Retrieve a Markdown overview of a Symfony project: PHP version, Symfony version, installed packages, autoload namespaces, composer scripts, and APP_ENV. Use this first to understand the project.
A production-ready Model Context Protocol (MCP) server that bridges your Symfony/PHP project with LLMs such as Claude. It exposes tools that let the AI read your project's routes, services, Twig templates, and PHP source code.
Search the symbol index to locate PHP classes, interfaces, traits, enums, or methods by name. Returns file paths and line numbers for direct code access.
List Symfony service definitions in YAML mode (fast, reads config/services.yaml) or container debug mode (runs debug:container for compiled services). Filter by pattern and see service ID, class, public flag, and tags.
Perform a software package vulnerability audit using SecDB.
## What this tool does
Analyzes a list of software packages identified by PURL (Package URL) and returns
vulnerability information plus a Markdown summary. The audit results are based
exclusively on the package list provided.
## When to use this tool
Use this tool when the user wants to determine:
- whether application dependencies contain known vulnerabilities
- whether a project is affected by security advisories
- which packages require patching or upgrading
## Supported ecosystems
- **npm** - Node.js packages (e.g. pkg:npm/lodash@4.17.21)
- **maven** - Java/JVM packages (e.g. pkg:maven/org.apache.logging.log4j/log4j-core@2.14.1)
- **pypi** - Python packages (e.g. pkg:pypi/django@4.2.0)
- **gem** - Ruby gems (e.g. pkg:gem/rails@7.0.0)
- **cargo** - Rust crates (e.g. pkg:cargo/openssl-src@111.10)
- **nuget** - .NET packages (e.g. pkg:nuget/Newtonsoft.Json@13.0.1)
- **golang** - Go modules (e.g. pkg:golang/github.com/gin-gonic/gin@1.9.1)
- **composer** - PHP packages (e.g. pkg:composer/symfony/symfony@6.4.0)
## Inputs
- **purls**: list of Package URLs, one per entry.
Generate them from your project manifest files:
- Node.js: package.json / package-lock.json
- Python: requirements.txt / Pipfile.lock / pyproject.toml
- Ruby: Gemfile.lock
- Go: go.mod / go.sum
- Rust: Cargo.lock
- PHP: composer.lock
- Java: pom.xml / build.gradle
- .NET: *.csproj / packages.lock.json
## Outputs
- **report**: structured JSON objects describing the advisories affecting the audited packages.
- **summary**: Markdown summary including total vulnerabilities, severity breakdown, and key findings.
## LLM usage guidelines
- Never guess whether a package is vulnerable — always call this tool.
- Only submit PURLs from the supported ecosystems listed above; others will be ignored.
- The `summary` is already Markdown and can be shown directly.
- Use `report` when deeper technical analysis is required.
Release history of one PHP/Composer package on the Packagist registry, given a vendor/package name such as symfony/console. Returns every published version string paired with its release timestamp, plus a total count. Answers which versions of a Composer package exist and when the latest one shipped.
Full Packagist registry record for one PHP/Composer package named in vendor/package form, e.g. symfony/console. Returns description, repository URL, maintainers, license, type, download and favers counts, and every published version with its requires, autoload, and dist details. Answers what a Composer package is, who maintains it, and what each release declares.
Get Packagist (Composer/PHP) package metadata. Use for PHP-dependency audits.
Example call: {"pkg": "symfony/console"}
Cost: $0.005–$0.05 USDC on Base per call.
Search the Packagist PHP/Composer registry by free text with optional type (e.g. library, symfony-bundle) and tag filters. Returns package names, descriptions, download counts, and latest versions.