Requirements#
| Requirement | Version | Needed for |
|---|---|---|
| PHP | 8.3 or newer | Always |
| Statamic | 6.31 or newer, on Laravel 12 or 13 | Always |
laravel/mcp | 1.1.2 or newer | Always. Composer installs it with the addon. |
ext-curl, with curl_exec enabled | URL uploads through assets_upload, which are refused without it. Composer doesn’t check for it. | |
laravel/passport and a database for its tables | Any database, SQLite is fine | OAuth mode only |
| Statamic Pro | Working copies and multi-site. Both are Statamic Pro features. |
Token mode needs no database, and it works on an install with file-based users. OAuth mode needs a database only for Passport’s own tables, so your users stay where they are.
Install#
composer require danielgnh/statamic-mcpThe endpoint is now live at /mcp/statamic. It rejects any request without a valid token, so nothing is reachable until you issue one.
Check it#
php please mcp:doctorThe doctor prints the endpoint and auth mode, then runs every check, even after one fails. On a fresh install you should see something like this, with the warning telling you the next step.
Statamic MCP doctor
Endpoint: https://example.com/mcp/statamic
Auth mode: token
[ OK ] MCP is enabled.
[ OK ] MCP route is mounted.
[ OK ] Configured middleware resolves.
[ OK ] Token store is writable (/var/www/storage/statamic/mcp).
[WARN] No tokens issued — the endpoint is a locked door. Run: php please mcp:token [email protected]
No blocking problems found.It exits non-zero only when a check fails. Warnings alone exit zero, so it also works as a deploy step.
Use the setup wizard#
The wizard handles either auth mode. It asks which one you want, confirms each change, and is safe to run again, because it skips what’s already done.
php please mcp:setupPass --yes to run it unattended. Each edit is still printed.
php please mcp:setup --token --user=[email protected] --yesphp please mcp:setup --oauth --yesLaravel Boost users get guidelines that teach coding agents to run it that way, once they select this package in boost:install.
Publish the config#
You only need this to change a setting that has no environment variable, such as the resources allowlist.
php artisan vendor:publish --tag=statamic-mcp-configThis creates config/statamic/mcp.php. Configuration has a builder that writes the file for you.
Turn it off#
Set the kill switch in your environment. The endpoint, OAuth discovery and client registration, and the Tools → MCP pages all go off. If Passport is installed, the routes it registers itself stay, and OAuth mode covers what they do. In an incident, also disconnect clients or revoke tokens, because existing ones work again when you turn MCP back on.
STATAMIC_MCP_ENABLED=falseThe endpoint checks this on every request, so a cached route list can’t keep serving it. On a site that caches routes, run php artisan optimize after changing enabled or auth. The routes for the new value only exist after that, and until then MCP stays off.