This project is not covered by Drupal’s security advisory policy.
MCP Tools connects Drupal to AI assistants (Claude, Cursor, Windsurf) via the Model Context Protocol. Describe what you want in plain English — the AI handles the Drupal work.
Example
You: "Create a blog with articles, categories, tags, and an editor role"
AI: Creates the content type, taxonomies, fields, role, and permissionsQuick Start
- Install:
composer require drupal/mcp_tools
drush en mcp_tools -y - Configure: Visit
/admin/config/services/mcp-toolsand choose a preset:- Development: Full access, no rate limiting
- Staging: Config-only mode, rate limited, audit logging
- Production: Read-only mode, strict limits, full audit trail
- Connect your AI tool: See transport options below
Option A: STDIO Transport (Recommended for Local)
Enable the STDIO module:
drush en mcp_tools_stdio -y
Generate config automatically:
drush mcp-tools:client-config > .mcp.json
Detects DDEV/Lando environments and outputs ready-to-use config. Use --scope=read for read-only.
Claude Code (run from your Drupal directory):
cd /path/to/drupal
claude mcp add --scope project drupal -- drush mcp-tools:serve --quiet --uid=1 --scope=read,writeOr add .mcp.json to your Drupal project root:
{
"mcpServers": {
"drupal": {
"command": "drush",
"args": ["mcp-tools:serve", "--quiet", "--uid=1", "--scope=read,write"]
}
}
}Option B: HTTP Transport (Remote/Docker)
Enable the remote module:
drush en mcp_tools_remote -y
Configure execution user: Visit /admin/config/services/mcp-tools/remote
- Quick setup: Check "Use site admin (uid 1)" — simple for development
- Production: Click "Create MCP Executor Account" for a dedicated service account
Generate an API key:
drush mcp-tools:remote-key-create --label="Claude" --scopes=read,write
Copy the key shown (it's only displayed once).
Claude Code one-liner:
claude mcp add drupal http://localhost:8080/_mcp_tools --transport http -H "Authorization: Bearer YOUR_API_KEY"
Or add to .mcp.json:
{
"mcpServers": {
"drupal": {
"type": "http",
"url": "http://localhost:8080/_mcp_tools",
"headers": {
"Authorization": "Bearer YOUR_API_KEY"
}
}
}
}Manage keys at /admin/config/services/mcp-tools/remote or via drush mcp-tools:remote-key-list.
What's Included
222 tools across 34 optional submodules:
- Site Building: Content types, fields, taxonomies, roles, permissions, menus
- Content: Create/edit/publish nodes, media, bulk operations
- Views & Layout: Views, blocks, Layout Builder, image styles
- Admin: Cache, cron, config management, security audits
Security
- Scoped access (read/write/admin per connection)
- Read-only and config-only modes
- Rate limiting and audit logging
- Designed for local development — remote access is optional
Requirements
- Drupal 10.3+ or 11
- Tool API module
- PHP 8.3+
Links
| Attachment | Size |
|---|---|
| Screenshot from 2026-01-07 19-22-35.png | 72.67 KB |
Project information
- Project categories: Artificial Intelligence (AI), Decoupled, Developer tools
81 sites report using this module
- Created by mowens on , updated
This project is not covered by the security advisory policy.
Use at your own risk! It may have publicly disclosed vulnerabilities.
Releases
1.0.0-beta7 — Re-enables SVG support in Remote Media with proper XSS sanitization via enshrined/svg-sanitize. SVG uploads are now sanitized to strip <script> tags, event handlers, <foreignObject>, and remote references. Adds an extensible saniti

