{"name":"io.github.shakaran/symfony-agent-mcp","slug":"shakaran-symfony-agent-mcp","title":"Symfony Agent MCP","description":"Read-only Symfony introspection: routes, services, entities, Doctrine, security, Twig and more.","url":"https://mcp.market/server/shakaran-symfony-agent-mcp","rating":null,"grade":"C","score":68,"certified":false,"status":"active","category":"ai","tags":["ai","security"],"presence":{"score":27,"stars":0,"forks":0,"downloads_week":55,"last_push_at":"2026-10-21T13:52:42.000Z","license":"MIT"},"uptime":null,"claimed":false,"transport":"npm","callable_via_gateway":false,"default_price_micros":0,"repository":"https://github.com/shakaran/symfony-agent-mcp","website":"https://github.com/shakaran/symfony-agent-mcp","version":"1.0.2","remotes":[],"packages":[{"registryType":"npm","identifier":"@shakaran/symfony-agent-mcp","version":"1.0.2","transport":{"type":"stdio"},"environmentVariables":[{"description":"Progressive tool discovery. Left on, tools/list advertises five discovery meta-tools and the rest become callable once a category is activated (~828 tokens on connect). Set to false to advertise all 1,677 up front (~154,000).","format":"boolean","default":"true","name":"SYMFONY_MCP_DYNAMIC_TOOLS"},{"description":"Token ceiling for the schemas a session may have active at once.","format":"number","default":"40000","name":"SYMFONY_MCP_TOKEN_BUDGET"},{"description":"Colon-separated allowlist of directories the server may read. Any app_path outside them is refused.","format":"filepath","name":"SYMFONY_MCP_ALLOWED_PATHS"},{"description":"Enables session-token authentication. Unset, authentication is off.","format":"string","isSecret":true,"name":"SYMFONY_MCP_SESSION_SECRET"},{"description":"Client-side token, required only once SYMFONY_MCP_SESSION_SECRET is set.","format":"string","isSecret":true,"name":"SYMFONY_MCP_SESSION_TOKEN"},{"description":"Encrypted audit log of every tool call.","format":"boolean","default":"true","name":"SYMFONY_MCP_AUDIT"},{"description":"Scan every result for credentials before returning it. Turning this off is reported as CRITICAL by the startup audit.","format":"boolean","default":"true","name":"SYMFONY_MCP_DLP"}]}],"tools":[{"name":"get_abstract_service_stats","description":"Abstract service statistics: abstract count, child count, max children per abstract, issue count","write_action":false,"price_micros":0,"input_schema":null},{"name":"get_accessibility_stats","description":"Show accessibility statistics: templates scanned, affected count, WCAG failure/warning/info counts, top failing rules","write_action":false,"price_micros":0,"input_schema":null},{"name":"get_algolia_integration_stats","description":"Statistics for Algolia integration: index/search/facet/synonym pattern counts and total issues","write_action":false,"price_micros":0,"input_schema":null},{"name":"get_alpine_js_integration_stats","description":"Statistics for Alpine.js integration: template/CSP count, issue count","write_action":false,"price_micros":0,"input_schema":null},{"name":"get_ansible_playbook_config_stats","description":"Statistics for Ansible playbook configuration: injection/privilege/secret/nolog/facts/errors issue counts.","write_action":false,"price_micros":0,"input_schema":null},{"name":"get_apache_config_stats","description":"Statistics for Apache configuration: counts by type (rewrite/security-header/disclosure/directory/performance) and total issues","write_action":false,"price_micros":0,"input_schema":null},{"name":"get_api_contract_testing_stats","description":"Statistics for API contract testing: counts by type, issue count","write_action":false,"price_micros":0,"input_schema":null},{"name":"get_api_cursor_pagination_stats","description":"Statistics for API pagination: offset/cursor count, issue count","write_action":false,"price_micros":0,"input_schema":null},{"name":"get_api_graphql_security_stats","description":"Statistics for GraphQL security: counts by type, issue count","write_action":false,"price_micros":0,"input_schema":null},{"name":"get_api_hateoas_stats","description":"Statistics for API HATEOAS: resource/collection count, issue count","write_action":false,"price_micros":0,"input_schema":null},{"name":"get_api_idempotency_stats","description":"Statistics for idempotency: key/storage/replay count, issue count","write_action":false,"price_micros":0,"input_schema":null},{"name":"get_api_json_ld_context_stats","description":"Statistics for JSON-LD: context/type/property/vocab count, issue count","write_action":false,"price_micros":0,"input_schema":null},{"name":"get_api_jsonapi_format_stats","description":"Statistics for JSON:API format: counts by type, issue count","write_action":false,"price_micros":0,"input_schema":null},{"name":"get_api_key_rotation_stats","description":"Statistics for API key rotation: hardcoded/rotation count, issue count","write_action":false,"price_micros":0,"input_schema":null},{"name":"get_api_openapi_context_stats","description":"Show API Platform OpenAPI context statistics: class count, total properties, description coverage, deprecated count, example coverage, issues count","write_action":false,"price_micros":0,"input_schema":null},{"name":"get_api_openapi_security_schemes_stats","description":"Statistics for OpenAPI security schemes: bearer/apiKey/oauth2/openIdConnect/basic count, issue count","write_action":false,"price_micros":0,"input_schema":null},{"name":"get_api_operation_stats","description":"Show API Platform operation statistics: resource count, total operations, write operation count, secured vs open write ops, normalization group coverage, issue count","write_action":false,"price_micros":0,"input_schema":null},{"name":"get_api_pagination_stats","description":"Show API Platform pagination statistics: custom resource pagination count, disabled/cursor/client-control/max-set counts, custom paginator count, issue count","write_action":false,"price_micros":0,"input_schema":null},{"name":"get_api_platform_custom_normalizer_stats","description":"Custom normalizer statistics: normalizer/denormalizer/both counts, cacheable support coverage, issue count","write_action":false,"price_micros":0,"input_schema":null},{"name":"get_api_platform_dto_output_stats","description":"API Platform DTO output statistics: resource count, explicit output class count, output:false count, transformer/processor coverage, issue count","write_action":false,"price_micros":0,"input_schema":null},{"name":"get_api_platform_error_handling_stats","description":"Show API Platform error handling statistics: error format count, exception mapping count, 5xx mappings, custom normalizer presence, issues count","write_action":false,"price_micros":0,"input_schema":null},{"name":"get_api_platform_filter_stats","description":"Show API Platform filter statistics: total declarations, entities with filters, custom filter count, issue count, filter type breakdown","write_action":false,"price_micros":0,"input_schema":null},{"name":"get_api_platform_iri_converter_stats","description":"API Platform IRI converter statistics: custom converter count, uriTemplate count, issue count","write_action":false,"price_micros":0,"input_schema":null},{"name":"get_api_platform_query_extension_stats","description":"API Platform query extension statistics: collection/item/both counts, resourceClass check coverage, issue count","write_action":false,"price_micros":0,"input_schema":null},{"name":"get_api_platform_resource_metadata_stats","description":"Show API Platform resource metadata statistics: resource count, shortName/description/types adoption, issue count","write_action":false,"price_micros":0,"input_schema":null},{"name":"get_api_platform_security_expression_stats","description":"API Platform security expression statistics: resource count, expression count, security/securityPostDenormalize breakdown, issue count","write_action":false,"price_micros":0,"input_schema":null},{"name":"get_api_platform_security_stats","description":"Show API Platform security statistics: resource count, total/secured/unsecured operation counts, normalization context count, issue count","write_action":false,"price_micros":0,"input_schema":null},{"name":"get_api_platform_serialization_context_stats","description":"Show API Platform serialization context statistics: resource count, normalization/denormalization context coverage, issue count","write_action":false,"price_micros":0,"input_schema":null},{"name":"get_api_platform_state_processor_stats","description":"Show API Platform state processor statistics: processor count, persist/remove/transaction counts, issue count","write_action":false,"price_micros":0,"input_schema":null},{"name":"get_api_platform_stats","description":"Show API Platform statistics: resource count, operation breakdown, filter count, and all serialization groups in use","write_action":false,"price_micros":0,"input_schema":null},{"name":"get_api_platform_subresource_stats","description":"API Platform subresource statistics: resource count, endpoint count, provider coverage, issue count","write_action":false,"price_micros":0,"input_schema":null},{"name":"get_api_platform_validation_context_stats","description":"Show API Platform validation context statistics: resource count, operation count, with-groups count, issue count","write_action":false,"price_micros":0,"input_schema":null},{"name":"get_api_problem_details_stats","description":"Statistics for Problem Details: response/exception/listener count, issue count","write_action":false,"price_micros":0,"input_schema":null},{"name":"get_api_rate_limit_stats","description":"Show API rate limit statistics: controller-level limits, nginx zone count, Caddy directive count, total mechanisms detected","write_action":false,"price_micros":0,"input_schema":null},{"name":"get_api_resource_details","description":"Get full details for an API Platform resource: all operations with paths, per-operation serialization groups, filters, and pagination config","write_action":false,"price_micros":0,"input_schema":null},{"name":"get_api_response_compression_stats","description":"Statistics for response compression: counts by type, issue count","write_action":false,"price_micros":0,"input_schema":null},{"name":"get_api_state_stats","description":"Show API state statistics: provider count, processor count, decorator count, deprecated AP v2 count, issue count","write_action":false,"price_micros":0,"input_schema":null},{"name":"get_api_version_stats","description":"Show API versioning statistics: versions detected, versioned endpoint count, versioned serializer group count, FOSRest flag","write_action":false,"price_micros":0,"input_schema":null},{"name":"get_asset_stats","description":"Show asset pipeline statistics: pipeline type, entry point count, package count, Stimulus controller breakdown","write_action":false,"price_micros":0,"input_schema":null},{"name":"get_aws_cloudfront_config_stats","description":"Statistics for AWS CloudFront configuration: env/PHP/config entry counts and issue breakdown.","write_action":false,"price_micros":0,"input_schema":null},{"name":"get_aws_cognito_integration_stats","description":"Statistics for AWS Cognito integration: env/PHP/config entry counts and issue breakdown.","write_action":false,"price_micros":0,"input_schema":null},{"name":"get_aws_ecs_config_stats","description":"Statistics for AWS ECS task definitions: file/family/container counts, secret/health-check/privileged issues, and total issue count","write_action":false,"price_micros":0,"input_schema":null},{"name":"get_aws_lambda_bref_stats","description":"Statistics for AWS Lambda / Bref: counts by type (runtime/cold-start/filesystem/timeout/messenger) and total issues","write_action":false,"price_micros":0,"input_schema":null},{"name":"get_aws_parameter_store_stats","description":"Statistics for AWS SSM Parameter Store: decryption/hardcoded/kms/naming/batch/credentials issue counts.","write_action":false,"price_micros":0,"input_schema":null},{"name":"get_aws_s3_integration_stats","description":"Statistics for AWS S3 integration: upload/download/presigned/acl pattern counts and total issues","write_action":false,"price_micros":0,"input_schema":null},{"name":"get_aws_secrets_manager_stats","description":"Statistics for AWS Secrets Manager: rotation/version/cache/hardcoded/parse/credentials issue counts.","write_action":false,"price_micros":0,"input_schema":null},{"name":"get_aws_ses_integration_stats","description":"Statistics for AWS SES integration: counts by type (dsn/env/php/config) and total issue count","write_action":false,"price_micros":0,"input_schema":null},{"name":"get_azure_blob_storage_stats","description":"Statistics for Azure Blob Storage: package/sas/acl/connection-string/retry/content-type issue counts.","write_action":false,"price_micros":0,"input_schema":null},{"name":"get_azure_pipelines_config_stats","description":"Statistics for Azure Pipelines configuration: file/stage/job counts, trigger/secret/timeout issues, and total issue count","write_action":false,"price_micros":0,"input_schema":null},{"name":"get_mercure_push_stats","description":"Show Mercure push statistics: hub configured, resource push count, private/custom topic counts, direct publish count, try/catch count, issue count","write_action":false,"price_micros":0,"input_schema":null},{"name":"list_abstract_services","description":"Show abstract: true and parent: service definitions from services.yaml: child count per abstract, inherited calls/properties, unused abstract warning, missing parent warning","write_action":false,"price_micros":0,"input_schema":null},{"name":"list_accessibility_issues","description":"Static accessibility audit of Twig templates: missing img alt, button without accessible name, input without label, table without caption/scope, aria-hidden on focusable elements, skipped heading levels, multiple h1 — categorized by WCAG severity","write_action":false,"price_micros":0,"input_schema":null},{"name":"list_algolia_integration","description":"Analyze Algolia integration: detect composer packages, env credentials (ALGOLIA_APP_ID/API_KEY/SEARCH_KEY), config/packages/algolia*.yaml, PHP SearchClient/search/saveObject/setSettings usage, flag admin key for search, no attributesForFaceting, hardcoded index names","write_action":false,"price_micros":0,"input_schema":null},{"name":"list_alpine_js_integration","description":"Analyze Alpine.js integration in Symfony templates; warns on x-data with Twig expression (JS injection), x-html XSS risk, $eval with user data, fetch result to innerHTML, password in x-model, CSP with unsafe-eval","write_action":false,"price_micros":0,"input_schema":null},{"name":"list_ansible_playbook_config","description":"Scan *.yml/*.yaml, playbooks/, ansible/ for Ansible playbook security issues: shell/command tasks with hostvars/vars variables missing | quote filter (injection), become: true without become_user (defaults to root), plaintext secrets in vars: block (masked), missing no_log: true on credential tasks, gather_facts: true unnecessarily, ignore_errors: true on critical tasks.","write_action":false,"price_micros":0,"input_schema":null},{"name":"list_apache_config","description":"Analyse Apache .htaccess and virtual-host config files for missing front-controller rewrite rules, missing security headers, server version disclosure, directory listing, and performance settings","write_action":false,"price_micros":0,"input_schema":null},{"name":"list_api_contract_testing","description":"Analyze API contract testing setup; warns on external API calls without Pact, no Pact broker verification in CI pipeline","write_action":false,"price_micros":0,"input_schema":null},{"name":"list_api_cursor_pagination","description":"Analyze API pagination implementation; warns on offset pagination with expensive COUNT, high OFFSET performance degradation, cursor without encoding, one-directional cursor, API Platform without max items per page, page-based instead of cursor for large collections","write_action":false,"price_micros":0,"input_schema":null},{"name":"list_api_graphql_security","description":"Analyze GraphQL security; warns on introspection enabled in prod, missing depth/complexity limits, N+1 resolver queries without DataLoader, mutations without security attributes","write_action":false,"price_micros":0,"input_schema":null},{"name":"list_api_hateoas","description":"Analyze API HATEOAS hypermedia link implementation; warns on API controllers without _links, collection endpoints without pagination links, API Platform resources without self link in serialization groups","write_action":false,"price_micros":0,"input_schema":null},{"name":"list_api_idempotency","description":"Detect API idempotency key patterns; warns on key read but not stored, storage without replay, no TTL, empty key not validated, key on GET requests","write_action":false,"price_micros":0,"input_schema":null},{"name":"list_api_json_ld_context","description":"Detect JSON-LD @context patterns; warns on ApiResource without IRI types, HTTP schema.org IRIs (use HTTPS), missing @vocab, invalid .jsonld context files","write_action":false,"price_micros":0,"input_schema":null},{"name":"list_api_jsonapi_format","description":"Analyze JSON:API format compliance; warns on missing jsonapi format configuration, wrong content-type headers, error responses without JSON:API structure","write_action":false,"price_micros":0,"input_schema":null},{"name":"list_api_key_rotation","description":"Analyze API key rotation and lifecycle management; warns on hardcoded keys in committed .env, non-timing-safe comparison, no key versioning for rotation, API keys without expiry field","write_action":false,"price_micros":0,"input_schema":null},{"name":"list_api_openapi_context","description":"List API Platform OpenAPI context: #[ApiProperty] descriptions, examples, enums, deprecated properties, deprecationReason presence, type consistency checks, normalizationContext warnings","write_action":false,"price_micros":0,"input_schema":null},{"name":"list_api_openapi_security_schemes","description":"Analyze OpenAPI security scheme definitions; warns on ApiKey in query param, OAuth2 implicit flow (deprecated), missing bearerFormat, openIdConnect without discovery URL, schemes defined but not applied","write_action":false,"price_micros":0,"input_schema":null},{"name":"list_api_operations","description":"Show API Platform per-resource operations: Get/GetCollection/Post/Put/Patch/Delete per class, security expression presence, normalizationContext groups, input/output DTO, uriTemplate, Post/Put/Patch/Delete without security warning","write_action":false,"price_micros":0,"input_schema":null},{"name":"list_api_pagination","description":"Show API Platform pagination config per resource: paginationEnabled, paginationItemsPerPage, paginationMaximumItemsPerPage, paginationClientEnabled, paginationClientItemsPerPage, paginationViaCursor, global api_platform.yaml defaults, unlimited-items warning when client control enabled without maximum","write_action":false,"price_micros":0,"input_schema":null},{"name":"list_api_platform_custom_normalizers","description":"Detect custom NormalizerInterface/DenormalizerInterface: supportsNormalization/supportsDenormalization presence, getSupportedTypes cache method, API Platform context check","write_action":false,"price_micros":0,"input_schema":null},{"name":"list_api_platform_dto_output","description":"Detect API Platform output: DTO classes in #[ApiResource], OutputDataTransformerInterface implementations, output: false with normalization_context warning, missing transformer warning","write_action":false,"price_micros":0,"input_schema":null},{"name":"list_api_platform_error_handling","description":"Audit API Platform error handling: error_formats and exception_to_status from api_platform.yaml, custom exception normalizers, ProblemDetailsFactory, HTML format warning, 5xx mapping detection","write_action":false,"price_micros":0,"input_schema":null},{"name":"list_api_platform_filters","description":"Show API Platform filters: #[ApiFilter] declarations per entity (Search/Order/Date/Range/Boolean/Exists/Numeric), strategy, properties, custom AbstractFilter subclasses, SearchFilter without strategy warning, OrderFilter on text field warning","write_action":false,"price_micros":0,"input_schema":null},{"name":"list_api_platform_iri_converter","description":"Detect API Platform IriConverterInterface implementations: getIriFromResource/getResourceFromIri presence, uriTemplate usage, missing method warning","write_action":false,"price_micros":0,"input_schema":null},{"name":"list_api_platform_query_extensions","description":"Detect API Platform QueryCollectionExtensionInterface and QueryItemExtensionInterface: applyToCollection/applyToItem presence, resourceClass check, global extension warning","write_action":false,"price_micros":0,"input_schema":null},{"name":"list_api_platform_resource_metadata","description":"Show API Platform resource metadata: shortName, description, iri, JSON-LD types, uriTemplate, missing description warning, non-prefixed type IRI warning","write_action":false,"price_micros":0,"input_schema":null},{"name":"list_api_platform_security","description":"Show API Platform security audit: operations without security/securityPostDenormalize, unsecured write operations (POST/PUT/PATCH/DELETE), public DELETE warning, missing normalizationContext (data leak risk), sensitive field name in normalization groups","write_action":false,"price_micros":0,"input_schema":null},{"name":"list_api_platform_security_expressions","description":"Analyze per-operation security:/securityPostDenormalize: expressions in #[ApiResource]: is_granted/user/object/previous_object usage, PUBLIC_ACCESS warning, write-without-user-check warning","write_action":false,"price_micros":0,"input_schema":null},{"name":"list_api_platform_serialization_contexts","description":"Show API Platform normalizationContext/denormalizationContext: serialization groups per operation, missing groups warning (all-properties serialized/writable)","write_action":false,"price_micros":0,"input_schema":null},{"name":"list_api_platform_state_processors","description":"Show API Platform StateProcessorInterface implementations: persist/flush/remove detection, transaction management, missing process() warning, persist without flush warning","write_action":false,"price_micros":0,"input_schema":null},{"name":"list_api_platform_subresources","description":"Detect API Platform subresources via multi-variable uriTemplate patterns and deprecated @ApiSubresource, state provider coverage, legacy annotation migration warning","write_action":false,"price_micros":0,"input_schema":null},{"name":"list_api_platform_validation_contexts","description":"Show API Platform per-operation validationContext groups: Post/Put/Patch operations, validation group per operation, missing groups on write operations warning","write_action":false,"price_micros":0,"input_schema":null},{"name":"list_api_problem_details","description":"Detect RFC 7807 Problem Details usage; warns on missing \"type\" field, wrong Content-Type, contradictory status codes, stack trace in response","write_action":false,"price_micros":0,"input_schema":null},{"name":"list_api_rate_limits","description":"Show API-layer rate limiting: nginx limit_req_zone/limit_req directives, Caddy rate_limit, controller-level RateLimiterFactory injection and rate-limit attributes, controllers without any limit coverage","write_action":false,"price_micros":0,"input_schema":null},{"name":"list_api_resources","description":"List all API Platform resources (#[ApiResource]) with their operations, serialization groups, filters, and security rules","write_action":false,"price_micros":0,"input_schema":null},{"name":"list_api_response_compression","description":"Analyze response compression configuration; warns on missing nginx gzip, gzip without gzip_min_length, gzip on binary images, missing Vary header","write_action":false,"price_micros":0,"input_schema":null},{"name":"list_api_state_providers","description":"Show API Platform 3 state providers and processors: ProviderInterface/ProcessorInterface implementations, #[AsDecorator] detection, resource binding, pagination/flush/mailer flags, deprecated AP v2 DataProvider/DataPersister style detection","write_action":false,"price_micros":0,"input_schema":null},{"name":"list_api_versions","description":"Show API versioning: URL-prefixed routes (/v1/, /v2/), versioned serializer groups (v1:read), FOSRestBundle versioning, gap analysis between versions","write_action":false,"price_micros":0,"input_schema":null},{"name":"list_asset_pipeline","description":"Show asset pipeline type (Asset Mapper or Webpack Encore), entry points, imported packages/importmap entries, and Stimulus controllers","write_action":false,"price_micros":0,"input_schema":null},{"name":"list_aws_cloudfront_config","description":"Scan for AWS CloudFront distribution configuration: composer.json aws/aws-sdk-php, .env* CLOUDFRONT_DISTRIBUTION_ID/KEY_PAIR_ID/PRIVATE_KEY_PATH (masked), PHP CloudFrontClient/createInvalidation/getDistribution/sign/CloudFrontCookieSigner/CloudFrontUrlSigner usage, config/packages/ and config/aws/ YAML/JSON. Flags wildcard invalidation (/*), signed URL without expiry, hardcoded private key path.","write_action":false,"price_micros":0,"input_schema":null},{"name":"list_aws_cognito_integration","description":"Scan for AWS Cognito user pool integration: composer.json aws/aws-sdk-php, .env* Cognito vars (masked secrets), PHP CognitoIdentityProviderClient/initiateAuth/adminInitiateAuth/respondToAuthChallenge/signUp/adminGetUser, JWT signing key verification. Flags USER_PASSWORD_AUTH flow, missing JWT verification, hardcoded client secret, adminConfirmSignUp bypassing email verification, missing MFA handli","write_action":false,"price_micros":0,"input_schema":null},{"name":"list_aws_ecs_config","description":"Analyse ECS task definition JSON files (*task-definition*.json, ecs-task*.json, taskdef.json) for hardcoded secrets in environment[], missing healthCheck, privileged:true containers, and missing cpu/memory","write_action":false,"price_micros":0,"input_schema":null},{"name":"list_aws_lambda_bref","description":"Analyse AWS Lambda / Bref configuration: runtime layers, cold-start memory, filesystem write safety, timeout limits, missing APP_ENV=prod, and SQS Messenger transport","write_action":false,"price_micros":0,"input_schema":null},{"name":"list_aws_parameter_store","description":"Scan src/**/*.php, config/**/*.yaml, .env* for AWS SSM Parameter Store patterns: GetParameter with WithDecryption: false on SecureString, hardcoded parameter name (not env var), missing custom KMS key alias (uses default aws/ssm), parameter path not following /app/env/param convention, multiple individual GetParameter calls instead of batch GetParameters, AWS credentials in source (masked).","write_action":false,"price_micros":0,"input_schema":null},{"name":"list_aws_s3_integration","description":"Analyze AWS S3 integration: detect composer SDK (aws-sdk-php, flysystem-aws-s3-v3), env credentials (AWS_ACCESS_KEY_ID/SECRET/S3_BUCKET/REGION), PHP S3Client/putObject/getObject/presigned usage, flag public-read ACL, hardcoded buckets, no server-side encryption, presigned URL without expiry","write_action":false,"price_micros":0,"input_schema":null},{"name":"list_aws_secrets_manager","description":"Scan src/**/*.php, config/**/*.yaml, .env* for AWS Secrets Manager patterns: RotationEnabled: false, GetSecretValue without VersionStage AWSCURRENT, missing SecretCache/SecretsManagerCache, hardcoded secret ARN or name, JSON parse without error handling, AWS credentials in source (masked).","write_action":false,"price_micros":0,"input_schema":null},{"name":"list_aws_ses_integration","description":"Analyze AWS SES integration: scan .env/.env.local/.env.prod/mailer.yaml for MAILER_DSN with ses+smtp/api/https, AWS_SES_* env vars (masked), PHP SesClient/SesV2Client/SimpleEmailServiceV2Client usage, hardcoded AWS credentials in PHP. Flags: missing bounce/complaint handler, ses+smtp vs ses+api, APP_ENV=prod sandbox risk","write_action":false,"price_micros":0,"input_schema":null},{"name":"list_azure_blob_storage","description":"Scan src/**/*.php, composer.json, config/**/*.yaml, .env* for Azure Blob Storage patterns: azure/storage-blob or microsoft/azure-storage-blob in composer.json, SAS token without expiry, container access set to container/blob (public), connection string with AccountKey (masked), missing retry policy (RetryMiddlewareFactory), blob upload without Content-Type header.","write_action":false,"price_micros":0,"input_schema":null},{"name":"list_azure_pipelines_config","description":"Analyse Azure Pipelines YAML (azure-pipelines.yml, azure-pipelines.yaml, .azure/pipelines.yml) for missing trigger branch filters, secrets in variables, no timeoutInMinutes, and job configuration","write_action":false,"price_micros":0,"input_schema":null},{"name":"list_mercure_push_config","description":"Show API Platform Mercure push integration: mercure:true/#[ApiResource(mercure:...)] per resource, private topics, custom topic patterns, hub URL configuration, direct HubInterface::publish() usages, try/catch around publish, static topic warning, hub-not-configured warning","write_action":false,"price_micros":0,"input_schema":null},{"name":"list_stimulus_controllers","description":"List all Stimulus controllers: local ones in assets/controllers/ and package-provided ones from controllers.json with lazy/enabled status","write_action":false,"price_micros":0,"input_schema":null}],"scan":{"score":68,"grade":"C","scanned_at":"2026-11-01T13:27:55.457Z","report":{"scannerVersion":"0.1.10","scannedAt":"2026-11-01T13:27:55.434Z","components":{"code":{"score":15,"max":25,"notes":["1500 source files scanned"]},"reliability":{"score":-1,"max":20,"notes":["no gateway calls yet and no remote to probe"]},"poisoning":{"score":-1,"max":15,"notes":["tools not inspected (local package is not executed); not counted"]},"auth":{"score":6,"max":15,"notes":["static API keys via environment variables"]},"maintenance":{"score":15,"max":15,"notes":["last push 11 days ago"]},"identity":{"score":8,"max":10,"notes":["registry namespace matches repository owner","GitHub account older than a year"]}},"findings":[{"id":"obf.hex-density","severity":"medium","component":"code","title":"Heavily hex-escaped string (obfuscation)","evidence":"dist/fuzz/generators.js: …-fixtures.js'; const DEFAULT_CHARSET = '\\x00\\x01\\x02\\x03\\x07\\x08\\x0b\\x0c\\x0e\\x0f\\x10\\x1b\\x7f' + // control chars ' \\t\\n\\r\\\\\"\\'/`…"},{"id":"exec.eval","severity":"medium","component":"code","title":"eval / new Function used","evidence":"dist/tools/alpine-js-integration.js: … issues.push(`Alpine.js $eval() or Alpine.evaluate() in \"${relFile}\" —…"}],"inputs":{"packages":[{"registryType":"npm","identifier":"@shakaran/symfony-agent-mcp","version":"1.0.2","found":true,"license":"MIT","hasInstallScripts":false,"dependencyCount":3,"publishedAt":"2026-08-23T02:49:49.044Z","repositoryUrl":"git+https://github.com/shakaran/symfony-agent-mcp.git","weeklyDownloads":55}],"repo":{"found":true,"owner":"shakaran","repo":"symfony-agent-mcp","archived":false,"pushedAt":"2026-10-21T13:52:42Z","stars":0,"forks":0,"openIssues":5,"ownerType":"User","ownerAvatarUrl":"https://avatars.githubusercontent.com/u/14254?v=4","ownerCreatedAt":"2008-06-19T00:53:06Z","license":"MIT"},"icon":{"url":"https://avatars.githubusercontent.com/u/14254?v=4&s=128","source":"registry"},"presence":{"stars":0,"forks":0,"downloadsWeek":55,"license":"MIT","lastPushAt":"2026-10-21T13:52:42.000Z","score":27}}}},"grade_history":[],"reviews":[]}