koh / sylius-webmcp

v1.1.42 2026-10-18 17:58 UTC

Requires

• php: ^8.3
• sylius/sylius: ^2.2.9 || ^2.3.0
• symfony/config: ^6.4 || ^7.4
• symfony/dependency-injection: ^6.4 || ^7.4
• symfony/http-kernel: ^6.4 || ^7.4

Requires (Dev)

• koh/dev-sylius: ^1.0
• phpstan/phpstan: ^2.3.1
• phpunit/phpunit: ^12.5 || ^13.4.3

MIT

• Kai Ole Hartwig

Published on Packagist.org on 2026-10-18 18:02 UTC

README

sylius-webmcp

WebMCP for the Sylius storefront (agentic tools in web pages)

WebMCP for the Sylius storefront — MCP tools embedded in storefront web pages (analogous to moselwal/webmcp for TYPO3). No public Sylius WebMCP package exists yet; this is ours.

What it does

On every storefront page, the bundle renders a meta tag with the agent API base and a small script. In a browser that offers WebMCP (document.modelContext, or navigator.modelContext in Chrome's origin trial), the script registers one tool for in-browser agents:

Tool	Input	Behaviour
search_products	query (required), limit (1–50, default 10)	GET {api_base}/feed?limit=…&q=… without cookies; returns the JSON response

The tool is read-only and marked readOnlyHint and untrustedContentHint: catalogue text is data for the agent, not instructions. Nothing changes the cart. Without WebMCP in the browser, the script does nothing.

The tool needs an agent API that serves {api_base}/feed. Install koh/sylius-acp, which serves /api/agent/feed. Its feed does not filter by q yet; the tool then returns the newest products.

Install

Requires PHP 8.3 or later and Sylius 2.2 or 2.3 (Twig Hooks).

composer require koh/sylius-webmcp koh/sylius-acp

Register the bundle (see the koh/sylius-acp README for its own entries):

// config/bundles.php
return [
    // …
    Koh\SyliusWebmcp\KohSyliusWebmcpBundle::class => ['all' => true],
];

The bundle registers its Twig hook itself: the script renders at the end of the shop's base template (sylius_shop.base#javascripts) as soon as the bundle is enabled.

Install the script into public/bundles/ and clear the cache:

bin/console assets:install
bin/console cache:clear

Check that a storefront page carries the tag and the script:

curl -s https://shop.example.com/en_US/ | grep -E 'koh-agent-api|webmcp.js'

<meta name="koh-agent-api" content="/api/agent">
<script src="/bundles/kohsyliuswebmcp/webmcp.js" defer></script>

If a theme overrides the base template's JavaScript block, check the hook name with bin/console debug:twig-hook sylius_shop.base and adjust the import.

Configure

# config/packages/koh_webmcp.yaml
koh_webmcp:
    api_base: '/api/agent'   # must match a route the shop serves

Decommission

Remove the composer require, the config/bundles.php entry, config/packages/koh_webmcp.yaml and public/bundles/kohsyliuswebmcp/.

Security

Report vulnerabilities privately — see SECURITY.md. Advisories are published as CSAF 2.0 at https://ole-hartwig.eu/.well-known/csaf/.

Licence

MIT — see LICENSE.

Part of the AI Ready Platform (content commerce: Sylius × TYPO3). Status: basic skeleton.