Pimcore Mcp Bundle Laravel Package

Stamp the page's CSP nonce onto the injected browser-collector script so it isn't blocked by Content-Security-Policy.

The collector is injected as an inline at the top of . Pages that enforce a CSP with a nonce in script-src (the Pimcore admin does, per request) cause the browser to ignore 'unsafe-inline', blocking any inline script without a matching nonce.

• ClientErrorScriptInjector now reads the script-src nonce from the response's enforcing Content-Security-Policy header and passes it to the collector builder (report-only policies are ignored, since they block nothing).
• CollectorScript::html() accepts an optional nonce and adds an HTML-escaped nonce="…" attribute when present. Pages without a CSP are unchanged.

Chunk client-error flushes to stay within the browser's beacon/keepalive size limit and retry on failure.

• Pull a size-bounded chunk (MAX_BEACON_BYTES = 50KB) per flush so a burst of errors never exceeds the ~64KB sendBeacon cap, which would otherwise make the whole batch fail.
• Honour sendBeacon's return value: when it declines (payload too large or disabled), fall back to fetch instead of dropping reports silently.
• Add credentials: 'same-origin' to the fetch fallback.
• Requeue a failed chunk (bounded to MAX_QUEUE) and reschedule so a later flush can retry and drain the remainder.

Inject the browser collector script at the top of so it runs before any other page script.

The collector's window.onerror / 'error' listener and console.error/console.warn wrappers only capture what happens after they are installed. Moving injection from just before to immediately after the opening tag (falling back to , then ) ensures the collector executes first and no longer misses errors thrown by the page's own head/body scripts.

What's new

Add frontend (browser) error collection to the MCP bundle.

New MCP tools

• get_frontend_errors — read browser-captured JS errors / unhandled rejections / console.error + console.warn from the running site, filterable by kind, surface and timestamp.
• frontend_error_stats — counts of stored browser errors/warnings grouped by type and surface.
• clear_frontend_errors — reset the store before reproducing an issue.

How it works

• Zero-config and debug-only. A high-priority kernel.request listener owns the fixed path /_pimcore-mcp/client-errors, short-circuiting it before routing and the security firewall — no route to register, no authentication required. Outside debug mode the collector effectively does not exist.
• A kernel.response listener appends the collector <script> before </body> for full HTML documents on the main request, covering both the public website and the Pimcore admin. JSON/XHR, redirects, downloads and streamed responses are left untouched.
• Reports are stored as JSON Lines in the log directory (frontend-errors.jsonl, rotated at 5 MB) — no database required. Free-text fields are clipped and each beacon is capped (≤ 64 KB, ≤ 50 reports).

Full Changelog: https://github.com/aashan10/pimcore-mcp-bundle/commits/1.0.0