shakaran/symfony-agent-mcp

Features • Quick Start • Integration • Usage • Documentation • Contributing • License
---
A production-ready **Model Context Protocol (MCP) server** for Symfony applications.
Gives AI assistants deep, read-only introspection into your entire Symfony codebase —
routes, controllers, services, entities, database schema, migrations, events, forms,
security, Doctrine, Messenger, Twig, API Platform, and much more.
| Client | Install |
|---------------------|----------------------------------------------------------------|
| **Claude Code** | Run claude mcp add → setup |
| **Claude Desktop** | Add to claude_desktop_config.json → setup |
| **Cursor** | Add to .cursor/mcp.json → setup |
| **VS Code Copilot** | Add to .vscode/mcp.json → setup |
| **Any MCP client** | stdio transport, command: npx @shakaran/symfony-agent-mcp |
---
Features
1,677 Tools across 16 Categories
Security-first design
- **Read-only** — never writes, modifies, or executes anything
- **Auto-redaction** — passwords, tokens, API keys, and database credentials are replaced with [REDACTED] before any data reaches the AI
- **DLP pipeline** — multi-layer Data Loss Prevention scanner (regex patterns + structural detection for credit cards, JWTs, SSH keys, cloud credentials, etc.)
- **Path validation** — directory traversal attacks are blocked at the input layer
- **No code execution** — PHP files are parsed statically (no eval, no PHP runtime)
- **No network calls** — all data comes from local files only
- **Prompt injection filter** — tool output is scanned for injection patterns before being forwarded to the AI
---
Quick Start
Option A: npx (no install required)
Option B: Install globally
Option C: From source
See GETTING_STARTED.md for a step-by-step guide including Node.js setup, troubleshooting, and first-use verification.
---
Integration
One-click Install
| Client | Install |
|----------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| **Cursor** | |
| **VS Code** | |
| **VS Code Insiders** | |
| **Windsurf** | |
| **Claude Code** | |
| **Claude Desktop** | |
Claude Code
Run once to register the server:
To make it available globally across all projects, add the --scope user flag:
Claude Desktop
Add to your Claude Desktop configuration file (claude_desktop_config.json):
Cursor
Add to .cursor/mcp.json:
VS Code Copilot
Add to .vscode/mcp.json:
---
Usage
Every tool accepts an app_path parameter pointing to the root of your Symfony application:
Example prompts you can use with Claude:
- *"Show me all routes with POST methods and their controllers"*
- *"Which services are tagged with doctrine.event_listener?"*
- *"List the last 50 lines of the production log"*
- *"Are there any circular dependencies in the service container?"*
- *"What Doctrine entities have relationships with User?"*
- *"Show me the migration history and any destructive migrations"*
- *"Which controllers have no security attributes?"*
---
Configuration
All configuration is done via environment variables passed to the MCP server process.
Tool Discovery
| Variable | Default | Description |
|-----------------------------|---------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| SYMFONY_MCP_DYNAMIC_TOOLS | true | Enable dynamic tool discovery. When true, tools/list returns only 5 meta-tools instead of all 1,677. Set to false to restore the legacy behaviour (all tools always visible). |