hypervel / mcp

0.4.x-dev 2026-10-19 23:11 UTC

Requires

• php: ^8.4
• ext-swoole: ^6.3.0RC1
• guzzlehttp/psr7: ^3.1
• hypervel/auth: ^0.4
• hypervel/cache: ^0.4
• hypervel/collections: ^0.4
• hypervel/conditionable: ^0.4
• hypervel/config: ^0.4
• hypervel/console: ^0.4
• hypervel/container: ^0.4
• hypervel/context: ^0.4
• hypervel/contracts: ^0.4
• hypervel/coroutine: ^0.4
• hypervel/database: ^0.4
• hypervel/engine: ^0.4
• hypervel/filesystem: ^0.4
• hypervel/foundation: ^0.4
• hypervel/http: ^0.4
• hypervel/json-schema: ^0.4
• hypervel/log: ^0.4
• hypervel/macroable: ^0.4
• hypervel/process: ^0.4
• hypervel/routing: ^0.4
• hypervel/session: ^0.4
• hypervel/support: ^0.4
• hypervel/testing: ^0.4
• hypervel/validation: ^0.4
• hypervel/view: ^0.4
• league/flysystem: ^3.25.1
• psr/http-message: ^2.0
• symfony/console: ^8.1.2
• symfony/http-foundation: ^8.1
• symfony/http-kernel: ^8.1
• symfony/process: ^8.1
• symfony/routing: ^8.1

Suggests

• hypervel/passport: Required to authorize MCP clients using OAuth (^0.4).
• phpunit/phpunit: Required to use MCP testing assertions (^13.0).

MIT

• Albert Chen
• Raj Siva-Rajah

• php
• swoole
• mcp
• hypervel

Published on Packagist.org on 2026-10-27 07:31 UTC

README

Documentation: https://hypervel.org/docs/mcp

Differences From Laravel

• HTTP servers validate browser origins against app.url and mcp.allowed_origins. Configure additional origins for direct cross-origin browser clients; see allowed origins.
• Modern HTTP streams cancel their work when the client disconnects; legacy streams finish. Account for cancellation when performing streamed side effects; see streaming responses.
• Servers do not negotiate protocol revision 2025-03-26, which Laravel accepts in the initialize handshake without supporting the JSON-RPC batching it requires. Clients requesting it are offered 2025-11-25, so use clients that support 2025-06-18 or newer; see protocol versions.
• Dynamic OAuth registration is rate limited by Passport's passport limiter. Customize that limiter when needed; see OAuth authentication.
• Local authorization-server discovery belongs to Passport and requires its configured HTTPS issuer. MCP keeps protected-resource discovery and uses passport.clients.register for registration. Choose one registration endpoint and define resource audiences in Passport; see OAuth setup.
• Anonymous registration persists an explicit scope ceiling from Passport's anonymous allowance plus mcp:use; custom client schemas require scopes and third_party. Wildcard callback domains permit HTTPS and HTTP loopback only; explicit administrator allowances and configured native schemes remain supported. See registration policy.
• Connect URLs containing resource_metadata or scope must be signed with redirect()->signedRoute() or URL::signedRoute() to prevent discovery-hint tampering; see authorization challenges.
• OAuth clients require an explicit policy allowance for private DNS destinations and a DNS substitute for unresolved hostnames in faked tests. See OAuth destinations and testing OAuth clients.
• OAuth clients use the remote server's advertised scopes instead of assuming mcp:use. Set withOAuth(scope: 'mcp:use') when that scope is required but not advertised; see OAuth scopes.
• The Inspector verifies HTTPS certificates. Configure NODE_EXTRA_CA_CERTS for locally issued certificates; see MCP Inspector.
• LastModified attributes require a complete date-time with seconds and a timezone so TypeScript-SDK clients can consume the response. Reformat other timestamp representations as described in resource annotations.
• Subclasses redeclaring JsonRpcException::$data or the client StdioTransport::$input must match their updated property types; see the MCP porting guide.

Ported from: https://github.com/laravel/mcp