v1.0.0

First public release. A Model Context Protocol server that gives an AI assistant read-only introspection into a Symfony application.

What it does

Exposes 1,679 tools across 16 categories — routes, services and the DI container, Doctrine entities and mappings, database schema, migrations, composer packages, and logs.

Sending 1,679 schemas on connect would exhaust a client's context window before the developer typed anything, so it doesn't. On connect the client sees five discovery tools: list categories, search, activate, deactivate, and show what's active. The model finds what it needs and activates that category, under a 40,000-token budget enforced per session. Set SYMFONY_MCP_DYNAMIC_TOOLS=false for the legacy behaviour.

Security

Every tool call passes through five layers:

validateToolArgs → guardAppPath → withAudit → tool → sanitizeToolResult

Input validation, app-path guarding with symlink resolution, an encrypted audit log (JSONL or SIEM-ready CEF), DLP scrubbing of the output, and a size cap. There is no write path to the application — that is structural, not a configuration option.

Install

npx @shakaran/symfony-agent-mcp

Works with Claude Code, Claude Desktop, Cursor, VS Code and Windsurf. Requires Node.js 22 or newer.

Known issue

Three tools in this release are advertised but have no handler, so calling them returns Unknown tool: get_php_dnf_type_stats, get_php_hash_algorithm_security_tools and get_php_socket_programming_tools. Fixed in v1.0.1.