🚀 Laravel MCP Server

AI-Powered Laravel Development Assistant — Secure bridge between AI Clients (Claude Desktop, Cursor, VS Code) and your local Laravel projects.

---

⚠️ Security Notice

This package intentionally requires system access for its core functionality (executing artisan commands, reading logs, etc.). All operations are protected by a 10-layer security system including:

• Input sanitization & command validation
• Path traversal prevention
• Production environment blocking
• Rate limiting & audit logging
• No shell injection (uses execFile only)

For local development only. Never use in production.

📢 Expected npm/Socket Security Alerts

When installing this package, you may see alerts from npm or Socket.dev about:

• Shell Access ✓ Required - safely executes php artisan commands
• Filesystem Access ✓ Required - reads Laravel logs and source files
• Environment Variables ✓ Required - validates APP_ENV to block production
• Network Access ✓ Required - MCP protocol communication
• AI-detected risks ✓ Expected - automated scanners flag dev tools

These are NOT vulnerabilities - they are legitimate features of a Laravel development tool, all protected by our security layers. See SECURITY.md for complete details on how each capability is secured.

🔐 Security Monitoring

We maintain enterprise-grade security through:

• ✅ CodeQL Analysis - Automated code security scanning
• ✅ Dependabot - Dependency vulnerability alerts
• ✅ Security Tests - 19 security-focused tests
• 📊 OpenSSF Scorecard - Best practice monitoring (weekly)

See SECURITY.md for complete security details.

---

📖 Table of Contents

• What is Laravel MCP Server?
• Features
• Security Architecture
• Installation
• Quick Start
• Configuration
• Usage Examples
• Tools Reference
• Security Details
• Troubleshooting
• Contributing
• License

---

🎯 What is Laravel MCP Server?