Agent Access
Agent Access allows an external AI agent to securely connect to a Drupal site using a user's existing Drupal account. It leverages existing Drupal modules and standards to ensure the agent only performs actions permitted by the site's existing user roles and permissions, without introducing new code or AI models. This project facilitates external AI agent integration with Drupal by utilizing standard authentication and Drupal's built-in access control systems.
What this is
Agent Access for Drupal lets an external AI agent connect to a Drupal site through a person's existing Drupal account. The connection is standards-based (MCP + OAuth, no Drupal-specific client code), and the agent can only do what that person can already do - the site's own permissions, workflows, and revision history stay in charge. It's a recipe: it assembles existing contrib modules and ships no code of its own.
Status: experimental - read this first
- Early v0.1 candidate. Not covered by Drupal's security advisory policy.
- Not composer-installable yet — two required modules have broken drupal.org packaging (fixes are upstream). REVIEWING.md in the repository has a working local setup.
What it installs
simple_oauth, Tool API (tool, tool_belt), and the MCP server stack (mcp_server, mcp_server_tool_bridge, mcp_server_oauth), plus two read-only OAuth scopes mapped to permissions every site already has. It creates no roles, no accounts, no content types - and installs no AI model, provider key, or chatbot.
Get involved
Review the recipe and the evidence from the first conformance run (REVIEWING.md is the guide), try it on a throwaway site and report what differs, or pick up an issue in the queue. This is a contribution to the Drupal AI Initiative's "Outside AI" work - external agents using Drupal - alongside #3576908: [META] 2026 Innovation Roadmap (draft).