Craft CMS 5.12.0: Added an authenticated HTTP MCP server

The release introduces an authenticated HTTP MCP server that clients can connect to after users sign in and authorize them via OAuth. These clients act as the authorized user within their permissions and access level, which can be read only, read and write, or full access for administrators. The endpoints default to /{cpTrigger}/mcp and /{cpTrigger}/mcp/auth, or /mcp and /mcp/auth when public registration is enabled.

A public HTTP MCP server has also been added, exposing only the capabilities and content approved from Settings → MCP without requiring users to sign in. Its endpoint defaults to /mcp. Both servers are discoverable via /.well-known/ai-catalog. and a Server Card at their respective endpoints, following SEP-2127 standards.

OAuth Integration

The update includes a comprehensive OAuth authorization server with discovery metadata, dynamic client registration, PKCE (Proof Key for Code Exchange), and refresh token rotation, which both MCP servers and the GraphQL API utilize. Dynamic OAuth client registration is limited to 10 clients per IP address per hour by default, controlled by new registrationRateLimit and registrationRateLimitDuration settings.

Administrators can now manage OAuth settings through new config files (config/mcp.php and config/oauth.php) and a new oauth/generate-keys command for generating keys used to sign OAuth access tokens. The system also includes garbage collection to delete expired and revoked OAuth authorization codes, tokens, and registered clients that were revoked or never authorized.

GraphQL Enhancements

GraphQL API requests can now be authenticated with OAuth access tokens, granting access to the content the authorizing user has permission to access. The API now includes a currentUser query that returns the user who authenticated the request, and schema components can support authenticated requests via an authenticated key in their configuration.

New GraphQL queries have been added for sites, sections, entry types, volumes, user groups, category groups, and tag groups, along with their individual counterparts. Elements now have additional fields in GraphQL when specific schema components are included, such as site fields for elements, section and type fields for entries, volume fields for assets, and group fields for users, categories, and tags.

Multi-Site Improvements

Element edit pages on multi-site installs now feature a Sites pane in their sidebars, replacing the Status pane. This pane lists the sites where the element is saved (that the user can edit), with status toggles and links to the element in each site, and allows authors to add the element to other sites. Users can also switch between sites in element editor slideouts by clicking on site names within the Sites pane.

Assets management has been enhanced with a new Propagation Method setting for volumes. This can be set to Let each asset choose which sites it should be saved to, with new volumes defaulting to this setting. Assets in such volumes now have a Sites pane in their edit pages, allowing them to be deleted for individual sites as long as they exist in another site. Files can also be uploaded to Assets fields by pasting them from the clipboard when the field has focus.