Weave Code
Boost Laravel Package
laravel/boost
Laravel Boost accelerates AI-assisted development by giving AI tools the context and structure they need to write high-quality, Laravel-specific code. It ships guidelines, docs, and tooling so assistants understand your app's conventions.
Laravel Boost accelerates AI-assisted development by providing the essential context and structure that AI needs to generate high-quality, Laravel-specific code.
Frequently asked questions about Boost
- What is Laravel Boost and what does it actually do?
- Laravel Boost is a developer-tooling package that combines a locally run MCP server with Laravel-specific guidelines, skills, and agent configuration. It is installed with php artisan boost:install and refreshed with boost:update or boost:add-skill. It does not ship runtime code to production; its purpose is to give AI assistants the context to generate better Laravel-specific code.
- Is laravel/boost a production dependency or a dev dependency?
- Laravel Boost is a dev-dependency decision, not a platform decision. It ships no production-facing routes, jobs, or schema and does not sit on the request path. Its blast radius is the developer workstation, repository agent-config files, and whatever database credentials the developer's .env exposes.
- How do I install Laravel Boost in a Laravel application?
- Install it as a dev dependency with composer require --dev laravel/boost, then run php artisan boost:install to generate the MCP server and agent configuration. Use boost:update to refresh guidelines and boost:add-skill to add skills. Commit or review generated files deliberately, and keep the package out of production deployment requirements.
- Which AI clients and config files does Laravel Boost support?
- Laravel Boost writes agent configuration for common AI coding clients, including files like .ai/, .mcp.json, CLAUDE.md, .cursor/rules, and opencode.jsonc. Teams using Claude Code, Cursor, Copilot, or similar Laravel workflows are the primary fit. Sanction which clients you support and decide which generated config formats you will commit and review.
- Is the Laravel Boost database tool safe to use against staging or production?
- The MCP server exposes a DatabaseQuery tool that executes SQL against the connection configured in the app's .env. Read-only enforcement has improved, including a hardened enforced read-only transaction in v2.6.0, but the changelog shows a sustained pattern of bypasses being found and fixed. If .env points at staging, the tool can too, so permit it only against a local database with least-privilege credentials.
- What are the security risks of Laravel Boost remote skill discovery?
- As of v2.5.0, boost:update defaults to third-party guideline discovery, so remote content can land in agent context and repository files. Mitigations include rejecting remote Blade templates, ignoring root SKILL.md, and skipping unrenderable vendor guidelines, but this is still a prompt-injection and supply-chain surface. Decide deliberately whether to enable discovery, restrict egress in devcontainers, and review generated changes.
- Does Laravel Boost modify repository files, and how should I review those changes?
- Yes. The installer and skill commands write and rewrite many files such as .ai/ outputs, .mcp.json, CLAUDE.md, .cursor/rules, and opencode.jsonc. Recent fixes for a skill command deleting the skills directory, MCP server injection dropping a separating comma, and UTF-8 corruption show generated config is fragile. Treat agent-config changes like code and review diffs before committing.
- Which Laravel versions does laravel/boost support?
- The supplied evaluation does not list a Laravel version matrix, so confirm the PHP and Laravel constraints in the package's composer.json and official docs before rollout. The main dependency pressure point called out is laravel/mcp ^0.9.0, plus a permissive Guzzle constraint. Pilot on one repository to verify compatibility with your app's dependency graph.
- How does Laravel Boost fit into CI and testing workflows?
- Laravel Boost adds no production routes, jobs, or schema, so normal Pest, PHPStan, and Pint workflows are unaffected. No CI service changes are required, though you can optionally run artisan commands in a validation CI job if you commit generated agent config. Keep the database tool's credentials out of CI unless that access is deliberately sanctioned.
- How actively maintained is Laravel Boost, and what are the alternatives?
- Laravel Boost has shown weekly-ish release churn, with visible versions 2.4.13 through 2.7.0, so plan to review updates rather than treat it as set-and-forget. For Laravel teams using AI assistants, it is the official context layer and is closer to framework-native than third-party alternatives. If your team does little AI-assisted development, the integration cost may not be repaid.
Weaver
How can I help you explore Laravel packages today?