# Over MCP, for editors

> droost_mcp offers the content tools to Claude Desktop, claude.ai and other MCP clients, each call held to the connected account's own Drupal access.

`droost_mcp` offers droost's content tools to MCP clients (Claude Desktop,
claude.ai and others) through [MCP Server](https://www.drupal.org/project/mcp_server)
and its [Tool API bridge](https://www.drupal.org/project/mcp_server_tool_bridge).
It is the part of Droost meant for a production site: an editor works with
the site's content from their AI client, and can do no more than Drupal's
own UI would let them.

## Set it up

1. Require MCP Server and its bridge, which droost does not pull in:

   ```bash
   composer require 'drupal/mcp_server:^2.0@beta' 'drupal/mcp_server_tool_bridge:^1.0@beta'
   ```

2. Enable `droost` and `droost_mcp`, and `droost_canvas` on a Canvas site.
   Leave `droost_build` and `droost_dev` off.
3. Enable the tools you want reachable. `droost_mcp` installs one mapping
   per content tool, every one disabled. A tool you do not enable is not
   listed and cannot be called.
4. Grant `use droost content tools` to the roles that may use them.
5. Set up MCP Server's authentication (for example `mcp_server_oauth`),
   then connect the client to the site's `/mcp` endpoint.

## How a call is held

Each call over the web is the connected account's own:

- **Entity access**: view, create, update and delete, as in Drupal's UI.
- **Field access**: a field it may not edit is refused; one it may not view
  is withheld from reads and refused in a query's conditions and sort.
- **Validation before any save**: a user's current password, a free alias,
  a text format the account may use.
- **Counts** include only what it may view.
- **Writes** need their switch armed in `settings.droost.php`; over the web
  a switch nobody set is off.
- **Every call** is kept in an audit log.

The build and developer tools refuse a web request whatever the account
holds. `drush mcp:server <account>` (MCP Server's stdio mode) runs as that
account and is held the same way.

Disabling a mapping takes its tool off MCP at once, through the admin form
or through configuration.

## What the client is told

At connection, MCP Server's instructions name each enabled droost tool, what
it is for, and how a call is held, so a client needs no file in a
repository to know the tools are there. For an agent working in the
project, `droost_mcp` also ships the `droost-tools-mcp` skill (tool names as
a client lists them, and connecting Claude Code or Codex over stdio), which
`droost init` installs beside `droost-tools`.