Exposing your Laravel app over MCP

The Model Context Protocol is a standard way for AI clients to find and call tools. It suits an application whose customers would benefit from asking their own assistant about their data: “which invoices are overdue?”, without logging in. It is less useful if your only AI feature lives inside your own UI. In that case, an agent with ordinary tools from the Laravel AI SDK is simpler.

composer require laravel/mcp
php artisan vendor:publish --tag=ai-routes
php artisan make:mcp-server InvoiceServer
php artisan make:mcp-tool ListOverdueInvoicesTool

Servers are registered in routes/ai.php. Mcp::web() creates an HTTP endpoint for remote clients; Mcp::local() creates one that runs as an Artisan command for tools on the same machine. For customer access you want the web form. See the Laravel MCP documentation for the full reference.

Annotations are hints that help a client behave sensibly. They don’t enforce anything, so the protection has to be in your code. Write tool descriptions for a reader who has never seen your application: the description is how the model decides when to call the tool, so vague wording leads to wrong calls.

Laravel documents two routes. OAuth 2.1 through Passport suits clients connecting on behalf of your customers: call Mcp::oauthRoutes() and add auth:api to the route. Sanctum suits simpler cases where a token can be issued in advance. Rate-limit client registration, or turn it off, if you use OAuth.

Mcp::web('/mcp/invoices', InvoiceServer::class)
    ->middleware(['auth:sanctum', 'throttle:mcp']);

Being signed in isn’t the same as being allowed. Inside each tool, check the user and return an error when they lack permission:

if (! $request->user()->can('viewAny', Invoice::class)) {
    return Response::error('Permission denied.');
}

Use shouldRegister() to hide tools from users who can’t use them. Hiding isn’t a substitute for the check, but it avoids confusing the model with tools that will always fail. Also limit how much a tool returns. Paginate, and don’t pass back a full model when three fields would do. Everything returned goes to whichever model the client uses, and you don’t choose that model or know its terms. Include that in your data review, and treat free-text fields as untrusted, because a customer note containing instructions will reach the model as well.

The MCP Inspector lets you call your server by hand: php artisan mcp:inspector mcp/invoices. For authenticated servers, supply the bearer token when connecting. Automated tests call tools directly, so add them to your existing suite:

InvoiceServer::actingAs($userWithoutAccess)
    ->tool(ListOverdueInvoicesTool::class, [])
    ->assertHasErrors(['Permission denied.']);

That is the test to write first: someone without permission asks, and the data doesn’t come back. Add a second test where a permitted user from another customer asks and sees only their own records. Then log every tool call with the user and arguments, so you can answer the question “what did the assistant do?” later.