MCP & AI: Connect ChatGPT, Codex, Claude, and More

Connect Luna Sites to an AI client

MCP (Model Context Protocol) is a standard way for an AI client to discover and use tools from another service. Luna Sites provides one account-wide endpoint; after OAuth sign-in, it exposes only the sites and operations allowed by your current Luna role and granted scopes.

Luna Account MCP endpoint: https://lunasites-api.onrender.com/account-mcp

Before you connect

• Sign in with the Luna account that owns or administers the sites you intend to use.

• Copy the endpoint only from Account Settings in Luna Sites; do not reuse an endpoint copied from an untrusted message or page.

• Know the target site ID or name so you can confirm the correct site before any authoring action.

• Review the requested OAuth scopes and match them to the task.

• Never paste a Luna password or API key into an AI client. Luna uses OAuth, so no Luna API key or password is required.

Find and copy the endpoint

Open Luna Sites Account Settings , find AI clients & MCP, and copy the MCP server URL shown there. The same account-wide endpoint works with ChatGPT, Codex, Claude, and other compatible remote MCP clients.

The screenshot above shows the server URL and the four connection steps in Luna Sites. Keep the endpoint unchanged, including the /account-mcp path.

Complete the OAuth connection

1. Paste the Luna endpoint into the AI client.

2. Choose OAuth, or let the client discover OAuth automatically.

3. Sign in to the correct Luna account.

4. Review the requested scopes and the client identity.

5. Choose Allow access.

6. Back in the AI client, ask Luna to list your sites and select the intended site before editing.

What happens during authorization

Luna uses OAuth 2.1 authorization code flow with PKCE S256, dynamic client registration, short-lived access tokens, rotated refresh tokens, and the offline_access scope for refresh access. The OAuth metadata is available at the Luna authorization-server metadata endpoint.

Connect ChatGPT on the web

The current ChatGPT Work surface may expose LunaSites under Settings → Plugins. Open LunaSites there and review its action permissions. The screenshot above demonstrates the connected state and the permissions surface.

Use the current Plugins surface

1. Open Settings → Plugins.

2. Open LunaSites and review which actions ChatGPT may request.

3. In a chat, enable or select LunaSites.

4. Ask it to list accessible sites before requesting an edit.

Create a custom app for a workspace

For Business, Enterprise, or Edu workspaces where custom apps are enabled, open Settings or Workspace settings → Apps → Create, enter the Luna endpoint, choose OAuth, select Scan Tools, and then choose Create.

Availability, menu labels, and the administrator or developer permissions required to create an app vary by plan and workspace configuration. See the official guides for connecting MCP servers to ChatGPT and developer mode and custom MCP connectors.

Start safely in a chat

Enable or select the LunaSites plugin or app, then begin with a read-only request such as “List the Luna Sites I can access.” Confirm the intended site before asking ChatGPT to edit, publish, or delete anything.

Connect Codex

In Codex, open Settings → MCP servers → Add server → Streamable HTTP, paste the Luna endpoint, choose Save, restart Codex, and then authenticate.

Add the server in the Codex interface

1. Choose Streamable HTTP as the server transport.

2. Paste https://lunasites-api.onrender.com/account-mcp.

3. Choose Save, restart Codex, and select Authenticate.

4. Complete Luna OAuth and review the requested scopes.

Use the shared Codex configuration

The Codex desktop app, CLI, and IDE extension use the same host configuration. Add this server entry:

[mcp_servers.lunasites]

url = "https://lunasites-api.onrender.com/account-mcp"

auth = "oauth"

Then run codex mcp login lunasites. Use codex mcp list or /mcp to confirm that the server is connected and its tools are available.

For current host configuration and OAuth behavior, see the official Codex MCP documentation.

Connect Claude

Open Customize → Connectors → + → Add custom connector, paste the Luna endpoint, choose Add, and then choose Connect to complete OAuth.

Add a custom connector

1. Enter a clear name such as Luna Sites.

2. Paste https://lunasites-api.onrender.com/account-mcp.

3. Choose Add, then Connect.

4. Sign in to Luna, review the scopes, and allow access.

Team and Enterprise administration

For Team and Enterprise, an Owner or Primary Owner adds the connector at the organization level. Members then connect their own Luna accounts individually. Menus and availability vary by plan and the current rollout.

Use the remote-connector route

Luna is a remote, account/cloud-mediated connector. A local claude_desktop_config.json file configures a separate local-server mechanism and is not the route for this remote Luna endpoint. See the official Claude custom connector guide.

Connect other compatible clients

Any client that supports remote Streamable HTTP MCP servers and OAuth can use the same Luna endpoint. Follow that client’s remote-server workflow, complete Luna OAuth, review scopes, and select a site before authoring.

The MCP Inspector is an advanced testing and debugging tool for checking the OAuth handshake and tool discovery. It is not the normal everyday client for managing a Luna site.

What Luna can do through MCP

Available tools are controlled by both the OAuth scopes granted to the client and your current role on each site. One account-wide connection never bypasses site membership or authoring permissions.

Read actions

• sites:read: list accessible sites and select a site based on the current role.

• analytics:read: read analytics for accessible sites.

• responses:read: read form submissions and newsletter signups.

Create and write actions

• sites:create: create a blank site or a site from a Luna template. Importing a website URL is not available through MCP.

• content:write: owners and Administrator collaborators can edit pages, sections, blocks, navigation, Footer, theme, SEO, media, and workflow.

Administrator collaborators can select and edit sites they administer. Contributors remain read-only and cannot select a site for authoring.

Publish actions

• publish:write: owners and Administrator collaborators may publish within their current permissions. Publishing still requires explicit user confirmation.

Destructive actions

• sites:delete: owner-only, granted as a separate explicit OAuth scope, and still requires explicit confirmation for the exact site.

Membership and role changes take effect on the next MCP request, so reconnecting is not normally required after an administrator updates access.

Permissions and safety

• Verify the AI client identity and its callback or redirect destination before approving access.

• Review every requested scope; grant only what the current task needs.

• Keep write, publish, and destructive actions confirmation-gated in your prompt and workflow.

• Do not grant sites:delete casually. It is separate because site deletion is permanent.

• Never paste a Luna password or API key into a client. Complete authorization only through Luna OAuth.

• Disconnect or revoke a client when it is no longer used.

Handoff: moving editing control safely

A page lock prevents two editors from saving over each other. A handoff transfers editing control safely from the current editor to the next one as a single operation, instead of force-unlocking the page underneath someone who is still working.

Handoff changes only who can edit the page now. It does not publish the page, change site roles or permissions, or give AI permanent access. Accepting a handoff leaves the page’s publication state unchanged.

When AI asks to edit a page you have open

If you own the page lock and Luna MCP needs to change the page, MCP sends an approval-required handoff request. The editor shows “MCP wants to edit.”

There is no countdown. The request remains pending until you explicitly accept or decline it. No response keeps your page lock and keeps AI blocked.

If the page has unsaved edits, choose Save & hand off to save them for the next editor, or Discard & hand off to transfer the last saved version. Choose Cancel if you are not ready to hand off.

On acceptance, your editor becomes read-only and the page lock transfers to MCP. If you saved changes, MCP must re-read and synchronize the latest page before continuing.

On decline, you keep the page lock and AI remains blocked. Neither accepting nor declining publishes the page.

When you take the page back from AI

In the open editor, use Take over to take control of an MCP-owned page lock immediately.

The transfer is atomic: the previous MCP lock can no longer be used, and the editor synchronizes the latest AI changes before manual editing begins.

Use this when you want to inspect the result, correct something, or continue the work yourself.

When another person asks to edit

Human-to-human edit requests have a 3-minute response window. The current editor can hand off now or keep editing during that window.

If the current editor does not answer, the requester repeats the request after the countdown and the page lock transfers automatically.

Choose Save & hand off to preserve the latest edits before transfer. Choose Discard & hand off to transfer the last saved version instead.

Lock lifetime and safe workflow

MCP page locks expire after 10 minutes without a mutation, and each mutation refreshes that idle timeout. When the task is complete, luna_finish_edit_prompt releases the page locks held by that MCP client.

Use this safe workflow:

1. Finish or save your current edits, and approve a handoff only when you are ready.

2. Let the next editor synchronize or re-read the latest saved page before changing it.

3. Use Take over whenever you need to inspect, correct, or continue the work manually.

4. Review the finished page, then publish separately only when you intend to make it public.

If AI is waiting for the current editor

Return to the editor tab where the page is open and explicitly accept or decline the request. Closing or ignoring the request does not approve MCP; AI remains blocked until you decide.

Example prompts

List the Luna Sites I can access and select lunasitesoficialwebsite.

Audit /docs/dashboard/mcp-ai and report issues only. Do not edit or publish.

Update the page after showing me the plan. Do not publish.

Show analytics for the last 30 days.

List recent form responses without exposing unnecessary personal data.

Troubleshooting

Wrong Luna account

Disconnect the Luna connection in the AI client, reconnect, and sign in with the Luna account that owns or administers the target site.

Authentication required or token expired

Choose Authenticate, Login, or Reconnect in the client and complete OAuth again. Short-lived access tokens are refreshed through rotated refresh tokens when the client supports the granted offline access.

Connected, but no site selected

Ask the client to list accessible Luna sites, then select the exact site ID before running site-editing tools.

Read-only role

A Contributor can read but cannot select a site for authoring. Ask the owner to grant Administrator access if editing is required, then retry on the next MCP request.

Missing publish permission

Reconnect and grant publish:write only if publishing is genuinely needed and your site role permits it. Even with the scope, confirm the exact publish action explicitly.

Tools changed or look outdated

Use Refresh, restart the client, or reconnect the server so it repeats tool discovery. In Codex, restart after changing MCP configuration and check codex mcp list or /mcp.

Menus do not match this guide

Client menu labels and availability can differ by plan, workspace policy, version, and rollout. Use the client’s current Settings, Plugins, Apps, Connectors, or MCP servers area and consult the linked official guide.

Disconnect or revoke access

Remove or disconnect LunaSites in the AI client when you no longer need it. For a complete cutoff, revoke the client’s Luna OAuth authorization, then reconnect later only with the scopes required for the new task.

Connection checklist

• Correct Luna account confirmed.

• Endpoint copied from Luna Account Settings.

• Client identity, callback, and requested scopes reviewed.

• OAuth completed without sharing a Luna password or API key.

• Target site listed and selected before editing.

• Write, publish, and delete actions kept behind explicit confirmation.

• Unused clients disconnected or revoked.

Authoritative links

• Luna Account MCP endpoint

• Luna OAuth authorization-server metadata

• ChatGPT apps and MCP servers

• ChatGPT developer mode and custom MCP

• Codex MCP

• Claude custom connectors

• MCP Inspector