Sylius Admin MCP Server Plugin

Product Description:

The Sylius Admin MCP Server Plugin turns your Sylius admin panel into a full Model Context Protocol (MCP) server, enabling AI assistants such as Claude, Cursor, and other MCP-compatible tools to interact directly with the store's back office. Instead of building custom integrations, teams can connect an AI client to the admin panel and manage products, orders, customers, promotions, shipping, and more through natural language.

The plugin exposes 171 tools across 34 resource groups, covering all major Sylius admin resources. Access is secured through a full OAuth 2.0 Authorization Code flow with PKCE, ensuring that only admin users with the appropriate role can authorize an AI client and interact with store data.

Built with configurability in mind, the plugin allows specific tool groups to be selectively disabled, making it easy to tailor the exposed capabilities to a given store's security and operational requirements.

Key Features:

Admin API as an MCP Server Exposes the Sylius Admin API through a standardized Model Context Protocol interface.

171 AI Tools Across 34 Resource Groups Covers all major Sylius admin resources, including products, orders, customers, promotions, and shipping.

OAuth 2.0 Authorization Code Flow with PKCE Full OAuth 2.0 implementation protects against authorization code interception.

Role-Based Access Control Only admin users with the ROLE_API_ACCESS role can authorize AI clients.

Ready-Made Client Integrations Works out of the box with Claude Desktop, Claude.ai, Claude Code, and Cursor.

Configurable Tool Groups Individual tool groups can be selectively disabled to match specific security or operational needs.

Additional Technical Information

The plugin adds a dedicated MCP server layer inside the Sylius application, exposing selected admin panel operations through the Model Context Protocol.

Requirements include PHP 8.2+, Sylius 2.1 or 2.2, Symfony 7.4, MySQL or PostgreSQL, and Node.js 20+ with Yarn for frontend assets.

Authorization is handled through OAuth 2.0 with PKCE: access tokens expire after 1 hour, and refresh tokens remain valid for 30 days. Every request to the /_mcp endpoint requires a valid OAuth 2.0 Bearer token.

Installation is handled via Composer (composer require sylius/admin-mcp-server-plugin), with bundles and routes registered automatically through Symfony Flex. Setup also requires generating a dedicated RSA keypair for OAuth token signing and running database migrations to create the tables used for OAuth clients, authorization codes, and refresh tokens.

Documentation covers the full authentication flow, the complete list of available MCP tools, configuration options for disabling tool groups, and manual installation steps for projects not using Symfony Flex.