Weave Code
Laravel Web Mcp Laravel Package
fosseva/laravel-web-mcp
fosseva/laravel-web-mcp helps Laravel applications act as web-based MCP servers, exposing tools and resources to AI clients through the Model Context Protocol. It simplifies adding MCP endpoints using familiar Laravel conventions.
Expose Laravel AI SDK tools to browser agents through Blade and native WebMCP.
Frequently asked questions about Laravel Web Mcp
- What is fosseva/laravel-web-mcp used for?
- fosseva/laravel-web-mcp is a Laravel package that helps your application act as a web-based Model Context Protocol server. It exposes Laravel AI SDK tools to browser agents through Blade and native WebMCP, using Laravel conventions for endpoints. It is currently an alpha release, so treat its API and behavior as provisional.
- How do I install and configure fosseva/laravel-web-mcp in Laravel?
- Install it with Composer and pin the exact alpha version rather than using a floating constraint. Laravel should auto-discover the service provider, and you can publish any provided configuration as part of setup. Because the alpha release notes lack detailed setup guidance, run a short spike in a non-production app to confirm installation, routes, and tool registration.
- Which Laravel and PHP versions does laravel-web-mcp support?
- The provided release information does not document supported Laravel or PHP versions, so compatibility is unproven. Validate the package against your application's Laravel and PHP matrix in CI before adopting it. Pin the exact alpha version and treat Composer updates as code changes that require review.
- Is fosseva/laravel-web-mcp production ready?
- No. Version 0.1.0-alpha.1 is pre-stable and carries high technical risk, including unstable public APIs and incomplete security controls. Use it behind a feature flag and a dedicated route group in a sandbox or internal environment first. Do not route production LLM traffic through it until the tool surface, auth model, and security review are complete.
- What MCP transport does laravel-web-mcp use?
- The package is positioned as a web-based MCP layer for browser agents using Blade and native WebMCP. However, the release notes do not specify whether the implemented transport is HTTP, SSE, stdio, or another variant. Confirm the actual transport and whether it is production-appropriate during your technical spike.
- How do I register and authorize MCP tools per user or tenant in Laravel?
- The exact tool registration API is not documented in the release notes, but it should follow Laravel's service provider and configuration patterns. There is no evidence of built-in per-user or per-tenant tool scoping, so define a minimal allow-listed tool surface and enforce authorization explicitly. Test registration, versioning, and access rules in a non-production environment before exposing any tools.
- How do I secure web-exposed MCP endpoints in Laravel?
- Treat every web-exposed MCP endpoint as an expanded attack surface and apply Laravel authentication and authorization middleware. Add rate limiting, tool allow-listing, input and output sanitization, audit logging, and fail-closed authorization. Use queues or async execution for expensive tools, cap execution time and payload size, and design graceful degradation when the MCP layer is unavailable.
- What are alternatives to laravel-web-mcp for exposing MCP tools in Laravel?
- Consider other MCP server implementations that clearly document transport, authentication, and Laravel compatibility, or build MCP endpoints with Laravel routes and middleware yourself. Compare any alternative against the same criteria: stable API, security controls, test coverage, and maintenance posture. Because this package is alpha, run the same spike and security checklist before choosing it over a custom or more mature option.
- How should I test and roll out laravel-web-mcp safely?
- Start with a technical spike in a non-production Laravel app to confirm installation, transport, and tool registration. Then expose a minimal read-only tool surface behind a feature flag and a dedicated route group, and validate it against your Laravel and PHP matrix in CI. Pilot with internal users and add authentication, rate limiting, audit logging, and load testing before any production promotion.
- How is fosseva/laravel-web-mcp maintained and supported?
- The release notes provide no changelog detail or maintainer information, so assume a small maintainer group and no SLA. Assign an internal owner, pin the alpha version, and budget for frequent breaking changes and upgrade cycles. Establish a runbook and fallback plan, and consider a maintained fork strategy if adoption grows.
Weaver
How can I help you explore Laravel packages today?