Nova Mcp Laravel Package

Product Decisions This Supports

• Roadmap sequencing for admin/back-office automation: v0.2.0 extends Nova MCP from read-only introspection into controlled writes (attach/detach relations, create children, restore/force-delete, run synchronous actions). This unlocks roadmap items like "let support agents resolve records via AI assistants" or "ops tooling can mutate Nova data through MCP" without building a custom API layer.
• Build vs. buy: If your admin surface is Laravel Nova, this package is a strong "buy" (open-source adopt) versus building a bespoke MCP server on top of Nova resources, controllers, and policies. The write path reuses Nova's native controllers, validation, and policy behavior — the expensive part to replicate correctly.
• Feature scoping for AI/agent integrations: The inclusion of nova:write scope, per-token authorization, and the NOVA_MCP_READ_ONLY kill switch makes it feasible to ship an "assistant with limited write access" feature with a defensible security posture, rather than treating agent writes as out of scope.
• Risk/rollout decisions: Because writes are enabled by default on write-scoped tokens, the PM decision is a deliberate one — default the org to read-only in non-prod and stage write tokens behind explicit provisioning.
• Custom guardrail messaging: NOVA_MCP_GUARDRAILS lets product shape the instructions clients receive (e.g., "confirm before destructive actions"), supporting UX policy decisions without forking the package.

When to Consider This Package

• Adopt when: your application is Laravel + Nova and you want MCP clients (Claude, IDE agents, internal assistants) to both read and perform guarded mutations against Nova resources without reimplementing authorization, validation, or relationship semantics.
• Adopt when: you need relationship management (BelongsToMany/MorphToMany attach/detach with pivot validation, HasMany/MorphMany child creation, restore/force-delete) and synchronous Nova actions with canRun, visibility, and policy enforcement intact.
• Adopt when: you require a simple operational off-switch (NOVA_MCP_READ_ONLY=true) that revokes mutation capability globally, including existing write tokens — useful for incident response.
• Look elsewhere when: your admin layer is not Nova, or you need queued actions, standalone actions, or pivot actions — these remain explicitly excluded in v0.2.0.
• Look elsewhere when: you need granular, per-action or field-level write policy beyond what Nova policies and the two-token scope model (nova:read/nova:write) provide, or when "writes on by default" is incompatible with your compliance posture and you cannot enforce read-only via environment configuration.
• Caveat: undefined Nova policy methods fall back to Nova's documented defaults — PMs should confirm those defaults match the intended blast radius before enabling write tokens.

How to Pitch It (Stakeholders)

For executives: Nova MCP v0.2.0 turns our Nova admin from an AI-readable surface into an AI-actionable one — assistants can now make governed changes (link records, create children, restore/delete, run approved actions) through the exact same permissions and validation rules our staff already use. That's a meaningful capability expansion without a parallel authorization system to audit. Risk is bounded by a single environment flag that disables all writes org-wide, and by per-token nova:write scope. Maturity signals are solid for a 0.x package: 126 tests / 1,387 assertions, PHPStan level 6, and CI across PHP 8.3–8.5 and Laravel 12–13.

For engineering: The write path deliberately routes through native Nova controllers and policies rather than shadowing them, so authorization, validation, pivot rules, and action canRun semantics stay consistent with the UI. Upgrade is a composer update mdrbx/nova-mcp plus a config cache rebuild — no migrations or frontend builds. Note the operational requirements: writes require the nova:write scope, remain enabled by default, and the NOVA_MCP_GUARDRAILS text is client guidance only — it is not an authorization control. Treat server-side policy defaults for undefined methods as a review item before issuing write tokens.

Recommendation: Adopt for a bounded pilot (read + relationship writes on non-destructive resources), default environments to NOVA_MCP_READ_ONLY=true outside controlled rollout, and revisit when queued/standalone/pivot actions land or when the package reaches 1.0.