Onetrace Laravel Laravel Package

Product Decisions This Supports

• Build vs. buy for conversational commerce / AI support. This release effectively lets your existing Laravel store expose its capabilities to the OneTrace AI chat bot via an MCP server (POST /onetrace/mcp). That is a "buy the assistant, build the tools" decision: you avoid building chat infrastructure, intent handling, and session management, while retaining control over exactly which store actions the bot can take.
• Scope of AI autonomy. The store_mcp.tools allowlist is a product-level governance lever: read tools are enabled by default, and write/action tools (e.g., anything beyond lookups) only activate when explicitly listed. This supports phased rollout — launch read-only ("where is my order?", "what's in stock?") and graduate to transactional actions after confidence and review.
• Customer identity and trust flows. findCustomer() and sendCode() give you email-based confirmation codes cached server-side, enabling a verification step before the bot discloses account-specific data or performs actions. This supports decisions about how much account context to expose in chat and what friction is acceptable for convenience vs. security.
• Frictionless entry into chat for signed-in users. @onetrace passing the signed-in customer to the bot (cdp.chatCustomer()) means authenticated shoppers get personalized, context-aware chat without re-identifying themselves — a measurable conversion/support-experience improvement lever.
• Operational ownership. The onetrace:store-mcp artisan command (--key to mint, --disconnect to revoke) makes connection lifecycle a routine ops task rather than a bespoke integration project, lowering the cost of piloting and of rolling back.
• Roadmap signal: the package is investing in MCP as the extension standard. If MCP becomes your integration pattern, future store capabilities (returns, subscriptions, loyalty) can ship as handler extensions rather than new vendor integrations.

When to Consider This Package

• Consider it if: you run a Laravel-based storefront with customer accounts and email, you already use (or are evaluating) the OneTrace AI chat bot, and you want the bot to answer questions and take actions against real store data rather than generic FAQ content.
• Consider it for a pilot if: you want a low-effort conversational support/commerce experiment — the MCP route is sessionless and CSRF-exempt, configuration is env-driven (ONETRACE_STORE_MCP, key, store_mcp.tools), and the read-only default keeps initial risk contained.
• Look elsewhere if: your stack isn't Laravel/PHP, you require full self-hosted or open-standard-only AI infrastructure, or you can't accept a hard dependency on OneTrace and onetrace-php (this release requires onetrace-php 1.13 — a coupled upgrade you must plan for).
• Look elsewhere if: you have no customer accounts / transactional data to expose, or your security posture forbids a sessionless public endpoint (POST /onetrace/mcp) even with tool allowlisting and code confirmation.
• Evaluate carefully if: the confirmation-code flow depends on cache availability and email deliverability — verify your cache backend and email path are production-grade before enabling action tools.

How to Pitch It (Stakeholders)

For executives: This release lets our store's AI chat bot go beyond answering questions — it can act on real store data, safely and on our terms. We decide which capabilities are live (read-only by default; actions only when we opt in), and customer-specific actions require an emailed confirmation code. Setup is a config change plus a single artisan command, so we can pilot conversational support and commerce with minimal engineering spend and a clean rollback path.

For engineering: Extend StoreMcpHandlers with the tools we offer, set ONETRACE_STORE_MCP=true and a key, and the package serves the store MCP contract at POST /onetrace/mcp (no session, no CSRF). php artisan onetrace:store-mcp wires the server to the bot; --key mints a new key and --disconnect tears it down. Read tools are exposed by default; anything that mutates state must be allowlisted in store_mcp.tools. findCustomer() / sendCode() handle email-based confirmation via the cache. @onetrace now forwards the signed-in customer (cdp.chatCustomer(), tracker 1.16). Dependency note: this requires onetrace-php 1.13 — schedule that upgrade alongside adoption.