TL;DR
This is a recap for the recent June community Call:
Host Paul opened the call. Marco presented the engineering updates. The rest of the session was community demos of the new MCP server. The updates fell into two groups: quality work on the core, and the move into AI features.
On the quality side, Marco noted that Strapi ships weekly and merges hundreds of pull requests each cycle. About one in five of those came from community contributors rather than the core team. Several of the improvements below came from contributors who needed them.
Four changes stood out for editors:
For developers, the API moved toward stability. The Entity Service API is deprecated and the Document Service is now stable. A new publication filter adds a draft state alongside the published one, so you can run queries like "local drafts that differ from what is live." There is also an optional OpenAPI spec route, and the upload endpoint is now paginated.
Marco covered security briefly. In this window the team published five security issues, plus a rate-limit bypass and a password-reset issue that did not involve sessions. If you are running below 5.37, he said to upgrade now to get the latest patches.
Strapi v4 has reached end of life. It was marked in the codebase alongside the 5.46 release, and 4.26.2 is the final v4 release. Earlier v4 security issues were patched, but there will be no more bug fixes or security patches. If you are on v4 in production, plan the move to v5.
Upgrading to Strapi v4 to v5 docs.
Additional resources here.
The main topic was Strapi's built-in MCP (Model Context Protocol) server, now generally available. Nico built the demo for it but could not attend, so Paul presented it.
If MCP is new to you: it is an open standard for how AI agents find and call tools across your stack, similar to how HTTP standardized web requests. Instead of writing a separate script for each AI assistant, you expose one interface and any MCP-compatible client can use it. With the server built into core, clients like Claude Desktop, Claude Code, and Cursor can read, create, update, delete, publish, and unpublish content through your Content Manager.
The team said this was something they had wanted in core for a while. It is free on any Strapi project, on any plan. The video shows how to enable and connect it.
MCP does not use API tokens. Those are for your content API. MCP access is scoped through an admin token tied to RBAC, so there is no direct database access unless you grant it. Permissions apply at three levels: which tools a client can see, which fields it can read or write, and which locales it can use. Each is limited to what the token allows.
By default, the server generates tools from your schema. In Nico's demo, built around a product collection, an order collection, and a store-settings single type, you get tools like list, create, update, and publish for products without writing them yourself. For custom work, the suggested pattern is to put it in a plugin, so the tooling and any custom admin screens stay in one package. Keep the business logic in a service so a controller and route can reuse it. Paul shared a repo and a write-up that walk through this; both are linked from the video.
Check you the MCP docs. How to set up and build custom tools for Strapi MCP blog.
The demos showed different uses:
Paul introduced a new open-source skills repository the team is building with the community.
Paul ran the main example: a builder skill that interviews you before you write code. It produces a set of documents that define the product and its value, then the user and their story, then the functional requirements, and only then the technical choices. You can hand those documents to a tool like Claude Code, which then has the product context as well as the build steps. Marco asked the community which skills would be most useful; the Discord and GitHub discussions are open.
If you are below 5.37, upgrade for the security patches. If you are on v4, plan the move to v5, since v4 is end of life. To try MCP, turn it on in a non-production project, connect an AI client with a scoped admin token, and test one of the workflows above. Access runs through the admin token and RBAC, so you control what the client can see and do. The full call has the live demos and code walkthroughs.
Strapi's open office hours are now weekly, every Wednesday at 12:30 PM CST on Discord. Bring your questions.
If you are looking for a Strapi starter, check out Notum, a Strapi partner the team highlighted on the call.
Their open-source Strapi and Next.js template is production-ready and runs their own client projects: https://www.notumstrapi.com/ (code at https://github.com/notum-cz/strapi-next-monorepo-starter).
There is also Strapi Launchpad, the official Strapi demo app, with a Strapi 5 backend and a Next.js frontend.
Try live demo for Launchpad here
Citations