README

Українська

MCP server (Model Context Protocol) for ufo-tech/json-rpc-bundle: the methods of your JSON-RPC API become tools that AI agents — Claude Code, Cursor, Gemini CLI, OpenAI — call over Streamable HTTP. Like ufo-tech/rest-bundle, it is a thin adapter: business logic stays in RPC services, and every tool call runs through the JSON-RPC bundle unchanged.

Requires PHP 8.4+, Symfony 7.2+ / 8, ufo-tech/json-rpc-bundle ^10.4.3, the official mcp/sdk ^0.8.1.

composer require ufo-tech/mcp-bundle

Quick start

Ufo\McpBundle\UfoMcpBundle::class => ['all' => true],

Copy install/packages/ufo_mcp.yaml to config/packages/ and install/routes/ufo_mcp.yaml to config/routes/. One route import is one MCP endpoint serving one API group:

# config/routes/ufo_mcp.yaml
ufo_mcp:
    resource: ../../vendor/ufo-tech/mcp-bundle/config/router.yaml
    prefix: /mcp
    defaults: { api_group: mcp }

Put RPC methods into that group:

use Ufo\McpBundle\Attribute\McpTool;
use Ufo\RpcObject\RPC;

#[RPC\APIGroups(['mcp'], withDefault: false)]
class CatalogProcedure implements IRpcService
{
    /** Search products by name. */
    #[McpTool(readOnlyHint: true)]
    public function search(string $query, int $limit = 10): array { /* ... */ }
}

Connect a client: GET /mcp/manifest/claude.json (or cursor, gemini, openai) returns a ready config; the token is the JSON-RPC bundle's RPC token (Ufo-RPC-Token header).

Key features

Exposure by API group. Every method of the group is a tool, named after the RPC method; several endpoints (/mcp, /mcp/internal, …) side by side, each with its own methods — configuration
API versions. /mcp/v2 serves version 2 of the group — configuration
The core does the work. A tool call is an RPC request: parameter conversion, DTOs, validation, cache, locks, RPC events and errors as on /rpc — tools
Schemas and texts for agents. inputSchema / outputSchema from RPC metadata; titles and descriptions from the core translations by Accept-Language, also per group; #[McpTool] hints — tools
Both MCP protocol eras. Session-based (sessions in the core cache pool) and stateless 2026-07-28 on one URL — HTTP
Same security. Core RPC tokens (401/403), 404 for a disabled group or a missing version, CORS and DNS-rebinding protection, body limit — security
Discovery. server.json for the MCP Registry and client manifests — discovery
Extensible. Availability checker, access policy, own client manifests — extending

Not supported: OAuth, MCP resources and prompts, server-initiated messages. See limitations.

Release notes

All versions with what was added and how to use it: releases. Latest: 1.0.

Documentation

Installation, configuration and how the bundle works: MCP Bundle documentation.

Development

PHP runs in Docker (ufotech/php:8.4-fpm):

make up-d              # start the container
make composer-install
make test              # unit, functional and end-to-end tests

ufo-tech / mcp-bundle

Package info

Security

Statistics