drupal-mcp-server 0.1.0__tar.gz → 0.3.0__tar.gz

drupal_mcp_server-0.3.0/.codecov.yml

@@ -0,0 +1,17 @@
+coverage:
+  # The 367 tool modules are thin wrappers exercised by the live test harness,
+  # which needs a real Drupal site and cannot run in CI. The CI gate (70%)
+  # deliberately excludes them, so keep Codecov consistent with CI.
+  ignore:
+    - "src/drupal_mcp_server/tools/*"
+
+  status:
+    project:
+      default:
+        target: 80%
+        threshold: 2%
+        informational: true
+    patch:
+      default:
+        target: 80%
+        informational: true

{drupal_mcp_server-0.1.0 → drupal_mcp_server-0.3.0}/.github/workflows/ci.yml

@@ -46,10 +46,13 @@ jobs:
       uses: codecov/codecov-action@v4
       with:
         files: ./coverage.xml
+        token: ${{ secrets.CODECOV_TOKEN }}
         fail_ci_if_error: true
 
     - name: Dependency vulnerability scan
-      run: pip-audit
+      run: |
+        pip install --upgrade "setuptools>=83.0.0"
+        pip-audit
 
   build:
     runs-on: ubuntu-latest

{drupal_mcp_server-0.1.0 → drupal_mcp_server-0.3.0}/.github/workflows/docs.yml

@@ -7,15 +7,24 @@ on:
       - 'docs/**'
       - 'mkdocs.yml'
       - 'README.md'
+      - '.github/workflows/docs.yml'
   pull_request:
     paths:
       - 'docs/**'
       - 'mkdocs.yml'
       - 'README.md'
+      - '.github/workflows/docs.yml'
 
 jobs:
   docs:
     runs-on: ubuntu-latest
+    # peaceiris/actions-gh-pages pushes the built site to the gh-pages
+    # branch, which requires write access. The repo's default workflow
+    # token is read-only, so grant it explicitly here.
+    permissions:
+      contents: write
+      pages: write
+      id-token: write
 
     steps:
     - uses: actions/checkout@v4

{drupal_mcp_server-0.1.0 → drupal_mcp_server-0.3.0}/.gitignore

@@ -56,10 +56,22 @@ htmlcov/
 # Ruff
 .ruff_cache/
 
+# mkdocs build output
+site/
+
 # Environment
 .env
 .env.local
 .env.*.local
+.env.live-smoke
+# Env files generated by the live migration harness scripts (contain
+# local dev credentials).
+.env.live
+.env.d9d11
+.env.d7d11
+
+# Runtime migration-plan state written by MigrationService
+.drupal-mcp/
 
 # OS
 .DS_Store
@@ -76,3 +88,5 @@ config/sync/
 .omc
 .pi
 .mutagen-*
+# export tools' default destination when DRUPAL_ROOT points at the repo
+exports/

{drupal_mcp_server-0.1.0 → drupal_mcp_server-0.3.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: drupal-mcp-server
-Version: 0.1.0
+Version: 0.3.0
 Summary: MCP server for Drupal operations - JSON:API, GraphQL, Drush, AI-powered migration
 Author: Loganathane V
 License: MIT
@@ -15,6 +15,7 @@ Requires-Python: >=3.11
 Requires-Dist: click>=8.1.7
 Requires-Dist: fastmcp>=2.0.0
 Requires-Dist: httpx>=0.27.0
+Requires-Dist: openpyxl>=3.1.2
 Requires-Dist: pydantic-settings>=2.3.0
 Requires-Dist: pydantic>=2.8.0
 Requires-Dist: python-dotenv>=1.0.0
@@ -44,11 +45,12 @@ Description-Content-Type: text/markdown
 
 [![CI](https://github.com/vloganathane/drupal-mcp-server/actions/workflows/ci.yml/badge.svg)](https://github.com/vloganathane/drupal-mcp-server/actions/workflows/ci.yml)
 [![codecov](https://codecov.io/gh/vloganathane/drupal-mcp-server/branch/main/graph/badge.svg)](https://codecov.io/gh/vloganathane/drupal-mcp-server)
-[![PyPI version](https://badge.fury.io/py/drupal-mcp-server.svg)](https://badge.fury.io/py/drupal-mcp-server)
+[![PyPI version](https://img.shields.io/pypi/v/drupal-mcp-server.svg)](https://pypi.org/project/drupal-mcp-server/)
 [![Python versions](https://img.shields.io/pypi/pyversions/drupal-mcp-server.svg)](https://pypi.org/project/drupal-mcp-server/)
+[![PyPI downloads](https://img.shields.io/pypi/dm/drupal-mcp-server.svg)](https://pypi.org/project/drupal-mcp-server/)
 [![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://github.com/vloganathane/drupal-mcp-server/blob/main/LICENSE)
 
-A Model Context Protocol (MCP) server for Drupal operations. Provides **367 tools across 37 modules** for site analysis, migration, content management, configuration, commerce, headless, DevOps, security, and more.
+A Model Context Protocol (MCP) server for Drupal operations. Provides **414 tools across 41 modules** for site analysis, migration, content management, configuration, commerce, headless, DevOps, security, and more.
 
 ## Why Use This?
 
@@ -130,6 +132,27 @@ Add to `~/Library/Application Support/Claude/claude_desktop_config.json`:
 }
 ```
 
+## AI Coding Agents
+
+Register the server with any MCP client in one command:
+
+```bash
+drupal-mcp install
+```
+
+It detects the agents on your machine — Claude Code, Claude Desktop, Cursor,
+Codex CLI, OpenCode, Windsurf, Pi, Hermes Agent and OpenClaw — gathers
+`DRUPAL_*` settings from `./.env` or the environment, and writes each client's
+config (preferring the client's own `mcp add` command when it has one).
+
+```bash
+drupal-mcp install --client claude-code --print   # preview without writing
+drupal-mcp install --command 'uvx drupal-mcp-server'  # run from PyPI, no install
+```
+
+See the [AI Coding Agents guide](docs/agents.md) for per-client copy-paste
+snippets, options, and caveats.
+
 ## Configuration
 
 ### Drupal connection
@@ -181,7 +204,7 @@ Set `MCP_TRANSPORT` to one of:
 - `sse` (for Server-Sent Events)
 - `streamable-http` (for Streamable HTTP)
 
-## Tools (367 total)
+## Tools (414 total)
 
 ### Accessibility (5)
 - `accessibility_axe_scan` — Run axe-core accessibility scan
@@ -196,13 +219,16 @@ Set `MCP_TRANSPORT` to one of:
 - `ai_generate_migration_plan` — Generate migration plan with AI
 - `ai_translate_content` — Translate content with AI
 
-### Analysis (6)
+### Analysis (9)
 - `analyze_d7_site` — Analyze D7 site for D10 readiness
 - `analyze_d9_site` — Analyze D9+ for deprecated APIs
 - `inventory_content_types` — List all content types
 - `inventory_modules` — List all modules
 - `map_modules_d7_to_d10` — AI-powered module mapping D7→D10
 - `find_deprecated_code` — Scan for deprecated APIs
+- `find_entity_references` — Bundles whose reference fields target an entity type
+- `search_entities` — Substring search across titles, names, and subjects
+- `find_entity_by_path` — Resolve a URL path or alias to its entity
 
 ### Code Audit (7)
 - `code_audit_phpstan` — Run PHPStan static analysis
@@ -213,6 +239,11 @@ Set `MCP_TRANSPORT` to one of:
 - `composer_audit` — Composer dependency audit
 - `code_quality_report` — Combined code quality report
 
+### Codebase (12)
+- `codebase_index_refresh`, `codebase_search`, `codebase_module_list`, `codebase_module_describe`
+- `codebase_unused_modules`, `codebase_redundancy_check`, `codebase_hooks_find`, `codebase_paths_list`
+- `codebase_files_list`, `codebase_directory_tree`, `codebase_file_read`, `codebase_function_read`
+
 ### Comments (10)
 - `comment_list`, `comment_get`, `comment_create`, `comment_update`, `comment_delete`
 - `comment_thread_list`, `comment_approve`, `comment_unapprove`
@@ -226,8 +257,8 @@ Set `MCP_TRANSPORT` to one of:
 - `commerce_promotion_list`, `commerce_promotion_create`
 - `commerce_shipping_method_list`, `commerce_shipping_method_create`
 
-### Config (7)
-- `config_get`, `config_set`, `export_config`, `import_config`, `sync_config`, `diff_config`, `split_config`
+### Config (8)
+- `config_get`, `config_set`, `export_config`, `import_config`, `sync_config`, `diff_config`, `split_config`, `config_status`
 
 ### Contact (9)
 - `contact_form_list`, `contact_form_get`, `contact_form_create`, `contact_form_update`, `contact_form_delete`
@@ -251,9 +282,13 @@ Set `MCP_TRANSPORT` to one of:
 - `composer_install`, `composer_require`, `composer_update`
 - `drush_cron`, `drush_watchdog`, `cache_clear`, `drush_updb`, `drush_php_eval`
 
-### Drupal.org (9)
+### Drupal.org (12)
 - `module_search`, `module_get`, `module_versions`, `module_dependencies`, `module_compatibility`
 - `theme_search`, `theme_get`, `release_history`, `project_usage`
+- `module_issues_search`, `module_popular`, `module_recommendation`
+
+### Exports (4)
+- `export_nodes`, `export_users`, `export_media`, `export_taxonomy`
 
 ### Feeds (12)
 - `feeds_feed_list`, `feeds_feed_get`, `feeds_feed_create`, `feeds_feed_update`, `feeds_feed_delete`
@@ -298,7 +333,7 @@ displays have Layout Builder enabled; `layout_builder_get`,
 - `metatag_defaults_get`, `metatag_defaults_set`, `metatag_token_list`
 - `metatag_canonical_set`, `metatag_jsonld_generate`
 
-### Migration (7)
+### Migration (17)
 - `generate_migration_yaml` — Generate migration YAML
 - `generate_module_migration` — Generate migration module
 - `run_migration_test` — Test migration with limited records
@@ -306,6 +341,16 @@ displays have Layout Builder enabled; `layout_builder_get`,
 - `rollback_migration` — Rollback a migration
 - `sync_media_files` — Sync media between paths
 - `migrate_taxonomy` — Migrate taxonomy vocabularies
+- `create_migration_plan` — Create a persisted migration manifest
+- `get_migration_plan` — Read a migration manifest and tracked state
+- `list_migration_plans` — List migration manifests
+- `migration_status` — Summarize migration progress
+- `migrate_records` — Copy a batch of source records to the target site
+- `record_migration_result` — Record externally executed migration outcomes
+- `analyze_source_site` — Analyze a source Drupal JSON:API resource type
+- `reconcile_migration_counts` — Compare source and target counts
+- `run_migration_wave` — Fetch and migrate one source resource type
+- `run_migration` — Run an ordered end-to-end migration for all planned types
 
 ### Moderation (13)
 - `moderation_state_list`, `moderation_state_get`, `moderation_state_create`, `moderation_state_update`, `moderation_state_delete`
@@ -353,7 +398,7 @@ displays have Layout Builder enabled; `layout_builder_get`,
 - `search_api_index_list`, `search_api_index_get`, `search_api_index_create`, `search_api_index_update`
 - `search_api_index_reindex`, `search_api_index_clear`, `search_api_facet_list`, `search_api_facet_create`
 
-### Security Audit (8)
+### Security Audit (10)
 - `security_scan` — PHPStan with security extensions
 - `dependency_scan` — Composer audit
 - `config_security_check` — Drupal config security
@@ -362,6 +407,14 @@ displays have Layout Builder enabled; `layout_builder_get`,
 - `xss_scan` — XSS vulnerability detection
 - `csp_audit` — Content Security Policy audit
 - `file_permissions_audit` — File permissions audit
+- `code_security_scan` — Local pattern scan, nothing to install
+- `route_access_audit` — Route access control classification
+
+### Status (4)
+- `status_report` — The site's status report (/admin/reports/status), read-only
+- `database_updates` — Pending database updates, read-only
+- `available_updates` — Packages with newer versions, from composer
+- `health_check` — Drush, database, JSON:API, and module diagnostics
 
 ### Taxonomy (10)
 - `create_vocabulary`, `get_vocabulary`, `update_vocabulary`, `delete_vocabulary`, `list_vocabularies`
@@ -372,6 +425,11 @@ displays have Layout Builder enabled; `layout_builder_get`,
 - `test_scaffold_phpunit`, `test_scaffold_behat`, `test_scaffold_nightwatch`
 - `test_coverage_report`, `test_list_suites`
 
+### Theme Analysis (8)
+- `theme_active`, `theme_info`, `theme_regions`, `theme_blocks`
+- `theme_templates`, `theme_template_overrides`, `template_suggestions`
+- `view_template_info`
+
 ### Theme Development (11)
 - `theme_create`, `theme_library_create`, `theme_region_create`, `theme_template_override`
 - `theme_preprocess_function`, `theme_breakpoint_create`, `theme_base_change`
@@ -393,10 +451,10 @@ displays have Layout Builder enabled; `layout_builder_get`,
 
 ## Documentation
 
-- [Contributing Guide](CONTRIBUTING.md)
-- [Changelog](CHANGELOG.md)
-- [Security Policy](SECURITY.md)
-- [Code of Conduct](CODE_OF_CONDUCT.md)
+- [Contributing Guide](docs/CONTRIBUTING.md)
+- [Changelog](docs/CHANGELOG.md)
+- [Security Policy](docs/SECURITY.md)
+- [Code of Conduct](docs/CODE_OF_CONDUCT.md)
 - [Architecture](docs/architecture.md)
 - [Migration Guide](docs/migration.md)
 - [Docstring Standard](docs/docstring_standard.md)
@@ -491,7 +549,7 @@ python tests/live/queue_test.py           # 18 cron/queue cases, ~60s
 python tests/live/filter_check.py         # every hard-coded JSON:API filter
 python tests/live/resource_check.py       # every resource name, asked of Drupal
 python tests/live/install_modules.py      # the modules the tools assume, ~10 min
-python tests/live/sweep.py                # all 367 tools, ~30 min
+python tests/live/sweep.py                # all 414 tools, ~30 min
 python tests/live/mcp_call.py content_list '{}'  # one call, for spot checks
 ```
 

{drupal_mcp_server-0.1.0 → drupal_mcp_server-0.3.0}/README.md

@@ -2,11 +2,12 @@
 
 [![CI](https://github.com/vloganathane/drupal-mcp-server/actions/workflows/ci.yml/badge.svg)](https://github.com/vloganathane/drupal-mcp-server/actions/workflows/ci.yml)
 [![codecov](https://codecov.io/gh/vloganathane/drupal-mcp-server/branch/main/graph/badge.svg)](https://codecov.io/gh/vloganathane/drupal-mcp-server)
-[![PyPI version](https://badge.fury.io/py/drupal-mcp-server.svg)](https://badge.fury.io/py/drupal-mcp-server)
+[![PyPI version](https://img.shields.io/pypi/v/drupal-mcp-server.svg)](https://pypi.org/project/drupal-mcp-server/)
 [![Python versions](https://img.shields.io/pypi/pyversions/drupal-mcp-server.svg)](https://pypi.org/project/drupal-mcp-server/)
+[![PyPI downloads](https://img.shields.io/pypi/dm/drupal-mcp-server.svg)](https://pypi.org/project/drupal-mcp-server/)
 [![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://github.com/vloganathane/drupal-mcp-server/blob/main/LICENSE)
 
-A Model Context Protocol (MCP) server for Drupal operations. Provides **367 tools across 37 modules** for site analysis, migration, content management, configuration, commerce, headless, DevOps, security, and more.
+A Model Context Protocol (MCP) server for Drupal operations. Provides **414 tools across 41 modules** for site analysis, migration, content management, configuration, commerce, headless, DevOps, security, and more.
 
 ## Why Use This?
 
@@ -88,6 +89,27 @@ Add to `~/Library/Application Support/Claude/claude_desktop_config.json`:
 }
 ```
 
+## AI Coding Agents
+
+Register the server with any MCP client in one command:
+
+```bash
+drupal-mcp install
+```
+
+It detects the agents on your machine — Claude Code, Claude Desktop, Cursor,
+Codex CLI, OpenCode, Windsurf, Pi, Hermes Agent and OpenClaw — gathers
+`DRUPAL_*` settings from `./.env` or the environment, and writes each client's
+config (preferring the client's own `mcp add` command when it has one).
+
+```bash
+drupal-mcp install --client claude-code --print   # preview without writing
+drupal-mcp install --command 'uvx drupal-mcp-server'  # run from PyPI, no install
+```
+
+See the [AI Coding Agents guide](docs/agents.md) for per-client copy-paste
+snippets, options, and caveats.
+
 ## Configuration
 
 ### Drupal connection
@@ -139,7 +161,7 @@ Set `MCP_TRANSPORT` to one of:
 - `sse` (for Server-Sent Events)
 - `streamable-http` (for Streamable HTTP)
 
-## Tools (367 total)
+## Tools (414 total)
 
 ### Accessibility (5)
 - `accessibility_axe_scan` — Run axe-core accessibility scan
@@ -154,13 +176,16 @@ Set `MCP_TRANSPORT` to one of:
 - `ai_generate_migration_plan` — Generate migration plan with AI
 - `ai_translate_content` — Translate content with AI
 
-### Analysis (6)
+### Analysis (9)
 - `analyze_d7_site` — Analyze D7 site for D10 readiness
 - `analyze_d9_site` — Analyze D9+ for deprecated APIs
 - `inventory_content_types` — List all content types
 - `inventory_modules` — List all modules
 - `map_modules_d7_to_d10` — AI-powered module mapping D7→D10
 - `find_deprecated_code` — Scan for deprecated APIs
+- `find_entity_references` — Bundles whose reference fields target an entity type
+- `search_entities` — Substring search across titles, names, and subjects
+- `find_entity_by_path` — Resolve a URL path or alias to its entity
 
 ### Code Audit (7)
 - `code_audit_phpstan` — Run PHPStan static analysis
@@ -171,6 +196,11 @@ Set `MCP_TRANSPORT` to one of:
 - `composer_audit` — Composer dependency audit
 - `code_quality_report` — Combined code quality report
 
+### Codebase (12)
+- `codebase_index_refresh`, `codebase_search`, `codebase_module_list`, `codebase_module_describe`
+- `codebase_unused_modules`, `codebase_redundancy_check`, `codebase_hooks_find`, `codebase_paths_list`
+- `codebase_files_list`, `codebase_directory_tree`, `codebase_file_read`, `codebase_function_read`
+
 ### Comments (10)
 - `comment_list`, `comment_get`, `comment_create`, `comment_update`, `comment_delete`
 - `comment_thread_list`, `comment_approve`, `comment_unapprove`
@@ -184,8 +214,8 @@ Set `MCP_TRANSPORT` to one of:
 - `commerce_promotion_list`, `commerce_promotion_create`
 - `commerce_shipping_method_list`, `commerce_shipping_method_create`
 
-### Config (7)
-- `config_get`, `config_set`, `export_config`, `import_config`, `sync_config`, `diff_config`, `split_config`
+### Config (8)
+- `config_get`, `config_set`, `export_config`, `import_config`, `sync_config`, `diff_config`, `split_config`, `config_status`
 
 ### Contact (9)
 - `contact_form_list`, `contact_form_get`, `contact_form_create`, `contact_form_update`, `contact_form_delete`
@@ -209,9 +239,13 @@ Set `MCP_TRANSPORT` to one of:
 - `composer_install`, `composer_require`, `composer_update`
 - `drush_cron`, `drush_watchdog`, `cache_clear`, `drush_updb`, `drush_php_eval`
 
-### Drupal.org (9)
+### Drupal.org (12)
 - `module_search`, `module_get`, `module_versions`, `module_dependencies`, `module_compatibility`
 - `theme_search`, `theme_get`, `release_history`, `project_usage`
+- `module_issues_search`, `module_popular`, `module_recommendation`
+
+### Exports (4)
+- `export_nodes`, `export_users`, `export_media`, `export_taxonomy`
 
 ### Feeds (12)
 - `feeds_feed_list`, `feeds_feed_get`, `feeds_feed_create`, `feeds_feed_update`, `feeds_feed_delete`
@@ -256,7 +290,7 @@ displays have Layout Builder enabled; `layout_builder_get`,
 - `metatag_defaults_get`, `metatag_defaults_set`, `metatag_token_list`
 - `metatag_canonical_set`, `metatag_jsonld_generate`
 
-### Migration (7)
+### Migration (17)
 - `generate_migration_yaml` — Generate migration YAML
 - `generate_module_migration` — Generate migration module
 - `run_migration_test` — Test migration with limited records
@@ -264,6 +298,16 @@ displays have Layout Builder enabled; `layout_builder_get`,
 - `rollback_migration` — Rollback a migration
 - `sync_media_files` — Sync media between paths
 - `migrate_taxonomy` — Migrate taxonomy vocabularies
+- `create_migration_plan` — Create a persisted migration manifest
+- `get_migration_plan` — Read a migration manifest and tracked state
+- `list_migration_plans` — List migration manifests
+- `migration_status` — Summarize migration progress
+- `migrate_records` — Copy a batch of source records to the target site
+- `record_migration_result` — Record externally executed migration outcomes
+- `analyze_source_site` — Analyze a source Drupal JSON:API resource type
+- `reconcile_migration_counts` — Compare source and target counts
+- `run_migration_wave` — Fetch and migrate one source resource type
+- `run_migration` — Run an ordered end-to-end migration for all planned types
 
 ### Moderation (13)
 - `moderation_state_list`, `moderation_state_get`, `moderation_state_create`, `moderation_state_update`, `moderation_state_delete`
@@ -311,7 +355,7 @@ displays have Layout Builder enabled; `layout_builder_get`,
 - `search_api_index_list`, `search_api_index_get`, `search_api_index_create`, `search_api_index_update`
 - `search_api_index_reindex`, `search_api_index_clear`, `search_api_facet_list`, `search_api_facet_create`
 
-### Security Audit (8)
+### Security Audit (10)
 - `security_scan` — PHPStan with security extensions
 - `dependency_scan` — Composer audit
 - `config_security_check` — Drupal config security
@@ -320,6 +364,14 @@ displays have Layout Builder enabled; `layout_builder_get`,
 - `xss_scan` — XSS vulnerability detection
 - `csp_audit` — Content Security Policy audit
 - `file_permissions_audit` — File permissions audit
+- `code_security_scan` — Local pattern scan, nothing to install
+- `route_access_audit` — Route access control classification
+
+### Status (4)
+- `status_report` — The site's status report (/admin/reports/status), read-only
+- `database_updates` — Pending database updates, read-only
+- `available_updates` — Packages with newer versions, from composer
+- `health_check` — Drush, database, JSON:API, and module diagnostics
 
 ### Taxonomy (10)
 - `create_vocabulary`, `get_vocabulary`, `update_vocabulary`, `delete_vocabulary`, `list_vocabularies`
@@ -330,6 +382,11 @@ displays have Layout Builder enabled; `layout_builder_get`,
 - `test_scaffold_phpunit`, `test_scaffold_behat`, `test_scaffold_nightwatch`
 - `test_coverage_report`, `test_list_suites`
 
+### Theme Analysis (8)
+- `theme_active`, `theme_info`, `theme_regions`, `theme_blocks`
+- `theme_templates`, `theme_template_overrides`, `template_suggestions`
+- `view_template_info`
+
 ### Theme Development (11)
 - `theme_create`, `theme_library_create`, `theme_region_create`, `theme_template_override`
 - `theme_preprocess_function`, `theme_breakpoint_create`, `theme_base_change`
@@ -351,10 +408,10 @@ displays have Layout Builder enabled; `layout_builder_get`,
 
 ## Documentation
 
-- [Contributing Guide](CONTRIBUTING.md)
-- [Changelog](CHANGELOG.md)
-- [Security Policy](SECURITY.md)
-- [Code of Conduct](CODE_OF_CONDUCT.md)
+- [Contributing Guide](docs/CONTRIBUTING.md)
+- [Changelog](docs/CHANGELOG.md)
+- [Security Policy](docs/SECURITY.md)
+- [Code of Conduct](docs/CODE_OF_CONDUCT.md)
 - [Architecture](docs/architecture.md)
 - [Migration Guide](docs/migration.md)
 - [Docstring Standard](docs/docstring_standard.md)
@@ -449,7 +506,7 @@ python tests/live/queue_test.py           # 18 cron/queue cases, ~60s
 python tests/live/filter_check.py         # every hard-coded JSON:API filter
 python tests/live/resource_check.py       # every resource name, asked of Drupal
 python tests/live/install_modules.py      # the modules the tools assume, ~10 min
-python tests/live/sweep.py                # all 367 tools, ~30 min
+python tests/live/sweep.py                # all 414 tools, ~30 min
 python tests/live/mcp_call.py content_list '{}'  # one call, for spot checks
 ```
 

{drupal_mcp_server-0.1.0 → drupal_mcp_server-0.3.0/docs}/CHANGELOG.md

@@ -7,6 +7,100 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.3.0] - 2026-10-17
+
+### Added
+
+- Wave 5 of the drupal-scout-mcp port — 2 local security tools
+  (414 total, 41 modules): `code_security_scan` runs scout's
+  zero-dependency pattern engine (XSS, SQL injection, command injection,
+  path traversal, hardcoded secrets, access control, CSRF, deprecated
+  API — 8 families, category/severity filters, per-finding file/line/
+  snippet/fix recommendation) with its Drupal-aware false-positive table
+  (EntityQuery conditions, stream wrappers, escapeshellarg, example
+  secrets, comment lines), so a site without PHPStan gets concrete
+  findings; counts stay complete when `max_findings` truncates the list.
+  `route_access_audit` is the routing half of scout's anonymous-exploit
+  scan done properly per route: every `*.routing.yml` route classified
+  as anonymous / permission / role / entity / custom / a named
+  underscore requirement / an alias (whose definition may live in a
+  PHP route provider this YAML pass cannot read) / denied / **missing**,
+  with its controller mapped to the declaring file. Targets confine to
+  DRUPAL_ROOT and prune vendor, tests, and contrib from the default scan;
+  symlinks are skipped. Two accuracy corrections over scout's registry:
+  `t(` is a live D8+ function (scout flagged every translation call as a
+  Drupal 7 leftover) and scout's CSRF `$request` pattern was escaped so
+  it could never match PHP. Scout's `verify_vulnerability` was not
+  ported — it returns static advice rather than site-specific data —
+  and the optional tree-sitter AST layer is skipped: the pattern pass
+  carries the signal. Live testing on D11.4.10's core node module
+  (115 files) caught five accuracy bugs before release: JS template
+  literals matched the PHP backtick-shell pattern, Drupal's `{table}` /
+  `->...Table()` placeholder concatenation read as SQL injection,
+  unrecognized underscore requirements and alias-only entries were both
+  reported as missing access (node went from five "missing" routes to
+  zero real ones), and a zero-file scan read as a clean bill of health.
+- Wave 4 of the drupal-scout-mcp port — 8 read-only theme analysis tools
+  (412 total, 41 modules): `theme_active` (default/admin/enabled themes
+  from `system.theme` + `pm:list`), `theme_info` (pm:list metadata merged
+  with a safe YAML parse of the theme's info.yml — regions in declaration
+  order, libraries, dependencies, and the base-theme chain followed
+  upward), `theme_regions` (regions with their block placements and
+  counts, empty regions visible, placements in regions the theme no
+  longer defines flagged), `theme_blocks` (every `block.block.*`
+  placement with theme/region/search filters — search matches labels and
+  plugins, folding scout's separate `search_blocks` into one tool),
+  `theme_templates` (pruned `*.html.twig` walk with sizes),
+  `theme_template_overrides` (one docroot-wide index splits templates
+  that shadow same-named core/module files from theme originals),
+  `template_suggestions` (the Twig suggestion chain per entity type, each
+  marked with whether the default theme already ships that file), and
+  `view_template_info` (the chain for a view display, looked up in the
+  JSON:API view collection by its machine id — Views config names differ
+  between Drupal generations, `view.*` on older sites and `views.view.*`
+  on Drupal 11.4+, so the entity collection is the stable source — with
+  an unknown display_id erroring with the display list and an unknown
+  view listing the ones the site has). Every file path resolves inside
+  DRUPAL_ROOT before a read — symlinks and `..` segments that leave the
+  docroot are rejected — and no caller input reaches a shell; theme
+  blocks come from JSON:API rather than scout's interpolated `drush ev`
+- The shared JSON:API helpers (`jsonapi_collect`, `jsonapi_attrs`,
+  `jsonapi_bundle`, `jsonapi_rel_ids`), `flag_label`, and the export
+  path/write helpers moved from the exports module into `_utils` so both
+  waves page collections and confine destinations the same way
+- Wave 3 of the drupal-scout-mcp port — 4 export tools (404 total, 40
+  modules): `export_nodes`, `export_users`, `export_media`,
+  `export_taxonomy` write CSV (UTF-8 with BOM) or Excel files
+  (`openpyxl`, new runtime dependency) and return only the path,
+  row/column counts, size, and a three-row preview. Destination paths are
+  confined to the Drupal root, the system temp directory, or the home
+  directory; data is paged per bundle over JSON:API (never through the
+  shared merged offset, which skips rows), and taxonomy usage counts come
+  from one validated `GROUP BY` query per field storage targeting
+  taxonomy terms, with unreadable tables reported in a note instead of
+  failing the export (and a `safe_to_delete` verdict withheld entirely
+  whenever the counts are incomplete). Entries with no internal id —
+  Drupal's uid-0 anonymous user serves only a display_name — are skipped
+  and counted as `skipped_without_id`, and an unreadable status stays
+  empty in the CSV rather than being presented as "blocked"
+- `sql_output`/`sql_rows` moved from the analysis module into `_utils` so
+  the export tools parse `drush sql:query` text the same way
+- Wave 2 of the drupal-scout-mcp port — 8 tools (400 total, 39 modules):
+  - Status section (4): `status_report` (drush core:requirements, severity
+    filter), `database_updates` (read-only pending DB updates),
+    `available_updates` (composer outdated with dev filtering and a
+    security-only mode intersected with composer audit), `health_check`
+    (Drush, database, JSON:API, and module probes with a fix per failure)
+  - Analysis: `find_entity_references` (bundles whose reference fields
+    target an entity type, via JSON:API field config), `search_entities`
+    (escaped LIKE search across six entity tables), `find_entity_by_path`
+    (route or path-alias resolution to an entity)
+  - Config: `config_status` (read-only active vs sync comparison)
+- `run_composer` gained a `tail` argument so tools that parse full JSON
+  documents (`composer outdated`) are not truncated
+
+## [0.2.0] - 2026-10-16
+
 ### Security
 
 - Fix command injection vulnerabilities in code audit and security audit tools
@@ -17,6 +111,18 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Added
 
+- Add `drupal-mcp install`, a self-installer that registers the server with
+  local MCP clients (Claude Code, Claude Desktop, Cursor, Codex CLI,
+  OpenCode, Windsurf, Pi, Hermes Agent, OpenClaw), with `--print`/`--json`
+  for scripted setup and an AI Coding Agents guide
+- Add `module_issues_search`, `module_popular`, and `module_recommendation`
+  (client-side issue-queue relevance scoring, usage-ranked module lists by
+  category, local-index + drupal.org recommendations), plus the `DRUPAL_ROOT`
+  and `DRUPAL_MODULES_PATH` settings for local codebase analysis
+- Add a local codebase index with 12 `codebase_*` tools: functionality
+  search, module inventory/descriptions, unused and redundant module
+  detection, hook implementation lookup, and safe module file/tree/function
+  reading (all reads confined to `DRUPAL_ROOT`)
 - Add `moderation_transition_delete`, giving `moderation_transition_create` the
   counterpart it never had. The tool count is now 367
 - Add Lando support to SiteManager