Configuration

Change what you need and copy the result. The builder only asks you to publish the config file when a setting has no environment variable.

Publish the config#

php artisan vendor:publish --tag=statamic-mcp-config

This creates config/statamic/mcp.php.

Every key#

Key	Default	What it does
enabled	true	Kill switch. When false, the endpoint, OAuth discovery and client registration, and the Tools → MCP pages are off, even when routes are cached. If Passport is installed, its own routes, such as /oauth/authorize and /oauth/token, stay. See Turning MCP off. Set with STATAMIC_MCP_ENABLED.
route	mcp/statamic	The endpoint path.
auth	token	token or oauth. Set with STATAMIC_MCP_AUTH.
server	Danielgnh\StatamicMcp\Server	The server class to mount. See Adding your own tools.
middleware	['throttle:60,1']	Runs before authentication on the MCP route. OAuth client registration and discovery keep their own throttle:60,1 per address, whatever this says.
read_only	false	Hides every write and delete tool. Set with STATAMIC_MCP_READ_ONLY. Reading an asset can still write Statamic’s own .meta cache file for it, as viewing it in the Control Panel does.
deletes	false	Registers the delete tools. Set with STATAMIC_MCP_DELETES.
resources	true for each type	One key each for collections, taxonomies, globals, asset_containers, navigations, and forms.
per_page	25	Default page size for list tools, capped at 100.
uploads.max_size	10240	Upload size limit in KB.
uploads.source_allowlist	null	Hosts assets_upload may download from. null allows any public host. Private and reserved addresses are always blocked, even for a listed host.

Environment variables#

Variable	Config key	Default
STATAMIC_MCP_ENABLED	enabled	true
STATAMIC_MCP_AUTH	auth	token
STATAMIC_MCP_READ_ONLY	read_only	false
STATAMIC_MCP_DELETES	deletes	false

Limiting resources#

Each type under resources takes one of three values.

'resources' => [
    'collections' => ['blog', 'pages'],
    'taxonomies' => true,
    'globals' => false,
    'asset_containers' => true,
    'navigations' => true,
    'forms' => true,
],

Value	Exposes
true	Every handle of that type
A list like ['blog', 'pages']	Only those handles
false, or an empty list	Nothing of that type

An exposed handle still needs the user’s permission. A handle outside the list reads as not found, and the error lists only what’s exposed.

collection 'landing' not found — available: blog

Changing enabled or auth on a cached site#

The endpoint checks enabled and auth on every request, so a cached route list can’t keep serving the old value of either. On a site that caches routes, run this after changing them. The routes for the new value exist only after that, and until then MCP stays off. mcp:doctor names a route cache built for another auth value or without the MCP route.

php artisan optimize

Middleware#

The list runs before authentication. A typo’d entry mounts fine and then returns a 500 on every request, so mcp:doctor checks that every entry resolves to a class, alias, or group.

Keep a throttle in the list. Without throttle:60,1, the addon puts no limit on how fast a caller can hit the endpoint.

Why deletes and read_only interact#

read_only wins. With both on, the delete tools stay hidden, and a client calling one gets HTTP 400, Tool [entries_delete] not found.