Webflow MCP Server Cursor IDE Setup (2026)

How do you set up the Webflow MCP server in Cursor? Webflow maintains an official server (webflow/mcp-server on GitHub, published as webflow-mcp-server on npm). The fastest path is the remote option — add a url pointing at https://mcp.webflow.com/sse to ~/.cursor/mcp.json and authorize over OAuth in the browser. If you'd rather run it locally with a site-scoped token instead of a hosted OAuth session, that path works too and is covered below. Either way, once it's connected, Cursor can read and edit CMS collection items, manage pages, and work with your site's content model without you tabbing over to the Webflow Designer.

Webflow occupies a different niche than a headless CMS or a code-first framework: it's a visual site builder where marketing and design teams often own the actual page layout, while engineering owns integrations, custom code embeds, and CMS schema. MCP is useful here specifically because it lets an AI in your editor read the current state of a live site's CMS — collection fields, item counts, slugs already in use — instead of you guessing at what's actually configured in the Designer.

What You Can Do With Webflow MCP in Cursor

The exact tool surface depends on your Webflow plan and the permissions attached to your token — Enterprise sites with locked CMS schemas or component libraries expose a narrower set of writable fields than a solo Growth-plan site.

Prerequisites

Method 1: Remote Server with OAuth (Recommended)

Open ~/.cursor/mcp.json and add:

{
  "mcpServers": {
    "webflow": {
      "url": "https://mcp.webflow.com/sse"
    }
  }
}

Restart Cursor. On the first tool call, Cursor opens a browser window for Webflow's OAuth authorization screen. Approve the connection and pick which site(s) it can access — this is the main advantage over the token route: you get a scoped, revocable grant instead of a long-lived credential sitting in a config file, and you can pull up a permissions screen instead of trusting that a token you generated months ago still has the access you think it does.

Method 2: Local Server with a Site Token

Use this if you're on a Cursor version that predates url-based remote servers, or your org's policy prefers a self-managed credential over an OAuth grant.

Step 1: Generate a Webflow API Token

1. In your Webflow site dashboard, go to Site Settings → Apps & Integrations → API access
2. Generate a token scoped to that site (Webflow's Data API is site-scoped by default — a token from Site A doesn't reach Site B's CMS)
3. Copy the token — treat it like any other credential; it inherits whatever access level you picked when generating it

Step 2: Add the Local Server to mcp.json

{
  "mcpServers": {
    "webflow": {
      "command": "npx",
      "args": ["-y", "webflow-mcp-server@latest"],
      "env": {
        "WEBFLOW_TOKEN": "your-site-token-here"
      }
    }
  }
}

The environment variable is WEBFLOW_TOKEN — not WEBFLOW_API_TOKEN or WEBFLOW_API_KEY, which are the names you'd guess by analogy with other MCP servers on this site. If your config silently does nothing, a mismatched variable name here is the first thing to check.

Step 3: Confirm Node Version

Before restarting Cursor, run:

node --version

If it's below v22.3.0, the local server process will fail to launch — install a current Node LTS via nvm or your platform's package manager first. This is a harder requirement than the "Node 18+" baseline most other MCP servers on this site ask for.

Step 4: Restart Cursor and Verify

Fully quit and reopen Cursor. In chat, try:

List the CMS collections on my Webflow site

or

Show me the first 5 items in the Blog Posts collection, including which fields are empty

A response naming real collections or items confirms the connection. An auth error on the local route usually means the token was scoped to the wrong site or has since been revoked from the dashboard.

Practical Workflows

Pre-launch content audit

List every item in the Products collection that's missing a description or a price, so I can flag them before we publish

Bulk draft generation

Draft 8 new CMS items for the Blog Posts collection based on this outline file, matching the field structure of the existing 3 published posts

Redirect and slug cleanup

List all page slugs on the site, then flag any that look like they'd 404 if referenced from an old sitemap

Custom code check before a launch

Show me the custom code embedded on the homepage and the checkout page, and tell me if either references an analytics ID that looks like a staging placeholder

Troubleshooting

OAuth popup never appears (remote server)
Confirm your Cursor version supports url-based MCP entries (0.47+). If it's current and still not firing, disconnect and reconnect the server from Cursor's MCP settings to force a fresh authorization attempt.

"Unauthorized" on the local server
Almost always a token scoped to the wrong site, or a token that was regenerated in the dashboard after you copied the old one. Site tokens don't roll over automatically — a regenerated token invalidates the previous value immediately.

Server won't start locally
Check node --version first. The 22.3.0 minimum trips up more setups than a missing WEBFLOW_TOKEN does, since most people copy a generic Node 18+ prerequisite from another guide and assume it applies here too.

Changes show up in the API but not on the live site
Webflow separates staged CMS/content changes from publishing. An item created or updated via the API exists in the CMS immediately but won't appear on the published site until that page (or the whole site) is published — either manually in the Designer or via a publish-triggering tool call, if your plan and token scope support one.

Can't find "Apps & Integrations" in Site Settings
Webflow's dashboard layout has shifted this menu location across releases. If it's not where this guide describes, search Site Settings for "API access" directly, or check Webflow's own current docs — dashboard navigation changes more often than the underlying API does.

Frequently Asked Questions

Q: Do I need the remote OAuth server or the local npx-based one?
A: The remote server (https://mcp.webflow.com/sse) is simpler for most people — no Node version to manage, no token to store in a file, and access can be revoked from Webflow's side at any time. Use the local server if you're on an older Cursor version, need to run the server in a CI or headless environment where an interactive OAuth popup isn't possible, or your security policy specifically wants a self-issued, individually rotatable credential.

Q: What Node.js version does the local Webflow MCP server actually require?
A: 22.3.0 or higher. This is stricter than the Node 18+ baseline common across most other MCP servers, and it's the most common reason the local server fails to start on a machine that's otherwise correctly configured.

Q: Is a Webflow site token scoped to my whole account or just one site?
A: One site. Webflow's Data API issues tokens per site, so a token generated for Site A has no visibility into Site B's CMS or pages, even under the same account. If you manage multiple sites, you need a separate token (or a separate OAuth authorization) per site.

Q: Can Cursor publish a site through this MCP server, or only edit the CMS?
A: It depends on your token's scope and plan — publish-capable tool calls exist, but whether they're available (and whether you want to grant that capability to an AI agent) is a separate decision from read/CMS-write access. If publishing isn't explicitly something you intend to automate, don't grant that scope when generating the token, and treat any publish-triggering prompt with the same caution you'd give a production deploy command.

Q: How is this different from just using Webflow's REST API directly in a script?
A: Functionally, the MCP server wraps the same Data API — the difference is that Cursor's AI can call it conversationally mid-session, using natural-language prompts instead of you writing and running a one-off script for each query. For a recurring automated job (a nightly CMS sync, for example), a direct API script is still the right tool; MCP is for interactive, ad hoc work inside your coding session.

Related Guides

---