It is a read-only MCP server that gives AI assistants deep introspection into Symfony applications via 1,677 tools across 16 categories, with dynamic tool discovery, search, and security-first protections.
Inspect Symfony codebase: routes, controllers, services, DI container, bundles, events, commands, and kernel configuration.
Explore database layer: Doctrine entities, relationships, migrations, indexes, DBAL schema, and query patterns.
Analyze security: voters, firewalls, authenticators, JWT/OAuth, CSRF, access control, and secrets handling.
Review frontend and integrations: Twig, translations, Symfony UX, Stripe, Slack, Sentry, Elasticsearch, OpenAI, and more.
Examine messaging, API, cache, and infrastructure: Messenger, notifier, Mercure, API Platform, OpenAPI, Docker, CI/CD, AWS, and queues.
Run code-quality checks: profiler data, dead code detection, dependency graphs, N+1 query risks, and test/static analysis tooling.
Use meta-tools: list tool categories, search for specific tools, activate/deactivate whole categories, and check active token budget.
Benefit from security-first design: static PHP parsing, no code execution, no network calls, sensitive-data redaction, path traversal protection, and prompt injection filtering.
Analyzes Consul service discovery and configuration in a Symfony project.
Analyzes Cypress end-to-end testing setup in a Symfony project.
Analyzes Datadog monitoring integration in a Symfony project.
Analyzes DigitalOcean cloud infrastructure configuration for a Symfony deployment.
Analyzes Docker configuration for Symfony application containers.
Analyzes Doctrine ORM configuration, entities, relationships, migrations, query patterns, indexes, and DBAL in a Symfony project.
Analyzes Elasticsearch integration in a Symfony project, including indexes, queries, and client configuration.
Analyzes Firebase integration in a Symfony project, including authentication and storage.
Analyzes Google Cloud integration in a Symfony project, including Cloud Run, Storage, and other services.
Analyzes GraphQL integration in a Symfony application, including schema, resolvers, and API Platform GraphQL support.
Analyzes Helm chart configurations for deploying Symfony applications.
Analyzes Kubernetes deployment and orchestration configuration for Symfony applications.
Analyzes Mailgun email delivery integration in a Symfony project.
Analyzes Symfony Messenger setup, including transports, stamps, failure handling, and messaging infrastructure.
Analyzes Nginx server configuration for Symfony applications.
Analyzes OpenAI integration in a Symfony project.
Analyzes Pusher real-time communication integration in a Symfony project.
Analyzes RabbitMQ message queue integration in a Symfony project.
Analyzes Redis cache, sessions, and pub/sub integration in a Symfony project.
Analyzes SendGrid email delivery integration in a Symfony project.
Analyzes Sentry error tracking integration in a Symfony project.
Analyzes serverless deployment configuration for Symfony applications.
Analyzes Slack integration in a Symfony project, including notifications and webhooks.
Analyzes Stripe payment integration in a Symfony project, including payment intents, subscriptions, and webhooks.
Provides deep, read-only introspection into a Symfony application, including routes, controllers, services, entities, database schema, migrations, events, forms, security, and more.
Analyzes Terraform infrastructure definitions for Symfony projects.
Analyzes Symfony UX Turbo integration for hotwire-based frontend enhancements.
Analyzes Twilio communication integration in a Symfony project, including SMS and voice.
Analyzes Webpack configuration as part of Symfony's frontend asset management.
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type @ followed by the MCP server name and your instructions, e.g., "@symfony-agent-mcp List all routes and their controllers"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
Features • Quick Start • Integration • Usage • Documentation • Contributing • License
A production-ready Model Context Protocol (MCP) server for Symfony applications. Gives AI assistants deep, read-only introspection into your entire Symfony codebase — routes, controllers, services, entities, database schema, migrations, events, forms, security, Doctrine, Messenger, Twig, API Platform, and much more.
Client | Install |
Claude Code | Run |
Claude Desktop | Add to |
Cursor | Add to |
VS Code Copilot | Add to |
Any MCP client | stdio transport, |
Available tool categories (16 categories, 1,677 tools total, ~164,615 tokens if all active)
Category │ Tools │ Est. tokens │ Description
─────────────────┼────────────┼───────────────┼────────────────────────────────────────────────────────
symfony-core │ 548 tools │ ~ 53939 tokens │ Routes, services, controllers, events, commands, bundles, DI container, kernel
database │ 176 tools │ ~ 17121 tokens │ Entities, migrations, Doctrine ORM, relationships, query patterns, indexes, DBAL
security │ 132 tools │ ~ 12950 tokens │ Voters, firewalls, authenticators, JWT, OAuth, CSRF, access control, secrets vault
frontend │ 121 tools │ ~ 11568 tokens │ Twig, translations, asset mapper, Symfony UX, Turbo, live components, Webpack
testing │ 110 tools │ ~ 10559 tokens │ PHPUnit, Behat, Cypress, Playwright, Psalm, PHPStan, Rector, static analysis
integrations │ 106 tools │ ~ 10939 tokens │ Stripe, Slack, Sentry, Elasticsearch, Twilio, SendGrid, Mailgun, Datadog, OpenAI
serializer │ 91 tools │ ~ 9031 tokens │ Serializer, validation, forms, constraints, DTOs, transformers, normalizers
messaging │ 87 tools │ ~ 8455 tokens │ Messenger, notifier, webhooks, Mercure, mailer, transports, stamps, failure handling
api │ 68 tools │ ~ 6438 tokens │ API Platform, OpenAPI, GraphQL, REST patterns, versioning, rate limits, Nelmio
infrastructure │ 68 tools │ ~ 6794 tokens │ Docker, CI/CD, Kubernetes, Terraform, Helm, Nginx, serverless, cloud platforms
cache-sessions │ 62 tools │ ~ 5945 tokens │ Cache pools, HTTP cache, sessions, rate limiter, lock, cache warmers, OPcache
config │ 35 tools │ ~ 3157 tokens │ Environment config, framework settings, Monolog, CORS, locale, feature flags
code-quality │ 25 tools │ ~ 2447 tokens │ Profiler, dead code detection, dependency graph, accessibility, code metrics
cloud-aws │ 18 tools │ ~ 1945 tokens │ AWS S3, SES, Cognito, ECS, Lambda/Bref, Parameter Store, Secrets Manager, CloudFront
cloud-other │ 16 tools │ ~ 1851 tokens │ Azure Blob/Pipelines, Google Cloud Run/Storage, Firebase, DigitalOcean, Consul
queues │ 14 tools │ ~ 1476 tokens │ RabbitMQ, Kafka, SQS FIFO/DLQ, Pusher, Redis pub/sub and streams
To activate a category: call activate_category(category: "<key>")
To search for specific tools: call search_tools(query: "what you want to do")Read-only — never writes, modifies, or executes anything
Auto-redaction — passwords, tokens, API keys, and database credentials are replaced with [REDACTED] before any data reaches the AI
DLP pipeline — multi-layer Data Loss Prevention scanner (regex patterns + structural detection for credit cards, JWTs, SSH keys, cloud credentials, etc.)
Path validation — directory traversal attacks are blocked at the input layer
No code execution — PHP files are parsed statically (no eval, no PHP runtime)
No network calls — all data comes from local files only
Prompt injection filter — tool output is scanned for injection patterns before being forwarded to the AI
Related MCP server: Symfony Debug MCP Server
npx @shakaran/symfony-agent-mcpnpm install -g @shakaran/symfony-agent-mcp
symfony-agent-mcpgit clone https://github.com/shakaran/symfony-agent-mcp
cd symfony-agent-mcp
pnpm install
pnpm build
pnpm startSee GETTING_STARTED.md for a step-by-step guide including Node.js setup, troubleshooting, and first-use verification.
Client | Install |
Cursor | |
VS Code | |
VS Code Insiders | |
Windsurf | |
Claude Code | |
Claude Desktop |
Run once to register the server:
# npx (no local install required)
claude mcp add symfony -- npx @shakaran/symfony-agent-mcp
# Or from a local source build
claude mcp add symfony -- node /path/to/symfony-agent-mcp/dist/server.jsTo make it available globally across all projects, add the --scope user flag:
claude mcp add --scope user symfony -- npx @shakaran/symfony-agent-mcpAdd to your Claude Desktop configuration file (claude_desktop_config.json):
{
"mcpServers": {
"symfony": {
"command": "npx",
"args": ["@shakaran/symfony-agent-mcp"]
}
}
}Add to .cursor/mcp.json:
{
"symfony": {
"command": "npx",
"args": ["@shakaran/symfony-agent-mcp"]
}
}Add to .vscode/mcp.json:
{
"servers": {
"symfony": {
"type": "stdio",
"command": "npx",
"args": ["@shakaran/symfony-agent-mcp"]
}
}
}Every tool accepts an app_path parameter pointing to the root of your Symfony application:
list_routes(app_path: "/var/www/myapp")
→ Found 42 routes: GET /api/users [api_users], POST /login [app_login], …
get_entity_details(app_path: "/var/www/myapp", entity_name: "User")
→ Entity: User | Table: users
Properties: id (int, PK), email (string 180), isActive (bool)
Relationships: OneToMany → Post (author)
get_error_summary(app_path: "/var/www/myapp")
→ Last 24h: 3 CRITICAL, 12 ERROR, 47 WARNING
get_code_quality_report(app_path: "/var/www/myapp")
→ God classes: UserManager (1240 lines), dead services: 4, N+1 risks: 7Example prompts you can use with Claude:
"Show me all routes with POST methods and their controllers"
"Which services are tagged with doctrine.event_listener?"
"List the last 50 lines of the production log"
"Are there any circular dependencies in the service container?"
"What Doctrine entities have relationships with User?"
"Show me the migration history and any destructive migrations"
"Which controllers have no security attributes?"
All configuration is done via environment variables passed to the MCP server process.
Variable | Default | Description |
|
| Enable dynamic tool discovery. When |
|
| Maximum estimated tokens that can be activated per session. Activation is blocked when this limit would be exceeded; pass |
Variable | Default | Description |
| (any) | Colon-separated list of absolute app paths the server may inspect. Example: |
|
| Set to |
| (all) | Comma-separated allowlist of tool names. Only listed tools are callable. |
| (none) | Comma-separated denylist. Takes precedence over the allowlist. |
| (off) | 32+ character secret for request signing. Enables per-request authentication. |
| (off) | Secret for session token generation. |
| (off) | Token to validate on incoming requests. |
|
| Set to |
|
| Session token validity window in seconds. |
Variable | Default | Description |
|
| Max requests per window. Set to |
|
| Rate limit window in milliseconds (1 minute). |
|
| Max burst requests in 1 second. |
Variable | Default | Description |
| (off) | Port for HTTP/SSE transport. When set, starts an HTTP server in addition to stdio. |
|
| Set to |
|
| Per-tool execution timeout in milliseconds. |
{
"mcpServers": {
"symfony": {
"command": "npx",
"args": ["@shakaran/symfony-agent-mcp"],
"env": {
"SYMFONY_MCP_DYNAMIC_TOOLS": "false"
}
}
}
}{
"mcpServers": {
"symfony": {
"command": "node",
"args": ["/path/to/symfony-agent-mcp/dist/server.js"],
"env": {
"SYMFONY_MCP_TOKEN_BUDGET": "80000"
}
}
}
}Use this when you want to run the server from a local clone (no npm publish needed).
# 1. Clone the repo
git clone https://github.com/shakaran/symfony-agent-mcp
cd symfony-agent-mcp
# 2. Install dependencies (Node.js ≥ 22 required)
pnpm install # or: npm install
# 3. Build TypeScript → dist/
pnpm build # or: npm run build
# 4. Test the server responds
echo '{"jsonrpc":"2.0","id":1,"method":"tools/list","params":{}}' | node dist/server.jsThen configure your MCP client to point at the built file:
Claude Code (run once):
claude mcp add symfony -- node /absolute/path/to/symfony-agent-mcp/dist/server.jsClaude Desktop (claude_desktop_config.json):
{
"mcpServers": {
"symfony": {
"command": "node",
"args": ["/absolute/path/to/symfony-agent-mcp/dist/server.js"]
}
}
}VS Code (.vscode/mcp.json):
{
"servers": {
"symfony": {
"type": "stdio",
"command": "node",
"args": ["/absolute/path/to/symfony-agent-mcp/dist/server.js"]
}
}
}Tip: After rebuilding (
pnpm build), restart your MCP client to pick up the changes.
The server reads files directly from your Symfony app — no database connection, no PHP runtime needed:
config/routes.yaml, config/routes/*.yaml — YAML routes
PHP 8 #[Route] attributes on controllers in src/Controller/
config/services.yaml — DI container services
config/packages/*.yaml — Framework, security, doctrine, messenger, mailer config
src/Entity/*.php — Doctrine entity files (PHP 8 attributes + annotations)
var/log/*.log — Application logs
migrations/, src/Migrations/ — Doctrine migration files
composer.json, composer.lock — Package info
.env, .env.local, .env.*.local — Environment variables (sensitive values auto-redacted)
Symfony | PHP | ORM mapping |
5.4 LTS | 8.0+ | Annotations or Attributes |
6.x | 8.0+ | Attributes |
7.x | 8.2+ | Attributes |
8.x | 8.2+ | Attributes |
Node.js ≥ 22.0.0
pnpm ≥ 11.0.0 (or npm/yarn for development)
pnpm install
pnpm dev # watch mode (TypeScript → dist/)
pnpm test # run all tests
pnpm lint # ESLint
pnpm typecheck # tsc --noEmitSee DEVELOPMENT.md for the full development guide: architecture overview, adding new tools, testing strategy, and contribution guidelines.
Document | Description |
Step-by-step setup, Node.js prerequisites, troubleshooting | |
System design, security pipeline, component overview, all 1,677 tools across 16 categories documented | |
Development workflow, adding tools, testing, contributing | |
Threat model, DLP pipeline, responsible disclosure policy | |
Release history and roadmap | |
High-level project overview and statistics |
Issues and pull requests are welcome at github.com/shakaran/symfony-agent-mcp.
Please read DEVELOPMENT.md before submitting a PR, and SECURITY.md for the responsible disclosure policy.
Standard | Status |
OpenSSF Baseline | Level 1, 2 and 3 |
OpenSSF Best Practices | Passing |
OpenSSF Scorecard | 7.4 / 10 |
Supply chain | Published from CI with SLSA provenance and SBOM |
Reproducible build | Verified in CI, byte-identical across builds |
Code scanning | Zero open alerts |
Secret scanning | Zero open alerts |
Tests | 1,019 — |
Licensing | MIT, SPDX headers on every source file |
Sign-off | Developer Certificate of Origin, checked in CI |
See SECURITY.md for the threat model, the assurance case and the remediation thresholds, and ROADMAP.md for what is planned.
MIT © Ángel Guzmán Maeso
Activate all tools in a category for this session. After activation the MCP client will receive the full tool definitions on the next tools/list refresh. Use list_tool_categories to see available categories and their token costs. Pass force=true to override the token budget guard.
Inputs: category (required), force.
Remove a previously activated category from this session to free up context budget. Useful when switching between different areas of the codebase.
Inputs: category (required).
Show which tool categories are currently active in this session, how many tools are exposed, and the estimated token cost. Use this to understand your current context budget.
Inputs: no named parameters.
List all available tool categories with descriptions, tool counts, and estimated token cost. Use this first to understand what groups of tools exist before activating them. Only the categories you activate will be shown in subsequent tools/list calls.
Inputs: no named parameters.
Search for specific tools by describing what you want to do. Returns the top matching tool definitions (name + description + input schema) ready to call immediately — no activation needed for one-off use. For repeated use of a group, call activate_category instead.
Inputs: query (required), limit.
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
Loading tool schema changelog…
Scored across 5 tools
Each tool has a clearly distinct purpose: listing categories, searching tools, activating a category, viewing active categories, and deactivating. There is no overlap or ambiguity in their functions.
All tool names follow a consistent verb_noun snake_case pattern (list_tool_categories, search_tools, activate_category, get_active_tools, deactivate_category), making prediction and selection straightforward.
With 5 tools, the set is tightly scoped to the server's purpose of managing tool categories and sessions. Each tool serves a necessary role in the lifecycle without redundancy or bloat.
The surface covers the full lifecycle of tool category management: discovery (list/search), activation, status inquiry, and deactivation. No obvious gaps exist for the stated domain.
Read-only discovery of ChatGXT's integration catalog and public MCP capabilities.
Read-only MCP tools for AI agent discovery, structured resources, and NIULAI information.
The Cortex MCP server provides read-only access to real-time engineering context from the Cortex developer portal, allowing AI coding assistants to answer natural language questions about your organization's catalog (microservices, libraries, domains, teams, infrastructure), scorecards (engineering standards and best practices), initiatives (goals and deadlines), and Engineering Intelligence metrics. It includes tools for querying documentation, tracking personal entities, and accessing AI-assisted insights across the entire Cortex ecosystem.
Your org's AI agents, tasks, runs, search, and brain files as MCP tools and resources.
