agent-mcp-cli

Agent MCP CLI

• The server key AGENT_MCP_KEY lives in .env, which artisan loads, so never export it by hand or pass it on the command line: it would land in shell history.
• No tool writes to the database, so surface a change you want made instead of attempting a write.
• Sensitive tools (run_artisan, config_inspect, db_diagnostics, cache_keys) are off by default, and agent-mcp:call refuses to print their result to a terminal without --allow-tty because it would land in scrollback. Piping or redirecting is always allowed.
• Redaction is best-effort; the real boundary is the read-only database grant and the per-tool enable flags. Never add agent-mcp:* to the run_artisan allowlist, which would let a tool re-invoke the CLI.

The CLI runs the same 14 tools as the HTTP endpoint with the same config flags, audit log and redaction, without registering an MCP server. Use it for one-off calls, scripts and CI; register the server when the need is constant. Examples use php artisan; use the project's form where it differs (for example vendor/bin/sail artisan).

Workflow

1. php artisan agent-mcp:tools lists the enabled tools (--all adds disabled ones, flagged enabled: false).

2. php artisan agent-mcp:schema <tool> prints a tool's inputs, so read it instead of guessing arguments.

3. Call with a JSON object as the positional argument or on STDIN. A tool with a section argument uses its first section when none is given.

   php artisan agent-mcp:call db_query '{"table":"users","query_type":"count"}'
   php artisan agent-mcp:call db_health '{"section":"indexes","table":"orders"}'
   php artisan agent-mcp:call queue_status '{"section":"failed"}'
   php artisan agent-mcp:call routes '{"name":"login"}'
   echo '{"sql":"select count(*) as c from users"}' | php artisan agent-mcp:call db_raw_select
   

4. Read the result: JSON on stdout (add --raw to skip pretty-printing), diagnostics on stderr, a non-zero exit on a tool error. A capped result carries truncated: true, so narrow the query instead of repeating it.