Symfony Agent MCP server

Read from the package source without running it. The installed server may list more.

• get_abstract_service_stats

  Abstract service statistics: abstract count, child count, max children per abstract, issue count

• get_accessibility_stats

  Show accessibility statistics: templates scanned, affected count, WCAG failure/warning/info counts, top failing rules

• get_algolia_integration_stats

  Statistics for Algolia integration: index/search/facet/synonym pattern counts and total issues

• get_alpine_js_integration_stats

  Statistics for Alpine.js integration: template/CSP count, issue count

• get_ansible_playbook_config_stats

  Statistics for Ansible playbook configuration: injection/privilege/secret/nolog/facts/errors issue counts.

• get_apache_config_stats

  Statistics for Apache configuration: counts by type (rewrite/security-header/disclosure/directory/performance) and total issues

• get_api_contract_testing_stats

  Statistics for API contract testing: counts by type, issue count

• get_api_cursor_pagination_stats

  Statistics for API pagination: offset/cursor count, issue count

• get_api_graphql_security_stats

  Statistics for GraphQL security: counts by type, issue count

• get_api_hateoas_stats

  Statistics for API HATEOAS: resource/collection count, issue count

• get_api_idempotency_stats

  Statistics for idempotency: key/storage/replay count, issue count

• get_api_json_ld_context_stats

  Statistics for JSON-LD: context/type/property/vocab count, issue count

• get_api_jsonapi_format_stats

  Statistics for JSON:API format: counts by type, issue count

• get_api_key_rotation_stats

  Statistics for API key rotation: hardcoded/rotation count, issue count

• get_api_openapi_context_stats

  Show API Platform OpenAPI context statistics: class count, total properties, description coverage, deprecated count, example coverage, issues count

• get_api_openapi_security_schemes_stats

  Statistics for OpenAPI security schemes: bearer/apiKey/oauth2/openIdConnect/basic count, issue count

• get_api_operation_stats

  Show API Platform operation statistics: resource count, total operations, write operation count, secured vs open write ops, normalization group coverage, issue count

• get_api_pagination_stats

  Show API Platform pagination statistics: custom resource pagination count, disabled/cursor/client-control/max-set counts, custom paginator count, issue count

• get_api_platform_custom_normalizer_stats

  Custom normalizer statistics: normalizer/denormalizer/both counts, cacheable support coverage, issue count

• get_api_platform_dto_output_stats

  API Platform DTO output statistics: resource count, explicit output class count, output:false count, transformer/processor coverage, issue count

• get_api_platform_error_handling_stats

  Show API Platform error handling statistics: error format count, exception mapping count, 5xx mappings, custom normalizer presence, issues count

• get_api_platform_filter_stats

  Show API Platform filter statistics: total declarations, entities with filters, custom filter count, issue count, filter type breakdown

• get_api_platform_iri_converter_stats

  API Platform IRI converter statistics: custom converter count, uriTemplate count, issue count

• get_api_platform_query_extension_stats

  API Platform query extension statistics: collection/item/both counts, resourceClass check coverage, issue count

• get_api_platform_resource_metadata_stats

  Show API Platform resource metadata statistics: resource count, shortName/description/types adoption, issue count

• get_api_platform_security_expression_stats

  API Platform security expression statistics: resource count, expression count, security/securityPostDenormalize breakdown, issue count

• get_api_platform_security_stats

  Show API Platform security statistics: resource count, total/secured/unsecured operation counts, normalization context count, issue count

• get_api_platform_serialization_context_stats

  Show API Platform serialization context statistics: resource count, normalization/denormalization context coverage, issue count

• get_api_platform_state_processor_stats

  Show API Platform state processor statistics: processor count, persist/remove/transaction counts, issue count

• get_api_platform_stats

  Show API Platform statistics: resource count, operation breakdown, filter count, and all serialization groups in use

• get_api_platform_subresource_stats

  API Platform subresource statistics: resource count, endpoint count, provider coverage, issue count

• get_api_platform_validation_context_stats

  Show API Platform validation context statistics: resource count, operation count, with-groups count, issue count

• get_api_problem_details_stats

  Statistics for Problem Details: response/exception/listener count, issue count

• get_api_rate_limit_stats

  Show API rate limit statistics: controller-level limits, nginx zone count, Caddy directive count, total mechanisms detected

• get_api_resource_details

  Get full details for an API Platform resource: all operations with paths, per-operation serialization groups, filters, and pagination config

• get_api_response_compression_stats

  Statistics for response compression: counts by type, issue count

• get_api_state_stats

  Show API state statistics: provider count, processor count, decorator count, deprecated AP v2 count, issue count

• get_api_version_stats

  Show API versioning statistics: versions detected, versioned endpoint count, versioned serializer group count, FOSRest flag

• get_asset_stats

  Show asset pipeline statistics: pipeline type, entry point count, package count, Stimulus controller breakdown

• get_aws_cloudfront_config_stats

  Statistics for AWS CloudFront configuration: env/PHP/config entry counts and issue breakdown.

• get_aws_cognito_integration_stats

  Statistics for AWS Cognito integration: env/PHP/config entry counts and issue breakdown.

• get_aws_ecs_config_stats

  Statistics for AWS ECS task definitions: file/family/container counts, secret/health-check/privileged issues, and total issue count

• get_aws_lambda_bref_stats

  Statistics for AWS Lambda / Bref: counts by type (runtime/cold-start/filesystem/timeout/messenger) and total issues

• get_aws_parameter_store_stats

  Statistics for AWS SSM Parameter Store: decryption/hardcoded/kms/naming/batch/credentials issue counts.

• get_aws_s3_integration_stats

  Statistics for AWS S3 integration: upload/download/presigned/acl pattern counts and total issues

• get_aws_secrets_manager_stats

  Statistics for AWS Secrets Manager: rotation/version/cache/hardcoded/parse/credentials issue counts.

• get_aws_ses_integration_stats

  Statistics for AWS SES integration: counts by type (dsn/env/php/config) and total issue count

• get_azure_blob_storage_stats

  Statistics for Azure Blob Storage: package/sas/acl/connection-string/retry/content-type issue counts.

• get_azure_pipelines_config_stats

  Statistics for Azure Pipelines configuration: file/stage/job counts, trigger/secret/timeout issues, and total issue count

• get_mercure_push_stats

  Show Mercure push statistics: hub configured, resource push count, private/custom topic counts, direct publish count, try/catch count, issue count

• list_abstract_services

  Show abstract: true and parent: service definitions from services.yaml: child count per abstract, inherited calls/properties, unused abstract warning, missing parent warning

• list_accessibility_issues

  Static accessibility audit of Twig templates: missing img alt, button without accessible name, input without label, table without caption/scope, aria-hidden on focusable elements, skipped heading levels, multiple h1 — categorized by WCAG severity

• list_algolia_integration

  Analyze Algolia integration: detect composer packages, env credentials (ALGOLIA_APP_ID/API_KEY/SEARCH_KEY), config/packages/algolia*.yaml, PHP SearchClient/search/saveObject/setSettings usage, flag admin key for search, no attributesForFaceting, hardcoded index names

• list_alpine_js_integration

  Analyze Alpine.js integration in Symfony templates; warns on x-data with Twig expression (JS injection), x-html XSS risk, $eval with user data, fetch result to innerHTML, password in x-model, CSP with unsafe-eval

• list_ansible_playbook_config

  Scan *.yml/*.yaml, playbooks/, ansible/ for Ansible playbook security issues: shell/command tasks with hostvars/vars variables missing | quote filter (injection), become: true without become_user (defaults to root), plaintext secrets in vars: block (masked), missing no_log: true on credential tasks, gather_facts: true unnecessarily, ignore_errors: true on critical tasks.

• list_apache_config

  Analyse Apache .htaccess and virtual-host config files for missing front-controller rewrite rules, missing security headers, server version disclosure, directory listing, and performance settings

• list_api_contract_testing

  Analyze API contract testing setup; warns on external API calls without Pact, no Pact broker verification in CI pipeline

• list_api_cursor_pagination

  Analyze API pagination implementation; warns on offset pagination with expensive COUNT, high OFFSET performance degradation, cursor without encoding, one-directional cursor, API Platform without max items per page, page-based instead of cursor for large collections

• list_api_graphql_security

  Analyze GraphQL security; warns on introspection enabled in prod, missing depth/complexity limits, N+1 resolver queries without DataLoader, mutations without security attributes

• list_api_hateoas

  Analyze API HATEOAS hypermedia link implementation; warns on API controllers without _links, collection endpoints without pagination links, API Platform resources without self link in serialization groups

• list_api_idempotency

  Detect API idempotency key patterns; warns on key read but not stored, storage without replay, no TTL, empty key not validated, key on GET requests

• list_api_json_ld_context

  Detect JSON-LD @context patterns; warns on ApiResource without IRI types, HTTP schema.org IRIs (use HTTPS), missing @vocab, invalid .jsonld context files

• list_api_jsonapi_format

  Analyze JSON:API format compliance; warns on missing jsonapi format configuration, wrong content-type headers, error responses without JSON:API structure

• list_api_key_rotation

  Analyze API key rotation and lifecycle management; warns on hardcoded keys in committed .env, non-timing-safe comparison, no key versioning for rotation, API keys without expiry field

• list_api_openapi_context

  List API Platform OpenAPI context: #[ApiProperty] descriptions, examples, enums, deprecated properties, deprecationReason presence, type consistency checks, normalizationContext warnings

• list_api_openapi_security_schemes

  Analyze OpenAPI security scheme definitions; warns on ApiKey in query param, OAuth2 implicit flow (deprecated), missing bearerFormat, openIdConnect without discovery URL, schemes defined but not applied

• list_api_operations

  Show API Platform per-resource operations: Get/GetCollection/Post/Put/Patch/Delete per class, security expression presence, normalizationContext groups, input/output DTO, uriTemplate, Post/Put/Patch/Delete without security warning

• list_api_pagination

  Show API Platform pagination config per resource: paginationEnabled, paginationItemsPerPage, paginationMaximumItemsPerPage, paginationClientEnabled, paginationClientItemsPerPage, paginationViaCursor, global api_platform.yaml defaults, unlimited-items warning when client control enabled without maximum

• list_api_platform_custom_normalizers

  Detect custom NormalizerInterface/DenormalizerInterface: supportsNormalization/supportsDenormalization presence, getSupportedTypes cache method, API Platform context check

• list_api_platform_dto_output

  Detect API Platform output: DTO classes in #[ApiResource], OutputDataTransformerInterface implementations, output: false with normalization_context warning, missing transformer warning

• list_api_platform_error_handling

  Audit API Platform error handling: error_formats and exception_to_status from api_platform.yaml, custom exception normalizers, ProblemDetailsFactory, HTML format warning, 5xx mapping detection

• list_api_platform_filters

  Show API Platform filters: #[ApiFilter] declarations per entity (Search/Order/Date/Range/Boolean/Exists/Numeric), strategy, properties, custom AbstractFilter subclasses, SearchFilter without strategy warning, OrderFilter on text field warning

• list_api_platform_iri_converter

  Detect API Platform IriConverterInterface implementations: getIriFromResource/getResourceFromIri presence, uriTemplate usage, missing method warning

• list_api_platform_query_extensions

  Detect API Platform QueryCollectionExtensionInterface and QueryItemExtensionInterface: applyToCollection/applyToItem presence, resourceClass check, global extension warning

• list_api_platform_resource_metadata

  Show API Platform resource metadata: shortName, description, iri, JSON-LD types, uriTemplate, missing description warning, non-prefixed type IRI warning

• list_api_platform_security

  Show API Platform security audit: operations without security/securityPostDenormalize, unsecured write operations (POST/PUT/PATCH/DELETE), public DELETE warning, missing normalizationContext (data leak risk), sensitive field name in normalization groups

• list_api_platform_security_expressions

  Analyze per-operation security:/securityPostDenormalize: expressions in #[ApiResource]: is_granted/user/object/previous_object usage, PUBLIC_ACCESS warning, write-without-user-check warning

• list_api_platform_serialization_contexts

  Show API Platform normalizationContext/denormalizationContext: serialization groups per operation, missing groups warning (all-properties serialized/writable)

• list_api_platform_state_processors

  Show API Platform StateProcessorInterface implementations: persist/flush/remove detection, transaction management, missing process() warning, persist without flush warning

• list_api_platform_subresources

  Detect API Platform subresources via multi-variable uriTemplate patterns and deprecated @ApiSubresource, state provider coverage, legacy annotation migration warning

• list_api_platform_validation_contexts

  Show API Platform per-operation validationContext groups: Post/Put/Patch operations, validation group per operation, missing groups on write operations warning

• list_api_problem_details

  Detect RFC 7807 Problem Details usage; warns on missing "type" field, wrong Content-Type, contradictory status codes, stack trace in response

• list_api_rate_limits

  Show API-layer rate limiting: nginx limit_req_zone/limit_req directives, Caddy rate_limit, controller-level RateLimiterFactory injection and rate-limit attributes, controllers without any limit coverage

• list_api_resources

  List all API Platform resources (#[ApiResource]) with their operations, serialization groups, filters, and security rules

• list_api_response_compression

  Analyze response compression configuration; warns on missing nginx gzip, gzip without gzip_min_length, gzip on binary images, missing Vary header

• list_api_state_providers

  Show API Platform 3 state providers and processors: ProviderInterface/ProcessorInterface implementations, #[AsDecorator] detection, resource binding, pagination/flush/mailer flags, deprecated AP v2 DataProvider/DataPersister style detection

• list_api_versions

  Show API versioning: URL-prefixed routes (/v1/, /v2/), versioned serializer groups (v1:read), FOSRestBundle versioning, gap analysis between versions

• list_asset_pipeline

  Show asset pipeline type (Asset Mapper or Webpack Encore), entry points, imported packages/importmap entries, and Stimulus controllers

• list_aws_cloudfront_config

  Scan for AWS CloudFront distribution configuration: composer.json aws/aws-sdk-php, .env* CLOUDFRONT_DISTRIBUTION_ID/KEY_PAIR_ID/PRIVATE_KEY_PATH (masked), PHP CloudFrontClient/createInvalidation/getDistribution/sign/CloudFrontCookieSigner/CloudFrontUrlSigner usage, config/packages/ and config/aws/ YAML/JSON. Flags wildcard invalidation (/*), signed URL without expiry, hardcoded private key path.

• list_aws_cognito_integration

  Scan for AWS Cognito user pool integration: composer.json aws/aws-sdk-php, .env* Cognito vars (masked secrets), PHP CognitoIdentityProviderClient/initiateAuth/adminInitiateAuth/respondToAuthChallenge/signUp/adminGetUser, JWT signing key verification. Flags USER_PASSWORD_AUTH flow, missing JWT verification, hardcoded client secret, adminConfirmSignUp bypassing email verification, missing MFA handli

• list_aws_ecs_config

  Analyse ECS task definition JSON files (*task-definition*.json, ecs-task*.json, taskdef.json) for hardcoded secrets in environment[], missing healthCheck, privileged:true containers, and missing cpu/memory

• list_aws_lambda_bref

  Analyse AWS Lambda / Bref configuration: runtime layers, cold-start memory, filesystem write safety, timeout limits, missing APP_ENV=prod, and SQS Messenger transport

• list_aws_parameter_store

  Scan src/**/*.php, config/**/*.yaml, .env* for AWS SSM Parameter Store patterns: GetParameter with WithDecryption: false on SecureString, hardcoded parameter name (not env var), missing custom KMS key alias (uses default aws/ssm), parameter path not following /app/env/param convention, multiple individual GetParameter calls instead of batch GetParameters, AWS credentials in source (masked).

• list_aws_s3_integration

  Analyze AWS S3 integration: detect composer SDK (aws-sdk-php, flysystem-aws-s3-v3), env credentials (AWS_ACCESS_KEY_ID/SECRET/S3_BUCKET/REGION), PHP S3Client/putObject/getObject/presigned usage, flag public-read ACL, hardcoded buckets, no server-side encryption, presigned URL without expiry

• list_aws_secrets_manager

  Scan src/**/*.php, config/**/*.yaml, .env* for AWS Secrets Manager patterns: RotationEnabled: false, GetSecretValue without VersionStage AWSCURRENT, missing SecretCache/SecretsManagerCache, hardcoded secret ARN or name, JSON parse without error handling, AWS credentials in source (masked).

• list_aws_ses_integration

  Analyze AWS SES integration: scan .env/.env.local/.env.prod/mailer.yaml for MAILER_DSN with ses+smtp/api/https, AWS_SES_* env vars (masked), PHP SesClient/SesV2Client/SimpleEmailServiceV2Client usage, hardcoded AWS credentials in PHP. Flags: missing bounce/complaint handler, ses+smtp vs ses+api, APP_ENV=prod sandbox risk

• list_azure_blob_storage

  Scan src/**/*.php, composer.json, config/**/*.yaml, .env* for Azure Blob Storage patterns: azure/storage-blob or microsoft/azure-storage-blob in composer.json, SAS token without expiry, container access set to container/blob (public), connection string with AccountKey (masked), missing retry policy (RetryMiddlewareFactory), blob upload without Content-Type header.

• list_azure_pipelines_config

  Analyse Azure Pipelines YAML (azure-pipelines.yml, azure-pipelines.yaml, .azure/pipelines.yml) for missing trigger branch filters, secrets in variables, no timeoutInMinutes, and job configuration

• list_mercure_push_config

  Show API Platform Mercure push integration: mercure:true/#[ApiResource(mercure:...)] per resource, private topics, custom topic patterns, hub URL configuration, direct HubInterface::publish() usages, try/catch around publish, static topic warning, hub-not-configured warning

• list_stimulus_controllers

  List all Stimulus controllers: local ones in assets/controllers/ and package-provided ones from controllers.json with lazy/enabled status

• Code scan1500 source files scanned15/25
• –Live reliabilityno gateway calls yet and no remote to proben/a
• –Tool poisoningtools not inspected (local package is not executed); not countedn/a
• Auth qualitystatic API keys via environment variables6/15
• Maintenancelast push 11 days ago15/15
• Maintainer identityregistry namespace matches repository owner; GitHub account older than a year8/10

Safety score

68/100

higher than 33% of 4,460 AI and agents servers

Tools

100

the typical AI and agents server has 6

Tools that change things

0%

typical: 0%. Fewer write tools means less an agent can break

Downloads a week

55

more than 46% of 1,538 AI and agents servers with a package

Symfony Agent MCP: common questions

Is Symfony Agent MCP server safe?

With care: it is graded C, so read the findings first (68/100). Read the Symfony Agent MCP safety report

How do I install Symfony Agent MCP?

It runs on your machine. Copy the Claude Code, Cursor, VS Code or Claude Desktop config from the install section.

Does Symfony Agent MCP need an API key?

Yes. The registry entry asks for SYMFONY_MCP_SESSION_SECRET, SYMFONY_MCP_SESSION_TOKEN.

Is Symfony Agent MCP maintained?

The last commit was 14 days ago (2026-10-21). The latest release is v1.0.2.

What can I use instead of Symfony Agent MCP?

Servers from other publishers that do the same job: HOL Guard MCP server, Shellward MCP server and Agent Security Scanner MCP server.

How does Symfony Agent MCP compare with other AI and agents MCP servers?

safety score 68/100 (higher than 33% of 4,460 AI and agents servers); tools 100 (the typical AI and agents server has 6); tools that change things 0% (typical: 0%. Fewer write tools means less an agent can break). Full comparison.