Skip to content

modxmcp 1.0.0

Choose a tag to compare

View all tags
@karamble karamble released this 01 Aug 22:04
· 23 commits to master since this release
v1.0.0
This tag was signed with the committer’s verified signature.
karamble karamble
GPG key ID: 47761B9F651E8896
Verified
Learn about vigilant mode.
c15191f
This commit was signed with the committer’s verified signature.
karamble karamble
GPG key ID: 47761B9F651E8896
Verified
Learn about vigilant mode.

First stable release: an MCP server for MODX Revolution 3.x, installed as a regular transport package.

What it is

modxmcp lets MCP clients administer a MODX 3.x site over Streamable HTTP. The endpoint is a MODX resource calling a snippet, so the package ships no web-accessible PHP and works on installs that deny PHP under assets/. Speaks MCP revision 2026-07-28 as well as the older protocol era that every currently-shipping client uses. Stateless, no SSE, zero third-party PHP dependencies.

Highlights

  • Writes go through MODX processors, so Manager-side behaviour fires natively: SeoSuite registration, Collections rules, cache invalidation and lifecycle events.
  • Token authentication: hashed at rest, per-token scopes, optional expiry and IP allowlist, last-used tracking. A Manager page handles token management and audit review, and the audit log covers rejected calls as well as successful ones.
  • Resource and element tools, including full element definition through element_save — input/output types, captions, option lists and properties for template variables, so MIGX, listbox and image TVs can be created and configured, not just filled.
  • Schema discovery across every installed extra, handling both package layouts and both metadata formats, with field descriptions taken from each extra's own lexicon.
  • Generic object access, opt-in per class for reads and writes, with a hard block on users, sessions, access-control rules and modxmcp's own tables that no setting can override.
  • File uploads via modxmcp_file_upload, written through the Browser/File/Upload processor so media source access policies, upload settings and the file-manager events all apply exactly as they would for a Manager upload. Ships disabled: the path allowlist is empty on install, and uploads are further gated by an extension allowlist, a size cap, a media source allowlist and a new write:media token scope. Server-executable extensions are blocked in every dot-segment of the filename, content containing a PHP open tag is refused regardless of name, and every upload is verified by reading the file back. The audit log stores who wrote which path, never the payload.
  • Adapters for SeoSuite (redirects), MIGX (item structure) and Collections (container listing), registered only where the extra is installed, plus an OnMCPRegisterTools event so third-party extras can contribute tools — a failing plugin degrades to its tools being absent, never to a dead endpoint.
  • Build fingerprint in modxmcp_site_info, computed per request from the shipped PHP files, so you can always tell exactly which build a site is running.

Installing

Upload modxmcp-1.0.0-pl.transport.zip through Package Management, or place it in core/packages/ and install by signature. Requires MODX Revolution 3.x. After installing, create a token on the modxmcp Manager page and point your MCP client at the endpoint resource.

Full details in core/components/modxmcp/docs/changelog.txt.

Assets 3
Loading