Mcp Adapter Laravel Package

Product Decisions This Supports

• Build vs. buy for AI/agent interoperability. If the roadmap includes "let AI clients read and act on our site content," this package is a buy signal: a maintained MCP (Model Context Protocol) adapter with an active contributor base, WordPress.org release discipline, and a documented setup path beats a bespoke JSON-RPC bridge. v0.7.1 is maintenance-only — it does not change the build-vs-buy verdict, but it hardens it.
• Security and reliability posture for an externally reachable surface. MCP endpoints accept unauthenticated-until-authenticated client traffic, so session handling is a real risk area. The 4 KiB cap on stored initialization parameters (with a JSON-RPC -32602 response and automatic purge of oversized rows) removes a cheap denial-of-service / log-flooding vector. That is the kind of fix that should be cited in a security review rather than discovered in one.
• Support-cost forecasting and onboarding. The new site-owner setup guide (connect client → create Application Password → test → troubleshoot) is a direct lever on support load. If we adopt, we should assume the first cohort of internal users can self-serve, and budget support tickets accordingly.
• Agent-facing error UX as a product surface. Unknown ability names now suggest relevant available abilities or point to discovery, instead of dead-ending. This is the difference between an agent that recovers and one that surfaces a confusing failure to an end user — worth tracking as a quality metric if agent integrations are customer-facing.
• Deployment and upgrade planning. The session-storage change forces affected clients to reconnect once; the ability_not_public_mcp → ability_not_found error code change and dropped clientInfo.icons retention alter the wire contract. Any client code or dashboards keyed on those need a coordinated release.
• Plugin coexistence / packaging decisions. The autoloader-ordering fix means the installed plugin wins over an older bundled copy. If we ship this inside a theme or distribution bundle, that resolves a version-skew class of bug that would otherwise be near-impossible to diagnose in the field.

When to Consider This Package

Adopt when:

• The target runtime is WordPress (this is WordPress/mcp-adapter, distributed via WordPress.org) and PHP/Composer is already in the stack — it is a PHP package, but it is not a framework-agnostic MCP server.
• You want AI clients (Claude, Cursor, IDE assistants) to discover and call site "abilities" over MCP without writing your own protocol layer or auth flow.
• You need a small, well-bounded surface and can live with an explicit, versioned error contract rather than a rich SDK.
• You can absorb 0.x API churn — pre-1.0 versioning means error codes and payload retention are still moving (this release renamed one error code and stopped retaining client icons).

Look elsewhere when:

• You are building on Laravel. There is no service provider, config publish, facade, or Laravel-native auth integration here. For a Laravel app, a Laravel-first MCP package is the lower-friction path; forcing this one in means bridging WordPress-style abilities and Application Password auth yourself.
• You need multi-tenant isolation, per-user scoped tokens, OAuth flows, or audited access control beyond Application Passwords.
• Your clients cannot tolerate a forced reconnect or a session-state purge on upgrade (e.g. long-lived agent processes doing stateful initialization).
• You bundle an older copy of the plugin and cannot guarantee load order — the fix helps, but a clean single-source install is still preferable.
• You require a stable 1.x contract with deprecation guarantees before committing roadmap dependencies to it.

How to Pitch It (Stakeholders)

To executives: We have a low-cost option to make our site content and actions available to AI assistants, using a maintained open-source MCP adapter rather than a custom integration. The latest release is a maintenance release — no new features — and that is the point: the project is actively fixing security and reliability issues, including a session-storage vulnerability reported by an external researcher and fixed within the release. It also ships a self-serve setup guide, which should reduce onboarding support cost. Caveat: it is pre-1.0, so we should treat the interface as provisional and pin versions.

To engineering: Small, focused adapter; PHP/WordPress-specific, no Laravel integration. Upgrade impact in 0.7.1: (1) sessions storing more than 4 KiB of initialization params now return JSON-RPC -32602 and the oversized rows are cleared — affected clients must reconnect once; (2) clientInfo.icons is no longer persisted across requests; (3) an ability not exposed over MCP now returns ability_not_found instead of ability_not_public_mcp — grep for any error-code matching before rolling out; (4) autoloader registration now precedes bundled-copy detection, so the installed plugin is preferred over an older bundled copy. Recommended: pin the version, run the setup guide in staging, and audit any client code that keys off the changed error code or icon field.