Weave Code
Mcp Laravel Package
unopim/mcp
UnoPim MCP bridges AI assistants like Claude, Copilot, and Cursor to your UnoPim catalog. Manage products, categories, attributes, channels, and locales via MCP, with dev tools, dynamic skills, and hardened security.
Model Context Protocol (MCP) server for UnoPim — let ChatGPT, Claude, Copilot, Cursor and other AI agents search, enrich and manage your product catalog over HTTP or stdio, with ACL-enforced tools. Open source, MIT.
Frequently asked questions about Mcp
- How do I install the UnoPim MCP package in a Laravel application?
- Run composer require unopim/mcp and then php artisan mcp:install. The install command publishes config/mcp.php, optionally scaffolds Laravel Passport for API authentication, and clears caches. There is no separate Node process or extra runtime to deploy, and no migrations beyond Passport's, because the bridge ships as a first-party UnoPim module inside the Laravel application.
- Which Laravel and UnoPim versions does unopim/mcp support?
- The declared support window, unchanged since v1.0.2, covers Laravel 11 through 13 and UnoPim 1.x through 3.x. That is a wide compatibility matrix, so verify your exact minor versions before a production rollout. The maintainer carries the testing burden for the full range, and so do you when you upgrade.
- What is the difference between the HTTP SSE transport and the stdio transport?
- The HTTP agent exposes a single endpoint, POST /api/mcp/unopim, using SSE for remote AI assistants running PIM workflows. The stdio agent runs locally via php artisan mcp:start unopim-dev and targets coding agents such as Copilot, Cursor, and Claude Code. Since v1.0.5 the tool surface presented to a client is conditional on transport and configuration, which keeps the two consumers properly separated.
- How do I disable developer tools over HTTP in production?
- Use the MCP_REMOTE_DEVELOPER_TOOLS config gate, which controls whether developer tools, diagnostics, and dynamic skills are served over the HTTP transport. Confirm that it is off in your actual deployment rather than assuming it, because the release notes scope the gate to HTTP. With the gate off, the server instructions also stop advertising tools a client cannot call, which shrinks the prompt-injection blast radius.
- Does the UnoPim MCP server enforce ACL permissions?
- The HTTP transport applies ACL enforcement, rate limiting, path traversal protection, and audit logging. The README states the CLI stdio path bypasses ACL for local development, so any agent or CI job with shell access to the host gets unscoped catalog and database reach. That is acceptable on a developer laptop but constrains where stdio may be started.
- Is run_command safe, and can individual developer tools be disabled?
- run_command allowlists base binaries such as php artisan and composer and blocks shell metacharacters, but php artisan tinker and composer run-script remain arbitrary-code paths unless subcommands are denied, and that subcommand policy is undocumented. v1.0.5 moves the whole developer-tool family behind MCP_REMOTE_DEVELOPER_TOOLS, which is a single family-level switch rather than a per-tool allowlist. If you need finer control, verify whether run_command, run_database_query, and dev_tools can be disabled independently in config/mcp.php.
- Can I add custom MCP tools without writing PHP?
- Yes. Drop a SKILL.md file into .ai/skills/ and it is auto-registered as an executable MCP tool within the 3600-second cache TTL. That is convenient for teams, but it is also an escalation path, so keep developer tools disabled over HTTP wherever the write half of that chain is not needed. Writing new core tools in PHP is covered in the extending-mcp documentation.
- How can I test the MCP connection without a full AI client?
- Run php artisan mcp:inspector, which provides a manual test harness for the bridge. It lets you list and invoke tools directly so you can validate authentication, configuration, and tool behaviour in under an hour. Do this before wiring up Claude, Copilot, or Cursor to a staging or production catalog.
- How does unopim/mcp compare with the Akeneo MCP server?
- The package is a first-party UnoPim module that bundles full catalog CRUD, settings management, schema discovery, and developer tooling in one Composer package. A written comparison is included in the repository under docs/comparison-and-benefits.md. For teams already on Laravel and UnoPim, it avoids a separate sidecar service entirely.
- What is the prompt injection risk of letting an AI agent read catalog data?
- Product names, descriptions, and attribute labels are attacker-influenced content that the model reads as input, so catalog poisoning remains a high-severity concern. v1.0.5 reduces the likelihood of the agent reaching for a developer tool by not describing one when the gate is off, but it does not sanitise the catalog itself. Treat catalog write access and developer tool access as separate privileges, and keep dev tools off over HTTP unless you specifically need them.
Weaver
How can I help you explore Laravel packages today?