drupal-mcp-connector | Open Source

Drupal MCP Connector is for content operators, site-reliability teams, and developers who want an AI client to work with Drupal through explicit tools instead of browser automation or unrestricted shell access. Wilkes & Liberty maintains the MIT-licensed Node.js service. It can connect one MCP client to one or many Drupal sites, normalize JSON:API and GraphQL into one entity model, and expose governed read, audit, and write operations.

Why it exists

AI assistants can reason about content, but Drupal's administrative surface was designed for people clicking forms. Giving an agent a browser session is brittle; giving it database or SSH access is too broad; writing a custom integration for every content type does not scale. The connector turns Drupal's supported APIs into a documented Model Context Protocol surface with typed parameters, capability checks, dry runs, and bounded output.

Who should use it, and when

Editorial and content-operations teams auditing stale content, metadata, taxonomy, accessibility, links, and workflow state across a large site.
Drupal developers creating structured draft content, resolving entity references, managing Paragraphs, or inspecting site configuration from an MCP-aware coding client.
Platform operators working across multiple Drupal environments with different URLs, credentials, and allowed capabilities.
Security teams that want a read-only auditor profile or a constrained write plane rather than a general-purpose administrator credential.

Use it when an MCP client needs repeatable Drupal operations with a clear security envelope. It is not necessary for a simple public-content chatbot that can consume a purpose-built read-only feed.

Where it sits

The connector runs as a separate Node.js process, usually launched over MCP stdio by Claude, Codex, Gemini, or another MCP-aware client. It can also expose an authenticated HTTPS transport for shared or remote operation. On the Drupal side, it uses core JSON:API for the write plane and either JSON:API or GraphQL Compose for reads. An optional SSH Drush bridge reaches administrative tasks that HTTP APIs do not expose.

This separation matters: the connector translates agent intent into Drupal API calls, but Drupal remains the system of record. Pairing it with MCP Sentinel moves the final policy decision inside Drupal, where connector settings cannot bypass it.

What it provides

Release 2.2.1 exposes 119 tools across 26 modules, plus MCP resources and prompts. The surface includes:

Node, taxonomy, media, user, Paragraph, menu, block, redirect, translation, and generic entity operations.
Moderation, revision, scheduling, relationship-resolution, and bulk workflows.
Read-only reports for content completeness, SEO, accessibility, broken links, redirect health, configuration drift, permissions, text formats, caches, PII exposure, and workflow bottlenecks.
A composite site-health audit that rolls content, link, and configuration findings into one scored report.
Capability-aware JSON:API and GraphQL backends. GraphQL Compose is treated as read-only; unsupported writes fail clearly rather than falling through.
Dry-run support on destructive or mutating tools so an operator can inspect the proposed change before committing it.

A typical request path

The MCP client starts the connector and selects a named Drupal site profile.
The connector authenticates using the configured OAuth token, client credentials, or other site-specific method.
The client calls a narrow tool such as “list unpublished nodes,” “audit missing metadata,” or “create a draft article.”
The connector validates the request against its security preset and entity/field rules, selects the available backend, and normalizes the response.
For writes, Drupal evaluates its own entity access and moderation rules; MCP Sentinel can add OAuth-scope, profile, redaction, publish, and audit controls inside the CMS.
The connector returns structured results and per-item failures rather than pretending a partial bulk operation succeeded.

Security model

The default preset is production-strict: read-only with sensitive entity types denied and broad PII redaction. Other explicit presets support auditors, content editors, configuration editors, and a write plane with publishing disabled by default. Entity allowlists, upload-root restrictions, rate limits, GraphQL gates, transport authentication, and output caps narrow the connector further.

These are connector-side controls, not a substitute for Drupal authorization. MCP Sentinel provides the companion server-side boundary: role-selected policy profiles, OAuth scopes, content locks, field redaction, DLP, quotas, anomaly detection, reliable webhooks, and a tamper-evident audit trail.

Install and connect

Requires Node.js 20+ and Drupal 10 or 11. JSON:API ships with Drupal core; GraphQL reads require GraphQL Compose; token authentication commonly uses Simple OAuth.

npm install -g drupal-mcp-connector
# Or run without a global install:
npx -y drupal-mcp-connector

A minimal stdio registration looks like:

{
  "mcpServers": {
    "drupal": {
      "command": "drupal-mcp-connector",
      "env": {
        "DRUPAL_BASE_URL": "https://cms.example.gov",
        "DRUPAL_API_TOKEN": "managed-outside-source-control"
      }
    }
  }
}

For multi-site configuration, HTTPS transport, OAuth client credentials, GraphQL, and the Drush bridge, follow the repository's getting-started and deployment guides.

Honest boundaries

The connector does not make an AI agent correct, authorize a request Drupal denies, or turn GraphQL Compose into a mutation API. Reports are best-effort analyses over the data the credential may see; bounded or client-side GraphQL filtering can be approximate and is labeled as such. The Drush bridge is a separate administrative trust boundary and should be disabled unless an operator needs it. Raw SQL is off unless both the connector and MCP Sentinel opt into the governed path.

Operators remain responsible for credential storage, least-privilege roles, reviewing dry-run output, separating environments, and deciding which actions require human approval.

Project, package, source, and support

Maintained by Jeremy Michael Cerda and Wilkes & Liberty under the MIT license. The checked source release for this page is 2.2.1.