drupal-mcp-server 0.2.0__tar.gz → 0.3.0__tar.gz

{drupal_mcp_server-0.2.0 → drupal_mcp_server-0.3.0}/.gitignore

@@ -88,3 +88,5 @@ config/sync/
 .omc
 .pi
 .mutagen-*
+# export tools' default destination when DRUPAL_ROOT points at the repo
+exports/

{drupal_mcp_server-0.2.0 → drupal_mcp_server-0.3.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: drupal-mcp-server
-Version: 0.2.0
+Version: 0.3.0
 Summary: MCP server for Drupal operations - JSON:API, GraphQL, Drush, AI-powered migration
 Author: Loganathane V
 License: MIT
@@ -15,6 +15,7 @@ Requires-Python: >=3.11
 Requires-Dist: click>=8.1.7
 Requires-Dist: fastmcp>=2.0.0
 Requires-Dist: httpx>=0.27.0
+Requires-Dist: openpyxl>=3.1.2
 Requires-Dist: pydantic-settings>=2.3.0
 Requires-Dist: pydantic>=2.8.0
 Requires-Dist: python-dotenv>=1.0.0
@@ -49,7 +50,7 @@ Description-Content-Type: text/markdown
 [![PyPI downloads](https://img.shields.io/pypi/dm/drupal-mcp-server.svg)](https://pypi.org/project/drupal-mcp-server/)
 [![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://github.com/vloganathane/drupal-mcp-server/blob/main/LICENSE)
 
-A Model Context Protocol (MCP) server for Drupal operations. Provides **392 tools across 38 modules** for site analysis, migration, content management, configuration, commerce, headless, DevOps, security, and more.
+A Model Context Protocol (MCP) server for Drupal operations. Provides **414 tools across 41 modules** for site analysis, migration, content management, configuration, commerce, headless, DevOps, security, and more.
 
 ## Why Use This?
 
@@ -203,7 +204,7 @@ Set `MCP_TRANSPORT` to one of:
 - `sse` (for Server-Sent Events)
 - `streamable-http` (for Streamable HTTP)
 
-## Tools (392 total)
+## Tools (414 total)
 
 ### Accessibility (5)
 - `accessibility_axe_scan` — Run axe-core accessibility scan
@@ -218,13 +219,16 @@ Set `MCP_TRANSPORT` to one of:
 - `ai_generate_migration_plan` — Generate migration plan with AI
 - `ai_translate_content` — Translate content with AI
 
-### Analysis (6)
+### Analysis (9)
 - `analyze_d7_site` — Analyze D7 site for D10 readiness
 - `analyze_d9_site` — Analyze D9+ for deprecated APIs
 - `inventory_content_types` — List all content types
 - `inventory_modules` — List all modules
 - `map_modules_d7_to_d10` — AI-powered module mapping D7→D10
 - `find_deprecated_code` — Scan for deprecated APIs
+- `find_entity_references` — Bundles whose reference fields target an entity type
+- `search_entities` — Substring search across titles, names, and subjects
+- `find_entity_by_path` — Resolve a URL path or alias to its entity
 
 ### Code Audit (7)
 - `code_audit_phpstan` — Run PHPStan static analysis
@@ -253,8 +257,8 @@ Set `MCP_TRANSPORT` to one of:
 - `commerce_promotion_list`, `commerce_promotion_create`
 - `commerce_shipping_method_list`, `commerce_shipping_method_create`
 
-### Config (7)
-- `config_get`, `config_set`, `export_config`, `import_config`, `sync_config`, `diff_config`, `split_config`
+### Config (8)
+- `config_get`, `config_set`, `export_config`, `import_config`, `sync_config`, `diff_config`, `split_config`, `config_status`
 
 ### Contact (9)
 - `contact_form_list`, `contact_form_get`, `contact_form_create`, `contact_form_update`, `contact_form_delete`
@@ -283,6 +287,9 @@ Set `MCP_TRANSPORT` to one of:
 - `theme_search`, `theme_get`, `release_history`, `project_usage`
 - `module_issues_search`, `module_popular`, `module_recommendation`
 
+### Exports (4)
+- `export_nodes`, `export_users`, `export_media`, `export_taxonomy`
+
 ### Feeds (12)
 - `feeds_feed_list`, `feeds_feed_get`, `feeds_feed_create`, `feeds_feed_update`, `feeds_feed_delete`
 - `feeds_import`, `feeds_import_status`, `feeds_log_list`
@@ -391,7 +398,7 @@ displays have Layout Builder enabled; `layout_builder_get`,
 - `search_api_index_list`, `search_api_index_get`, `search_api_index_create`, `search_api_index_update`
 - `search_api_index_reindex`, `search_api_index_clear`, `search_api_facet_list`, `search_api_facet_create`
 
-### Security Audit (8)
+### Security Audit (10)
 - `security_scan` — PHPStan with security extensions
 - `dependency_scan` — Composer audit
 - `config_security_check` — Drupal config security
@@ -400,6 +407,14 @@ displays have Layout Builder enabled; `layout_builder_get`,
 - `xss_scan` — XSS vulnerability detection
 - `csp_audit` — Content Security Policy audit
 - `file_permissions_audit` — File permissions audit
+- `code_security_scan` — Local pattern scan, nothing to install
+- `route_access_audit` — Route access control classification
+
+### Status (4)
+- `status_report` — The site's status report (/admin/reports/status), read-only
+- `database_updates` — Pending database updates, read-only
+- `available_updates` — Packages with newer versions, from composer
+- `health_check` — Drush, database, JSON:API, and module diagnostics
 
 ### Taxonomy (10)
 - `create_vocabulary`, `get_vocabulary`, `update_vocabulary`, `delete_vocabulary`, `list_vocabularies`
@@ -410,6 +425,11 @@ displays have Layout Builder enabled; `layout_builder_get`,
 - `test_scaffold_phpunit`, `test_scaffold_behat`, `test_scaffold_nightwatch`
 - `test_coverage_report`, `test_list_suites`
 
+### Theme Analysis (8)
+- `theme_active`, `theme_info`, `theme_regions`, `theme_blocks`
+- `theme_templates`, `theme_template_overrides`, `template_suggestions`
+- `view_template_info`
+
 ### Theme Development (11)
 - `theme_create`, `theme_library_create`, `theme_region_create`, `theme_template_override`
 - `theme_preprocess_function`, `theme_breakpoint_create`, `theme_base_change`
@@ -529,7 +549,7 @@ python tests/live/queue_test.py           # 18 cron/queue cases, ~60s
 python tests/live/filter_check.py         # every hard-coded JSON:API filter
 python tests/live/resource_check.py       # every resource name, asked of Drupal
 python tests/live/install_modules.py      # the modules the tools assume, ~10 min
-python tests/live/sweep.py                # all 392 tools, ~30 min
+python tests/live/sweep.py                # all 414 tools, ~30 min
 python tests/live/mcp_call.py content_list '{}'  # one call, for spot checks
 ```
 

{drupal_mcp_server-0.2.0 → drupal_mcp_server-0.3.0}/README.md

@@ -7,7 +7,7 @@
 [![PyPI downloads](https://img.shields.io/pypi/dm/drupal-mcp-server.svg)](https://pypi.org/project/drupal-mcp-server/)
 [![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://github.com/vloganathane/drupal-mcp-server/blob/main/LICENSE)
 
-A Model Context Protocol (MCP) server for Drupal operations. Provides **392 tools across 38 modules** for site analysis, migration, content management, configuration, commerce, headless, DevOps, security, and more.
+A Model Context Protocol (MCP) server for Drupal operations. Provides **414 tools across 41 modules** for site analysis, migration, content management, configuration, commerce, headless, DevOps, security, and more.
 
 ## Why Use This?
 
@@ -161,7 +161,7 @@ Set `MCP_TRANSPORT` to one of:
 - `sse` (for Server-Sent Events)
 - `streamable-http` (for Streamable HTTP)
 
-## Tools (392 total)
+## Tools (414 total)
 
 ### Accessibility (5)
 - `accessibility_axe_scan` — Run axe-core accessibility scan
@@ -176,13 +176,16 @@ Set `MCP_TRANSPORT` to one of:
 - `ai_generate_migration_plan` — Generate migration plan with AI
 - `ai_translate_content` — Translate content with AI
 
-### Analysis (6)
+### Analysis (9)
 - `analyze_d7_site` — Analyze D7 site for D10 readiness
 - `analyze_d9_site` — Analyze D9+ for deprecated APIs
 - `inventory_content_types` — List all content types
 - `inventory_modules` — List all modules
 - `map_modules_d7_to_d10` — AI-powered module mapping D7→D10
 - `find_deprecated_code` — Scan for deprecated APIs
+- `find_entity_references` — Bundles whose reference fields target an entity type
+- `search_entities` — Substring search across titles, names, and subjects
+- `find_entity_by_path` — Resolve a URL path or alias to its entity
 
 ### Code Audit (7)
 - `code_audit_phpstan` — Run PHPStan static analysis
@@ -211,8 +214,8 @@ Set `MCP_TRANSPORT` to one of:
 - `commerce_promotion_list`, `commerce_promotion_create`
 - `commerce_shipping_method_list`, `commerce_shipping_method_create`
 
-### Config (7)
-- `config_get`, `config_set`, `export_config`, `import_config`, `sync_config`, `diff_config`, `split_config`
+### Config (8)
+- `config_get`, `config_set`, `export_config`, `import_config`, `sync_config`, `diff_config`, `split_config`, `config_status`
 
 ### Contact (9)
 - `contact_form_list`, `contact_form_get`, `contact_form_create`, `contact_form_update`, `contact_form_delete`
@@ -241,6 +244,9 @@ Set `MCP_TRANSPORT` to one of:
 - `theme_search`, `theme_get`, `release_history`, `project_usage`
 - `module_issues_search`, `module_popular`, `module_recommendation`
 
+### Exports (4)
+- `export_nodes`, `export_users`, `export_media`, `export_taxonomy`
+
 ### Feeds (12)
 - `feeds_feed_list`, `feeds_feed_get`, `feeds_feed_create`, `feeds_feed_update`, `feeds_feed_delete`
 - `feeds_import`, `feeds_import_status`, `feeds_log_list`
@@ -349,7 +355,7 @@ displays have Layout Builder enabled; `layout_builder_get`,
 - `search_api_index_list`, `search_api_index_get`, `search_api_index_create`, `search_api_index_update`
 - `search_api_index_reindex`, `search_api_index_clear`, `search_api_facet_list`, `search_api_facet_create`
 
-### Security Audit (8)
+### Security Audit (10)
 - `security_scan` — PHPStan with security extensions
 - `dependency_scan` — Composer audit
 - `config_security_check` — Drupal config security
@@ -358,6 +364,14 @@ displays have Layout Builder enabled; `layout_builder_get`,
 - `xss_scan` — XSS vulnerability detection
 - `csp_audit` — Content Security Policy audit
 - `file_permissions_audit` — File permissions audit
+- `code_security_scan` — Local pattern scan, nothing to install
+- `route_access_audit` — Route access control classification
+
+### Status (4)
+- `status_report` — The site's status report (/admin/reports/status), read-only
+- `database_updates` — Pending database updates, read-only
+- `available_updates` — Packages with newer versions, from composer
+- `health_check` — Drush, database, JSON:API, and module diagnostics
 
 ### Taxonomy (10)
 - `create_vocabulary`, `get_vocabulary`, `update_vocabulary`, `delete_vocabulary`, `list_vocabularies`
@@ -368,6 +382,11 @@ displays have Layout Builder enabled; `layout_builder_get`,
 - `test_scaffold_phpunit`, `test_scaffold_behat`, `test_scaffold_nightwatch`
 - `test_coverage_report`, `test_list_suites`
 
+### Theme Analysis (8)
+- `theme_active`, `theme_info`, `theme_regions`, `theme_blocks`
+- `theme_templates`, `theme_template_overrides`, `template_suggestions`
+- `view_template_info`
+
 ### Theme Development (11)
 - `theme_create`, `theme_library_create`, `theme_region_create`, `theme_template_override`
 - `theme_preprocess_function`, `theme_breakpoint_create`, `theme_base_change`
@@ -487,7 +506,7 @@ python tests/live/queue_test.py           # 18 cron/queue cases, ~60s
 python tests/live/filter_check.py         # every hard-coded JSON:API filter
 python tests/live/resource_check.py       # every resource name, asked of Drupal
 python tests/live/install_modules.py      # the modules the tools assume, ~10 min
-python tests/live/sweep.py                # all 392 tools, ~30 min
+python tests/live/sweep.py                # all 414 tools, ~30 min
 python tests/live/mcp_call.py content_list '{}'  # one call, for spot checks
 ```
 

{drupal_mcp_server-0.2.0 → drupal_mcp_server-0.3.0}/docs/CHANGELOG.md

@@ -5,6 +5,100 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [Unreleased]
+
+## [0.3.0] - 2026-10-17
+
+### Added
+
+- Wave 5 of the drupal-scout-mcp port — 2 local security tools
+  (414 total, 41 modules): `code_security_scan` runs scout's
+  zero-dependency pattern engine (XSS, SQL injection, command injection,
+  path traversal, hardcoded secrets, access control, CSRF, deprecated
+  API — 8 families, category/severity filters, per-finding file/line/
+  snippet/fix recommendation) with its Drupal-aware false-positive table
+  (EntityQuery conditions, stream wrappers, escapeshellarg, example
+  secrets, comment lines), so a site without PHPStan gets concrete
+  findings; counts stay complete when `max_findings` truncates the list.
+  `route_access_audit` is the routing half of scout's anonymous-exploit
+  scan done properly per route: every `*.routing.yml` route classified
+  as anonymous / permission / role / entity / custom / a named
+  underscore requirement / an alias (whose definition may live in a
+  PHP route provider this YAML pass cannot read) / denied / **missing**,
+  with its controller mapped to the declaring file. Targets confine to
+  DRUPAL_ROOT and prune vendor, tests, and contrib from the default scan;
+  symlinks are skipped. Two accuracy corrections over scout's registry:
+  `t(` is a live D8+ function (scout flagged every translation call as a
+  Drupal 7 leftover) and scout's CSRF `$request` pattern was escaped so
+  it could never match PHP. Scout's `verify_vulnerability` was not
+  ported — it returns static advice rather than site-specific data —
+  and the optional tree-sitter AST layer is skipped: the pattern pass
+  carries the signal. Live testing on D11.4.10's core node module
+  (115 files) caught five accuracy bugs before release: JS template
+  literals matched the PHP backtick-shell pattern, Drupal's `{table}` /
+  `->...Table()` placeholder concatenation read as SQL injection,
+  unrecognized underscore requirements and alias-only entries were both
+  reported as missing access (node went from five "missing" routes to
+  zero real ones), and a zero-file scan read as a clean bill of health.
+- Wave 4 of the drupal-scout-mcp port — 8 read-only theme analysis tools
+  (412 total, 41 modules): `theme_active` (default/admin/enabled themes
+  from `system.theme` + `pm:list`), `theme_info` (pm:list metadata merged
+  with a safe YAML parse of the theme's info.yml — regions in declaration
+  order, libraries, dependencies, and the base-theme chain followed
+  upward), `theme_regions` (regions with their block placements and
+  counts, empty regions visible, placements in regions the theme no
+  longer defines flagged), `theme_blocks` (every `block.block.*`
+  placement with theme/region/search filters — search matches labels and
+  plugins, folding scout's separate `search_blocks` into one tool),
+  `theme_templates` (pruned `*.html.twig` walk with sizes),
+  `theme_template_overrides` (one docroot-wide index splits templates
+  that shadow same-named core/module files from theme originals),
+  `template_suggestions` (the Twig suggestion chain per entity type, each
+  marked with whether the default theme already ships that file), and
+  `view_template_info` (the chain for a view display, looked up in the
+  JSON:API view collection by its machine id — Views config names differ
+  between Drupal generations, `view.*` on older sites and `views.view.*`
+  on Drupal 11.4+, so the entity collection is the stable source — with
+  an unknown display_id erroring with the display list and an unknown
+  view listing the ones the site has). Every file path resolves inside
+  DRUPAL_ROOT before a read — symlinks and `..` segments that leave the
+  docroot are rejected — and no caller input reaches a shell; theme
+  blocks come from JSON:API rather than scout's interpolated `drush ev`
+- The shared JSON:API helpers (`jsonapi_collect`, `jsonapi_attrs`,
+  `jsonapi_bundle`, `jsonapi_rel_ids`), `flag_label`, and the export
+  path/write helpers moved from the exports module into `_utils` so both
+  waves page collections and confine destinations the same way
+- Wave 3 of the drupal-scout-mcp port — 4 export tools (404 total, 40
+  modules): `export_nodes`, `export_users`, `export_media`,
+  `export_taxonomy` write CSV (UTF-8 with BOM) or Excel files
+  (`openpyxl`, new runtime dependency) and return only the path,
+  row/column counts, size, and a three-row preview. Destination paths are
+  confined to the Drupal root, the system temp directory, or the home
+  directory; data is paged per bundle over JSON:API (never through the
+  shared merged offset, which skips rows), and taxonomy usage counts come
+  from one validated `GROUP BY` query per field storage targeting
+  taxonomy terms, with unreadable tables reported in a note instead of
+  failing the export (and a `safe_to_delete` verdict withheld entirely
+  whenever the counts are incomplete). Entries with no internal id —
+  Drupal's uid-0 anonymous user serves only a display_name — are skipped
+  and counted as `skipped_without_id`, and an unreadable status stays
+  empty in the CSV rather than being presented as "blocked"
+- `sql_output`/`sql_rows` moved from the analysis module into `_utils` so
+  the export tools parse `drush sql:query` text the same way
+- Wave 2 of the drupal-scout-mcp port — 8 tools (400 total, 39 modules):
+  - Status section (4): `status_report` (drush core:requirements, severity
+    filter), `database_updates` (read-only pending DB updates),
+    `available_updates` (composer outdated with dev filtering and a
+    security-only mode intersected with composer audit), `health_check`
+    (Drush, database, JSON:API, and module probes with a fix per failure)
+  - Analysis: `find_entity_references` (bundles whose reference fields
+    target an entity type, via JSON:API field config), `search_entities`
+    (escaped LIKE search across six entity tables), `find_entity_by_path`
+    (route or path-alias resolution to an entity)
+  - Config: `config_status` (read-only active vs sync comparison)
+- `run_composer` gained a `tail` argument so tools that parse full JSON
+  documents (`composer outdated`) are not truncated
+
 ## [0.2.0] - 2026-10-16
 
 ### Security

{drupal_mcp_server-0.2.0 → drupal_mcp_server-0.3.0}/docs/index.md

@@ -1,6 +1,6 @@
 # Drupal MCP Server
 
-A Model Context Protocol (MCP) server for Drupal operations. Provides 392 tools across 38 modules for site analysis, migration, content management, configuration, commerce, headless, DevOps, security, and more.
+A Model Context Protocol (MCP) server for Drupal operations. Provides 414 tools across 41 modules for site analysis, migration, content management, configuration, commerce, headless, DevOps, security, and more.
 
 ## Quick Links
 
@@ -11,19 +11,22 @@ A Model Context Protocol (MCP) server for Drupal operations. Provides 392 tools
 
 ## Features at a Glance
 
-A sample of the catalog — the full list of all 392 tools lives in the
-[README's Tools section](https://github.com/vloganathane/drupal-mcp-server#tools-392-total).
+A sample of the catalog — the full list of all 414 tools lives in the
+[README's Tools section](https://github.com/vloganathane/drupal-mcp-server#tools-414-total).
 
 | Category | Tools | Description |
 |----------|-------|-------------|
 | Content | 14 | CRUD for nodes, media, users, taxonomy, comments |
 | Users | 12 | User management, roles, permissions |
 | DevOps | 20 | DDEV/Lando, Drush, database, cron |
-| Security Audit | 8 | Audits, scanning, permission checks |
+| Security Audit | 10 | Audits, scanning, permission checks |
 | Migration | 17 | Plans, batch import, reconciliation between Drupal sites |
 | AI | 4 | Content analysis, field mapping, planning |
 | Module Dev | 12 | Scaffolding for modules, plugins, forms |
 | Codebase | 12 | Local codebase index, hook search, unused module detection |
+| Status | 4 | Status report, pending updates, health diagnostics |
+| Exports | 4 | CSV/Excel inventories of content, users, media, taxonomy |
+| Theme Analysis | 8 | Theme metadata, regions, block placements, Twig templates |
 
 ## Example: Create a Node