before publication**, without touching the public site.
- **A complete featured-image lifecycle**: generation, attachment, inspection, detachment, and deletion.
- **Strict asset validation**, including rejection of hostile SVG payloads.
- **Test-content safety** designed to prevent accidental publication.
- **Stage-aware build and publication verification**, with explicit status for each phase.
- **Storage, runtime, Git, theme, SRI, SEO, AI-readiness, and link diagnostics** directly available to the agent.
- **Structured, agent-repairable errors** instead of vague strings that require guesswork.

That combination is unusually mature for a static-site MCP. Over the course of these audits, the project has stopped looking like a simple wrapper around Markdown files and started behaving more like a small transactional editorial layer designed to let an AI agent operate autonomously without giving up safety rails.

## A real feedback loop

The project has shipped close to a dozen releases in a single month, with a changelog that documents each change precisely and cites reproduction steps.

The most telling detail: several fixes explicitly reference external audits that found the underlying bug.

This isn't a project you discover broken six months later. It's a development cycle that absorbs feedback and ships fixes fast.

## What changed recently: available to everyone

Until recently, this server only ran on my own infrastructure. That's no longer true:

- **`npx @jmrgrav/mcp-hugo-server-go`** — one-command install, SHA-256-verified binary, published with cryptographic provenance traceable to the exact commit and GitHub Actions run that built it

- **Claude Desktop extension (`.mcpb`)** — one-click install, local OAuth-free mode, manually tested on Windows

- **Submitted to the Claude Connectors Directory** — currently under Anthropic review

- **Self-hosted HTTP+OAuth mode** — still available for anyone who wants to run it remotely, exactly like arleo.eu does

Two transport modes, one binary, no regression on either from adding the other.

## Installing it

The full installation guide — both transport modes, environment-variable vs. file configuration, troubleshooting — lives on the **[project's GitHub wiki](https://github.com/jmrGrav/mcp-hugo-server-go/wiki)**.

The repository itself is at [github.com/jmrGrav/mcp-hugo-server-go](https://github.com/jmrGrav/mcp-hugo-server-go).

If you run a Hugo site and want Claude to be able to drive it directly — safely — this is built for exactly that.

## Tags

- mcp
- claude
- homelab
- open-source
- security

## Categories

- infrastructure