Agent Access

What this is

Agent Access for Drupal is an opinionated way for external AI agents to connect through a person's existing Drupal account. It is part of the Drupal AI Initiative's Outside AI work: establishing a clear Drupal approach to agent authentication and access that sites and client developers can test, improve, and build on.

Drupal remains the authority. The agent uses the connected account, and requests are evaluated against that account's existing permissions. This first implementation brings together Simple OAuth, Tool API, and MCP Server.

Current status

This is an experimental 1.0.x development release. Some required modules are currently alpha or beta releases, so standard Drupal projects need the explicit Composer steps below. The roadmap includes testing this approach with real agents, fixing issues in the appropriate upstream projects, helping the dependencies reach stable releases, and simplifying installation.

Install

Use a current Composer 2 release. From the root of an installed, Composer-managed Drupal 11.4 project, run these as two separate commands:

composer require \
  'drupal/tool:^1.0@beta' \
  'drupal/tool_belt:^1.0@alpha' \
  'drupal/mcp_server:^2.0@beta' \
  'drupal/mcp_server_tool_bridge-mcp_server_tool_bridge:^1.0@beta' \
  'drupal/mcp_server_oauth-mcp_server_oauth:^1.0@alpha'

composer require 'drupal/agent_access:1.0.x-dev@dev'

Then apply the recipe:

vendor/bin/dr recipe ../recipes/agent_access

Copy the package names exactly; the two doubled names are intentional. Follow the README to finish setup and connect an agent client.

Get involved

Try the recipe with an external agent and tell us what works or where the process breaks. Use the Agent Access issue queue for recipe, installation, documentation, and integration problems.

When investigation identifies a defect in an underlying module, report it in that module's issue queue and link it from the Agent Access issue. That keeps this project focused on the integrated path while improvements happen in the projects that own the affected code. Remove credentials, tokens, passwords, and keys before sharing logs.