PHPackages alengo/sulu-mcp-server-bundle - PHPackages - PHPackages [Skip to content](#main-content)[PHPackages](/)[Directory](/)[Categories](/categories)[Trending](/trending)[Leaderboard](/leaderboard)[Changelog](/changelog)[Analyze](/analyze)[Collections](/collections)[Log in](/login)[Sign up](/register) 1. [Directory](/) 2. / 3. [API Development](/categories/api) 4. / 5. alengo/sulu-mcp-server-bundle ActiveSymfony-bundle[API Development](/categories/api) alengo/sulu-mcp-server-bundle ============================= Read-only HTTP API exposing local Sulu template XML files (pages, articles, blocks, snippets, properties) for use by MCP servers. 3.0.0(4w ago)011MITPHPPHP ^8.2 Since May 12Pushed 4w agoCompare [ Source](https://github.com/alengodev/SuluMcpServerBundle)[ Packagist](https://packagist.org/packages/alengo/sulu-mcp-server-bundle)[ Docs](https://github.com/alengodev/SuluMcpServerBundle)[ RSS](/packages/alengo-sulu-mcp-server-bundle/feed)WikiDiscussions 3.x Synced 1w ago READMEChangelog (1)Dependencies (6)Versions (3)Used By (0) SuluMcpServerBundle =================== [](#sulumcpserverbundle) Read-only HTTP API exposing local Sulu template XML files (pages, articles, blocks, snippets, properties) for use by an MCP (Model Context Protocol) server. What it does ------------ [](#what-it-does) Provides two authenticated endpoints mounted under the project's admin API prefix (typically `/admin/api`): MethodPathReturns`GET``/admin/api/mcp/templates/{type}`JSON list of template names available for a type`GET``/admin/api/mcp/templates/{type}/{name}`Raw XML body of a single templateDefense-in-depth auth: 1. **Sulu admin session** — the endpoints live under `/admin/api/*`, so the standard admin firewall applies. A request without a valid admin session (cookies) is rejected with `401` before reaching the controller. 2. **Bearer token** — the controller additionally verifies an `Authorization: Bearer ` header. This restricts access to a specific MCP-server client even among logged-in admin users. If the token is not configured (or empty), the API is fully disabled and returns `403`. Installation ------------ [](#installation) ``` composer require alengo/sulu-mcp-server-bundle ``` Register the bundle in `config/bundles.php`: ``` Alengo\SuluMcpServerBundle\McpServerBundle::class => ['all' => true], ``` Import the routing in `config/routes/alengo_mcp_server.yaml`: ``` alengo_mcp_server: resource: "@McpServerBundle/Resources/config/routing_admin_api.yaml" prefix: /admin/api ``` Set the bearer token in `.env.local`: ``` MCP_SERVER_TOKEN= ``` Generate one with e.g. `openssl rand -hex 32`. The MCP client must send **both** the admin session cookies (after authenticating against `/admin/login` with a Sulu admin user) **and** the `Authorization: Bearer ` header. The standard Sulu admin firewall (`^/admin`) protects the path; no `PUBLIC_ACCESS` exception is required in `security.yaml`. Configuration ------------- [](#configuration) The bundle ships with sensible defaults — no configuration file is required. To override defaults, create `config/packages/alengo_mcp_server.yaml`: ``` alengo_mcp_server: # Bearer token. Empty string disables the API. Defaults to the MCP_SERVER_TOKEN env var. token: '%env(string:default::MCP_SERVER_TOKEN)%' # Template type => directory mapping (paths relative to %kernel.project_dir%). template_dirs: page: config/templates/pages article: config/templates/articles block: config/templates/blocks/content snippet: config/templates/snippets property: config/templates/properties ``` You can add additional template types by extending `template_dirs` — the controller will resolve any configured type. Security model -------------- [](#security-model) - **Two-factor auth.** Both a valid Sulu admin session AND the configured bearer token are required. - **Admin firewall first.** The path lives under `/admin/api/*`. Requests without a session never reach the controller. - **Bearer token narrows further.** Even logged-in admins cannot call the endpoint without the MCP token — this prevents accidental misuse from other admin tooling. - **Constant-time comparison** via `hash_equals` to avoid timing attacks. - **Read-only.** No write endpoints. - **Token rotation:** change `MCP_SERVER_TOKEN`, clear cache. The next request with the old token returns `403`. Requirements ------------ [](#requirements) PackageVersionPHP`^8.2`Symfony`^7.0`License ------- [](#license) MIT — [alengo.dev](https://alengo.dev) ### Health Score 41 — FairBetter than 87% of packages Maintenance94 Actively maintained with recent releases Popularity7 Limited adoption so far Community6 Small or concentrated contributor base Maturity47 Maturing project, gaining track record Bus Factor1 Top contributor holds 100% of commits — single point of failure How is this calculated?**Maintenance (25%)** — Last commit recency, latest release date, and issue-to-star ratio. Uses a 2-year decay window. **Popularity (30%)** — Total and monthly downloads, GitHub stars, and forks. Logarithmic scaling prevents top-heavy scores. **Community (15%)** — Contributors, dependents, forks, watchers, and maintainers. Measures real ecosystem engagement. **Maturity (30%)** — Project age, version count, PHP version support, and release stability. ### Release Activity Cadence Every ~0 days Total 2 Last Release 28d ago ### Community Maintainers ![](https://www.gravatar.com/avatar/4a3bea97975bdeddcfa5b76c222740e703e4ff5f9bbf5f6d5d75e8827e0a48ac?d=identicon)[alengodev](/maintainers/alengodev) --- Top Contributors [![hual7](https://avatars.githubusercontent.com/u/89628357?v=4)](https://github.com/hual7 "hual7 (4 commits)") ### Embed Badge ![Health badge](/badges/alengo-sulu-mcp-server-bundle/health.svg) ``` [![Health](https://phpackages.com/badges/alengo-sulu-mcp-server-bundle/health.svg)](https://phpackages.com/packages/alengo-sulu-mcp-server-bundle) ``` ### Alternatives [easycorp/easyadmin-bundle Admin generator for Symfony applications 4.3k17.5M370](/packages/easycorp-easyadmin-bundle) PHPackages © 2026 [Directory](/)[Categories](/categories)[Trending](/trending)[Changelog](/changelog)[Analyze](/analyze)