Commands — Statamic MCP

All commands run through php please. They’re also available in Artisan with a statamic: prefix, as in php artisan statamic:mcp:doctor.

Command	What it does
`mcp:setup`	Setup wizard for token or OAuth mode
`mcp:token`	Issue a token for a Statamic user
`mcp:tokens`	List issued tokens
`mcp:token:revoke`	Revoke a token
`mcp:doctor`	Check the configuration and print a fix for each problem
`mcp:keys`	Provision or export Passport’s keys
`mcp:guidelines`	List blocks without instructions, and move 0.6.0 guidelines

mcp:setup#

php please mcp:setup

Interactive by default. It asks which mode you want, confirms each change, and skips what’s already done, so running it again is safe.

Option	What it does
`--oauth`	Set up OAuth mode without asking which mode.
`--token`	Set up token mode without asking which mode.
`--user=`	Email for the first token, in token mode.
`--yes`	Run unattended and apply every change without confirming. Each edit is still printed.

Passing both --oauth and --token is an error. Token mode with --yes needs --user.

php please mcp:setup --token --user=[email protected] --yes

php please mcp:setup --oauth --yes

In OAuth mode the steps run in this order: install Passport, offer to publish the consent view, set STATAMIC_MCP_AUTH=oauth, run the migrations, provision the keys, then run mcp:doctor. The mode change comes before the migrations because the addon’s migrations only load in OAuth mode. With --yes, the consent view isn’t published, since a working default is already bound.

It exits non-zero if a step fails or the doctor finds a problem.

mcp:token#

php please mcp:token [email protected] --name="Claude Code" --expires-days=90

Argument or option	What it does
`email`	Required. Email of the Statamic user the token will act as.
`--name=`	Label for this token.
`--expires-days=`	Days until the token expires, a positive whole number. It never expires when omitted.

It prints the token once, its id, its expiry, a ready-to-paste command for Claude Code, and a config block for Cursor. It warns when the user lacks Access MCP, and when APP_URL is still http://localhost. An unknown email is an error, so create the user first. A route config that isn’t a path issues nothing and says why.

mcp:tokens#

php please mcp:tokens

Prints a table of id, user, name, created, and expires. A token whose user was deleted shows that it’s dead.

mcp:token:revoke#

php please mcp:token:revoke {id}

id is the first column of mcp:tokens. Clients using the token get a 401 on their next request. An unknown id is an error.

mcp:doctor#

php please mcp:doctor

Runs every check without stopping at the first failure, so all problems are named at once. Each [FAIL] carries the same remedy text the endpoint answers with at runtime.

It exits non-zero on any [FAIL]. [WARN] lines alone exit zero, so it works as a deploy step. Troubleshooting lists what it checks.

mcp:keys#

php please mcp:keys

Provisions Passport’s encryption keys into the database now, instead of on the first request, and prints the pair as PASSPORT_PRIVATE_KEY and PASSPORT_PUBLIC_KEY lines. Deploys don’t need this. It exists for hosts that want keys in the environment.

Option	What it does
`--write`	Write the variables into this environment’s `.env` instead of printing them.
`--json`	Print raw JSON for piping into secret-store CLIs.

It never overwrites existing keys, because regenerating would make every connected client fail with a 401. If the database can’t be read, it refuses to generate a pair or to write key files to .env, until it can read the stored key. The output is a private key, so keep it out of CI logs. mcp:setup hides it for that reason.

mcp:guidelines#

php please mcp:guidelines

Says where guidelines are written and lists the page builder blocks with no instructions. On a site coming from 0.6.0, it moves the old global set to the Guidelines page first. See Guidelines for agents.

These come from the addon’s dependencies, and they’re useful alongside it.

php artisan mcp:inspector mcp/statamic

php artisan passport:purge

mcp:inspector comes from laravel/mcp. passport:purge comes from Passport, and it clears dead OAuth rows. Don’t run passport:keys per release. See Keys.

Publish tags#

Tag	Publishes
`statamic-mcp-config`	`config/statamic/mcp.php`
`statamic-mcp-views`	The Blade views, to `resources/views/vendor/statamic-mcp`