Weave Code
A Laravel package for implementing secure Model Context Protocol servers using Streamable HTTP and SSE transport, providing real-time communication and a scalable tool system for enterprise environments.
Frequently asked questions about Laravel Mcp Server
- How do I install opgginc/laravel-mcp-server in a Laravel application?
- Install it with Composer using composer require opgginc/laravel-mcp-server. The service provider is auto-discovered, and you publish the package config with the vendor:publish command before defining your first tool. Because the package registers its own routes, confirm the resulting endpoint path and middleware stack in the config before exposing it.
- Does this package use Streamable HTTP or SSE for MCP transport?
- It supports Streamable HTTP as the primary JSON-RPC transport, with SSE available as a legacy or alternate transport. That distinction matters because Streamable HTTP can be served from a normal request/response lifecycle, while SSE needs a long-lived process. Treat the transport choice as a deployment-architecture decision rather than a config toggle.
- Will this Laravel MCP server work under PHP-FPM, or do I need Octane or Swoole?
- Streamable HTTP can be made to work under PHP-FPM behind Nginx, but SSE effectively requires a long-lived runtime such as Laravel Octane, RoadRunner, or Swoole, or a dedicated worker tier. Proxy buffering, load-balancer idle timeouts, and worker exhaustion are the predictable failure modes. Design for those up front instead of discovering them under production load.
- Which PHP and Laravel versions are supported by laravel-mcp-server?
- The expected envelope is Laravel 10, 11, or 12 on PHP 8.1 and above, but verify the actual composer constraints in the package before committing. Check whether the maintainer publishes a CI matrix proving those version combinations. Pin the exact version you validate against in your own test suite.
- How do I define MCP tools in Laravel with this package?
- Tools are defined as classes that are resolved through the Laravel service container, so they can delegate to your existing domain services, Eloquent models, and policies. A typical read-only setup is install, publish config, write a handful of tool classes, then mount the route behind your existing auth middleware. Keep tool schemas narrow and explicit so an agent cannot invoke more capability than you intend.
- How are tool calls authenticated and authorized, and can tools be scoped per user or tenant?
- The package does not impose your authorization model: every tool needs an explicit policy check, tenant scoping, and an audit log mapped to the authenticated principal. Read-only tools are straightforward, while write-capable tools are where blast-radius control becomes the real engineering work. For public or multi-tenant exposure, expect to build a token bridge, since MCP authorization leans on OAuth discovery and Sanctum or session tokens do not natively satisfy that handshake.
- Are MCP sessions stateful, and what happens to in-flight sessions during a deploy or horizontal scale-out?
- MCP is session-oriented, so you must decide whether sessions hold state and what happens to active conversations during a deploy or when you add workers. Without shared session storage, a rolling deploy or a second instance can drop in-flight agent sessions. Test this explicitly with more than one instance before you rely on it in production.
- Is laravel-mcp-server safe to expose to AI agents in production?
- Prompt injection, over-broad tool schemas, and error messages that leak internals are the dominant risks once an LLM can invoke your application's capabilities. The package cannot solve those problems; tool design, strict authorization, and sanitized error responses must. Run a security review before exposing anything write-capable, and log invocation details and latency for every tool call.
- Which MCP specification revision does the package implement, and how do I handle spec changes?
- MCP has revised its transport and authorization guidance repeatedly, and HTTP plus SSE has been superseded by Streamable HTTP. Confirm which spec revision the package implements and whether it stays compatible with current clients like Claude Desktop or Cursor. Ask whether the maintainer documents an upgrade path for when the spec changes again.
- What are the alternatives to this package, and what is its maintenance risk?
- Alternatives include standing up a separate Node or Python MCP gateway, or using another PHP MCP SDK directly, so weigh staying inside Laravel against adding another moving part. Around 330 stars and a single organizational maintainer is a real bus factor, though the MIT license means you can fork as a mitigation. Verify the canonical repository, release tag, and Packagist entry first, because the provenance listed here is unconfirmed and the last release date looks anomalous.
Weaver
How can I help you explore Laravel packages today?