PHPackages danielgnh/statamic-mcp - PHPackages - PHPackages [Skip to content](#main-content)[PHPackages](/)[Directory](/)[Categories](/categories)[Trending](/trending)[Leaderboard](/leaderboard)[Changelog](/changelog)[Analyze](/analyze)[Collections](/collections)[Log in](/login)[Sign up](/register) 1. [Directory](/) 2. / 3. danielgnh/statamic-mcp ActiveLibrary danielgnh/statamic-mcp ====================== MCP server for Statamic — manage entries, terms, and globals from AI clients over streamable HTTP. v0.4.2(1mo ago)21.6k↑2350%MITPHPPHP ^8.3CI passing Since Jul 12Pushed 1mo agoCompare [ Source](https://github.com/danielgnh/statamic-mcp)[ Packagist](https://packagist.org/packages/danielgnh/statamic-mcp)[ RSS](/packages/danielgnh-statamic-mcp/feed)WikiDiscussions main Synced 1w ago READMEChangelog (10)Dependencies (20)Versions (15)Used By (0) Statamic MCP ============ [](#statamic-mcp) [![Latest Version](https://camo.githubusercontent.com/de52c4acbb05041e9294d26cabdd231bbd4cb8f6bd1f14d73134a231e6db6059/68747470733a2f2f696d672e736869656c64732e696f2f7061636b61676973742f762f64616e69656c676e682f73746174616d69632d6d6370)](https://packagist.org/packages/danielgnh/statamic-mcp)[![Tests](https://github.com/danielgnh/statamic-mcp/actions/workflows/tests.yml/badge.svg)](https://github.com/danielgnh/statamic-mcp/actions/workflows/tests.yml)[![License](https://camo.githubusercontent.com/7013272bd27ece47364536a221edb554cd69683b68a46fc0ee96881174c4214c/68747470733a2f2f696d672e736869656c64732e696f2f62616467652f6c6963656e73652d4d49542d626c75652e737667)](LICENSE.md) This package presents a remote **MCP server for Statamic v6**, which makes it possible to manage your content (entries, taxonomy terms, globals, and assets) via any AI provider. Statamic's permission system is deciding who may do what. Built on the first-party [`laravel/mcp`](https://laravel.com/docs/mcp) package. Requirements ------------ [](#requirements) - PHP ^8.3 - Statamic ^6.0 (Laravel 12 or 13) - For OAuth mode only: `laravel/passport` + a database for Passport's own tables (your users stay wherever they are — file users work) Installation ------------ [](#installation) ``` composer require danielgnh/statamic-mcp ``` That's it — no config publishing required. The connected user needs the **Access MCP** permission (or super). Grant it in the Control Panel under the role's permissions — `mcp:token` warns you at issuance if the user doesn't have it yet. Prefer a guided setup? One interactive command handles either auth mode — including every OAuth prerequisite — and finishes by running `mcp:doctor` as proof: ``` php please mcp:setup ``` It's scriptable too — `--oauth --yes` (or `--token --user=you@site.com --yes`) runs unattended, which is what the bundled [Laravel Boost](https://laravel.com/docs/boost)guidelines teach AI coding agents to use. Boost users get them automatically on `boost:install`. Token vs. OAuth mode -------------------- [](#token-vs-oauth-mode) ClientToken modeOAuth modeClaude Code / Cursor✅✅claude.ai / Claude Desktop connectors (individual plan)❌ no static headers✅Claude Team/Enterprise connectors⚠️ org-admin-configured headers only✅ChatGPT connectors❌ OAuth or no-auth only✅What Statamic MCP can do? ------------------------- [](#what-statamic-mcp-can-do) 19 tools across five areas — every agent session is starting with `statamic_overview`, which reports the sites, resources, and capabilities visible to the acting user: - **Discovery** — `statamic_overview`, `blueprints_get` (fields + a valid example payload for writes) - **Entries** — `entries_list`, `entries_get`, `entries_create`, `entries_update`, `entries_delete` - **Taxonomy terms** — `terms_list`, `terms_get`, `terms_create`, `terms_update`, `terms_delete` - **Globals** — `globals_get`, `globals_update` - **Assets** — `assets_list`, `assets_get`, `assets_upload`, `assets_update`, `assets_delete` The write semantics are deliberately conservative: - Entry creates and updates save **drafts by default** — agents draft, humans publish. - On revision-enabled collections, edits become **working copies** through the same mechanism the CP uses; the live entry is never touched. - Delete tools aren't even registered unless you opt in (`deletes` config). - Every write response states the resulting liveness ("saved as draft — not live", "working copy created — live entry unchanged", …) and links the CP edit page. See **[docs/tools.md](docs/tools.md)** for the full per-tool reference, including upload limits and the SSRF policy for URL-based asset uploads. Authentication -------------- [](#authentication) ### Token mode (default) [](#token-mode-default) Works on **every** install, including file-based users. Tokens are stored SHA-256-hashed in `storage/statamic/mcp/tokens.yaml` — no database, no migrations — and shown exactly once at issuance. A token authenticates as the Statamic user it was issued for; delete the user and the token dies with them. ``` php please mcp:token you@site.com --name="Claude" --expires-days=90 # issue php please mcp:tokens # list php please mcp:token:revoke {tokenId} # revoke ``` Users can also issue and revoke their own tokens in the Control Panel at **Tools → Utilities → MCP Access** — grant the **Access MCP Tokens utility**permission to enable it. Super admins see (and can revoke) everyone's tokens. ### OAuth mode [](#oauth-mode) For claude.ai, Claude Desktop, and ChatGPT connectors. Client registration, PKCE, discovery, and consent are delegated to `laravel/mcp` + Laravel Passport — and **your users stay exactly where they are, file users included**. The addon brings its own guard: bearers are validated by Passport's ResourceServer, and the token's user resolves through the Statamic repository. No user migration, no `HasApiTokens`trait, no `config/auth.php` edit. Passport just needs a database for its *own*tables (sqlite is fine) and its encryption keys. The easy path is the wizard: ``` php please mcp:setup ``` It installs Passport, flips `STATAMIC_MCP_AUTH=oauth`, runs the migrations (including the addon's user\_id conversion — Statamic ids are UUIDs, Passport's stock columns are bigint), and provisions the Passport keys — never editing a file without showing the change first. Keys are managed in the database (encrypted with `APP_KEY`, shared across servers, provisioned automatically), so deploying is just `php artisan migrate --force` — no PEM blobs to paste anywhere. Explicit `PASSPORT_*` env vars still override for those who want them (`php please mcp:keys` exports the pair). The manual steps, the deploy recipe, and the CP panel for viewing and disconnecting OAuth connections are in **[docs/oauth.md](docs/oauth.md)**. If any prerequisite is missing, the MCP endpoint answers **503 with the exact remedy** — the rest of your site is untouched. Configuration ------------- [](#configuration) ``` php artisan vendor:publish --tag=statamic-mcp-config # → config/statamic/mcp.php ``` KeyDefaultWhat it does`enabled``true` (`STATAMIC_MCP_ENABLED`)Kill switch. When `false` the MCP route is never registered.`route``mcp/statamic`Where the streamable-HTTP endpoint mounts.`auth``token` (`STATAMIC_MCP_AUTH`)`token` or `oauth`.`middleware``['throttle:60,1']`Prepended to the auth middleware on the MCP route. Plain Laravel.`read_only``false` (`STATAMIC_MCP_READ_ONLY`)Hides every write/delete tool from the server entirely.`deletes``false` (`STATAMIC_MCP_DELETES`)Delete tools are not even registered unless `true`.`resources`all `true`Exposure allowlist per type: `true` = all handles, or an array like `'collections' => ['blog', 'pages']`.`per_page``25`Default page size for list tools (hard-capped at 100).`uploads.max_size``10240`Per-upload cap in **kilobytes** for `assets_upload`.`uploads.source_allowlist``null`Exact-host allowlist for `assets_upload` URLs. `null` = any public host; private/reserved addresses are always blocked.> Upgrading from v1.0? Re-publish the config or add `'asset_containers' => true`to `resources` — a published config **without** the key exposes no containers (safe by default). Security model: the token is the user ------------------------------------- [](#security-model-the-token-is-the-user) There are no API scopes and no parallel ACL. Every MCP request authenticates as a real Statamic user, and authorization is always Statamic's native permission system — the same roles UI you already use: 1. **Read-only switch** — `read_only` hides all write/delete tools. 2. **Exposure allowlist** — `resources` decides what exists as far as MCP is concerned. 3. **Native permissions on every call** — `view/edit/create/delete {handle} entries`(and term/global equivalents), publish permissions for publish-state changes, site permissions on multi-site. Denials name the missing permission and the remedy. 4. **Deletes off by default** — both the config flag and the role permission must open. A restricted agent is just a dedicated Statamic user with a restricted role. Ready-made recipes — drafting agent, read-only analyst, publishing agent, site scoping — are in **[docs/permissions.md](docs/permissions.md)**. Troubleshooting --------------- [](#troubleshooting) ``` php please mcp:doctor ``` One command answers "why doesn't my MCP endpoint work?" — it runs every check without short-circuiting and names each problem with the exact remedy. ResponseMeaning`401`Missing, malformed, expired, or revoked token — deliberately identical in every case.`403` "requires 'access mcp'…"Authenticated fine, but the user lacks the `Access MCP` permission.`503` + `remedy` (OAuth mode)An OAuth prerequisite is missing; the body names the exact fix.`404` on the endpointMCP is disabled, or failed to mount — run `mcp:doctor`.Details on every doctor check, and the MCP Inspector, are in **[docs/troubleshooting.md](docs/troubleshooting.md)**. Testing ------- [](#testing) ``` composer test # Pest composer format # Pint ``` License ------- [](#license) MIT — see [LICENSE.md](LICENSE.md). ### Health Score 45 — FairBetter than 91% of packages Maintenance91 Actively maintained with recent releases Popularity25 Limited adoption so far Community6 Small or concentrated contributor base Maturity46 Maturing project, gaining track record Bus Factor1 Top contributor holds 100% of commits — single point of failure How is this calculated?**Maintenance (25%)** — Last commit recency, latest release date, and issue-to-star ratio. Uses a 2-year decay window. **Popularity (30%)** — Total and monthly downloads, GitHub stars, and forks. Logarithmic scaling prevents top-heavy scores. **Community (15%)** — Contributors, dependents, forks, watchers, and maintainers. Measures real ecosystem engagement. **Maturity (30%)** — Project age, version count, PHP version support, and release stability. ### Release Activity Cadence Every ~0 days Total 10 Last Release 42d ago ### Community Maintainers ![](https://www.gravatar.com/avatar/7fc66414f26e8bed17a1a0f212b2f24776c2a0ba5044b501163300f14f4b04a1?d=identicon)[danielgnh](/maintainers/danielgnh) --- Top Contributors [![danielgnh](https://avatars.githubusercontent.com/u/33636385?v=4)](https://github.com/danielgnh "danielgnh (151 commits)") --- Tags connectormcpstatamicstatamic-addonstatamic-mcpmcpaiaddonstatamicclaude ### Code Quality TestsPest Static AnalysisPHPStan, Rector Code StyleLaravel Pint Type Coverage Yes ### Embed Badge ![Health badge](/badges/danielgnh-statamic-mcp/health.svg) ``` [![Health](https://phpackages.com/badges/danielgnh-statamic-mcp/health.svg)](https://phpackages.com/packages/danielgnh-statamic-mcp) ``` ### Alternatives [cboxdk/statamic-mcp MCP (Model Context Protocol) server for Statamic CMS v6 — gives AI assistants structured access to content, blueprints, assets, and more. 3526.5k](/packages/cboxdk-statamic-mcp)[laravel/boost Laravel Boost accelerates AI-assisted development by providing the essential context and structure that AI needs to generate high-quality, Laravel-specific code. 3.6k31.1M882](/packages/laravel-boost)[statamic/statamic Statamic 830185.7k](/packages/statamic-statamic)[statamic-rad-pack/runway Eloquently manage your database models in Statamic. 138249.0k8](/packages/statamic-rad-pack-runway)[statamic/seo-pro 73578.9k](/packages/statamic-seo-pro)[duncanmcclean/statamic-cargo Comprehensive e-commerce addon for Statamic. Build bespoke e-commerce sites without the complexity. 3622.8k](/packages/duncanmcclean-statamic-cargo) PHPackages © 2026 [Directory](/)[Categories](/categories)[Trending](/trending)[Changelog](/changelog)[Analyze](/analyze)