MCP Tools connects Drupal to AI assistants like Claude, allowing you to describe desired changes in plain English. The AI then automatically creates content types, fields, roles, and other Drupal configurations based on your requests. It offers different security modes for development, staging, and production environments.
MCP Tools connects Drupal to AI assistants (Claude, Cursor, Windsurf) via the Model Context Protocol. Describe what you want in plain English - the AI handles the Drupal work.
Example
You: "Create a blog with articles, categories, tags, and an editor role"
AI: Creates the content type, taxonomies, fields, role, and permissionsQuick Start
- Install:
composer require drupal/mcp_tools
drush en mcp_tools -y - Configure: Visit
/admin/config/services/mcp-toolsand choose a preset:- Development: Full access, no rate limiting
- Staging: Config-only mode, rate limited, audit logging
- Production: Read-only mode, strict limits, full audit trail
- Connect your AI tool: See transport options below
Option A: STDIO Transport (Recommended for Local)
Enable the STDIO module:
drush en mcp_tools_stdio -y
Generate config automatically:
drush mcp-tools:client-config > .mcp.json
Detects DDEV/Lando environments and outputs ready-to-use config. Use --scope=read for read-only.
Claude Code (run from your Drupal directory):
cd /path/to/drupal
claude mcp add --scope project drupal -- drush mcp-tools:serve --quiet --uid=1 --scope=read,writeOr add .mcp.json to your Drupal project root:
{
"mcpServers": {
"drupal": {
"command": "drush",
"args": ["mcp-tools:serve", "--quiet", "--uid=1", "--scope=read,write"]
}
}
}Option B: HTTP Transport (Remote/Docker)
Enable the remote module:
drush en mcp_tools_remote -y
Configure execution user: Visit /admin/config/services/mcp-tools/remote
- Quick setup: Check "Use site admin (uid 1)" — simple for development
- Production: Click "Create MCP Executor Account" for a dedicated service account
Generate an API key:
drush mcp-tools:remote-key-create --label="Claude" --scopes=read,write
Copy the key shown (it's only displayed once).
Claude Code one-liner:
claude mcp add drupal http://localhost:8080/_mcp_tools --transport http -H "Authorization: Bearer YOUR_API_KEY"
Or add to .mcp.json:
{
"mcpServers": {
"drupal": {
"type": "http",
"url": "http://localhost:8080/_mcp_tools",
"headers": {
"Authorization": "Bearer YOUR_API_KEY"
}
}
}
}Manage keys at /admin/config/services/mcp-tools/remote or via drush mcp-tools:remote-key-list.
The tool library also works through MCP Server 2.x via its Tool Bridge, or with no MCP server at all - as plain Tool API plugins for ECA and AI Agents (via the mcp_tools_ai submodule).
What's Included
226 tools across 36 optional submodules:
- Site Building: Content types, fields, taxonomies, roles, permissions, menus
- Content: Create/edit/publish nodes, media, bulk operations
- Translations: Read translatable content in document order, create complete linked translations, update single languages — paragraphs-aware
- Views & Layout: Views, blocks, Layout Builder, image styles
- Admin: Cache, cron, config management, security audits
Security
- Scoped access (read/write/admin per connection)
- Read-only and config-only modes
- Rate limiting and audit logging
- Destructive operations require explicit confirmation; unknown tool parameters are rejected, not silently dropped
- Designed for local development - remote access is optional
Requirements
- Drupal 10.3+ or 11
- Tool API module
- PHP 8.3+
Links
Depends on
Dependencies of the latest stable release
No dependencies recorded for this project.
Required by
Tracked projects that depend on this one
No tracked projects depend on this one yet.
Activity
Release Timeline
Releases
| Version | Type | Core | Notes | Release date | |
|---|---|---|---|---|---|
| 1.0.0-beta18 | Pre-release | 10–11 | Sampling-powered alt text generation (the client's model describes images), per-item progress notifications for bulk operations, and parameterized resources (drupal://node/{nid}, drupal://config/{name}) | Jul 24, 2026 | |
| 1.0.0-beta17 | Pre-release | 10–11 | Native user confirmation for destructive deletes (elicitation), typed outputSchema on all tools, full-surface weekly compatibility sweep against MCP Server Tool Bridge. | Jul 24, 2026 | |
| 1.0.0-beta16 | Pre-release | 10–11 | New mcp_tools_translate submodule (3 translation tools, paragraphs-aware). Fixes paragraphs >= 1.18 fatal and a Tool API outputs issue affecting external consumers. | Jul 24, 2026 | |
| 1.0.0-beta15 | Pre-release | 10–11 | Safer deletes (breaking), unknown parameters rejected, config-deploy and remote transport fixes, Layout Paragraphs support. Requires drupal/tool >= 1.0.0-beta2 | Jul 24, 2026 | |
| 1.0.0-beta14 | Pre-release | 10–11 | Jun 13, 2026 | ||
| 1.0.0-beta13 | Pre-release | 10–11 | Jun 13, 2026 | ||
| 1.0.0-beta12 | Pre-release | 10–11 | Jun 12, 2026 | ||
| 1.0.0-beta10 | Pre-release | 10–11 | Jun 12, 2026 | ||
| 1.0.0-beta9 | Pre-release | 10–11 | Jun 12, 2026 | ||
| 1.0.0-beta8 | Pre-release | 10–11 | Jun 12, 2026 | ||
| 1.0.0-beta7 | Pre-release | 10–11 | 1.0.0-beta7 — Re-enables SVG support in Remote Media with proper XSS sanitization via enshrined/svg-sanitize. SVG uploads are now sanitized to strip <script> tags, event handlers, <foreignObject>, and remote references. Adds an extensible saniti | Mar 10, 2026 | |
| 1.0.0-beta6 | Pre-release | 10–11 | New: Remote media fetching submodule (community contribution by guillaumeg). 223 tools across 35 submodules. | Mar 10, 2026 | |
| 1.0.0-beta5 | Pre-release | 10–11 | Code quality & CI hardening: zero PHPCS violations, 5 new unit tests, accurate documentation, drush client-config command. | Feb 26, 2026 | |
| 1.0.0-beta4 | Pre-release | 10–11 | Fix ApiKeyManagerTest failures on Drupal 11 caused by the frozen REQUEST_TIME | Feb 26, 2026 | |
| 1.0.0-beta3 | Pre-release | 10–11 | Fix ApiKeyManagerTest failures on Drupal 11 caused by the frozen REQUEST_TIME fix in beta3. | Feb 26, 2026 | |
| 1.0.0-beta2 | Pre-release | 10–11 | DefaultToolErrorHandler | Feb 6, 2026 | |
| 1.0.0-beta1 | Pre-release | 10–11 | First beta release with 222 tools across 34 submodules. Full PHP MCP ecosystem integration with 5 standalone Composer packages. 741 tests passing on Drupal 11 + PHP 8.4. | Jan 10, 2026 | |
| 1.0.0-alpha26 | Pre-release | 10–11 | External package extraction and service interface improvements | Jan 9, 2026 | |
| 1.0.0-alpha24 | Pre-release | 10–11 | Admin mcp user checkbox | Jan 8, 2026 | |
| 1.0.0-alpha23 | Pre-release | 10–11 | Restored 4 unit tests. Fixed ContentTypeService to use proper dependency injection | Jan 8, 2026 | |
| 1.0.0-alpha21 | Pre-release | 10–11 | Test coverage milestone + Admin UI improvements | Jan 7, 2026 | |
| 1.0.0-alpha20 | Pre-release | 10–11 | Configuration presets (dev/staging/prod modes), compound scaffold operations, text format tools, and architecture documentation. | Jan 4, 2026 | |
| 1.0.0-alpha18 | Pre-release | 10–11 | Fixes template audit logging, improves batch/migration consistency, and significantly expands automated test coverage to raise overall reliability (and Codecov). | Jan 4, 2026 | |
| 1.0.0-alpha17 | Pre-release | 10–11 | Remote HTTP origin allowlisting + JS SDK (Codex/Claude) compatibility smoke test in CI. | Jan 4, 2026 | |
| 1.0.0-alpha16 | Pre-release | 10–11 | Bugfix: MCP schema compatibility for empty-input tools; improved STDIO docs (--uid) | Jan 4, 2026 | |
| 1.0.0-alpha15 | Pre-release | 10–11 | Richer audit logs + safer remote setup, expanded config previews, improved CI/tool schema validation, more deterministic MCP E2E. | Jan 4, 2026 | |
| 1.0.0-alpha14 | Pre-release | 10–11 | Hardens the remote HTTP transport (now refuses to run as uid 1) and expands HTTP E2E coverage (IP allowlist + least-privilege service user), with updated docs and starter bundles. | Jan 4, 2026 | |
| 1.0.0-alpha13 | Pre-release | 10–11 | Safer defaults and remote hardening (IP allowlist + expiring keys), plus stronger E2E/schema coverage. | Jan 4, 2026 | |
| 1.0.0-alpha12 | Pre-release | 10–11 | Config-change tracking for MCP tool calls, SSRF-hardened broken-link scanning, Drupal 11/PHP 8.4 CI fix, and expanded test coverage. | Jan 4, 2026 | |
| 1.0.0-alpha1 | Pre-release | 10–11 | First public alpha release | Jan 3, 2026 |