Agent Access

What this is

Agent Access for Drupal lets an external AI agent connect to a Drupal site through a person's existing Drupal account. The connection is standards-based (MCP + OAuth, no Drupal-specific client code), and the agent can only do what that person can already do - the site's own permissions, workflows, and revision history stay in charge. It's a recipe: it assembles existing contrib modules and ships no code of its own.

Status: experimental - read this first

• Early v0.1 candidate. Not covered by Drupal's security advisory policy.
• Not composer-installable yet — two required modules have broken drupal.org packaging (fixes are upstream). REVIEWING.md in the repository has a working local setup.

What it installs

simple_oauth, Tool API (tool, tool_belt), and the MCP server stack (mcp_server, mcp_server_tool_bridge, mcp_server_oauth), plus two read-only OAuth scopes mapped to permissions every site already has. It creates no roles, no accounts, no content types - and installs no AI model, provider key, or chatbot.

Get involved

Review the recipe and the evidence from the first conformance run (REVIEWING.md is the guide), try it on a throwaway site and report what differs, or pick up an issue in the queue. This is a contribution to the Drupal AI Initiative's "Outside AI" work - external agents using Drupal - alongside #3576908: [META] 2026 Innovation Roadmap (draft).