MCP servers and Laravel Boost

Pathshala’s North centre has two overdue fee instalments worth 7,500 rupees, and its accountant wants an AI assistant that finds them without a developer writing a report. The assistant cannot be handed the database: it must call a few named actions that each check who is asking. MCP servers publish those actions as tools an AI client can call, and Laravel Boost gives the coding agent you build with its own tools, guidelines and skills.

This lesson builds that server, protects each tool with Sanctum abilities and a centre scope, and opens what Laravel Boost installs.

What an MCP server is, and why a Laravel app would publish one

An agent that helps run a business must do things: read overdue fees, send a reminder. Raw database access is unsafe and unversioned. The Model Context ProtocolModel Context Protocol: An open standard for connecting AI models to external tools and data through JSON-RPC messages between a host, its clients and servers, so a model can run named actions instead of touching systems directly.’s specification says MCP “provides a standardized way to connect LLMs with the context they need”, over JSON-RPC 2.0. MCP servers let a Laravel app offer a few named, checked actions instead of a database login.

A server offers three kinds of thing:

A serverMCP server: A service that exposes tools, resources and prompts to AI clients over the Model Context Protocol. In Laravel it is a class registered with Mcp::web or Mcp::local in routes/ai.php. runs over a transportMCP transport: How MCP messages travel between a client and a server: a web server answers an HTTP POST, and a local server exchanges messages over its standard input and output as a command.: a web server answers an HTTP POST, a local one runs as a command. Because tools “represent arbitrary code execution”, the specification wants a human able to deny a call, and the server must validate inputs and rate-limit calls:

Registering a server and writing a tool that authorises each caller

composer require laravel/mcp, then php artisan make:mcp-server PathshalaMcpServer writes a server in app/Mcp/Servers. Register it in routes/ai.php with Mcp::web('/mcp/pathshala', PathshalaMcpServer::class), or Mcp::local(...) for a command server such as Boost’s. A tool extends Laravel\Mcp\Server\Tool: an input schema, a read-only or destructive annotation, and a handle(). Its name comes from the class, so ListOverdueFees is list-overdue-fees.

The route takes auth:sanctum, so inside a tool $request->user() is the user of the personal access tokenpersonal access token: A Sanctum API token issued to one user for one named client, with a list of abilities. The client sends it as a bearer token, and deleting its row revokes it. More in “API auth with Sanctum and Passport”, and the tool reads only that user’s centre. Each tool’s shouldRegister() checks a token abilitytoken ability: A string on a Sanctum token that names an action the token may take, such as fees:read. The ability and abilities middleware refuse a request whose token lacks what the route requires. More in “API auth with Sanctum and Passport”; a tool that says no is left out of tools/list and cannot be called. MCP’s spec documents OAuth 2.1; Pathshala already issues Sanctum tokens. A client sends JSON-RPC requests with three tokens, and once with none:

from session import run

# Pathshala's MCP server answering a client over HTTP. The project is the course's Pathshala with laravel/mcp
# installed (its routes/ai.php published). rpc.php sends each JSON-RPC request through the app's own HTTP kernel, so
# auth:sanctum, throttle:mcp and the MCP header checks run exactly as for a request from the network:
#   * a fees:read token lists one tool and reads its own centre's two overdue rows (Kabir's paid row left out);
#   * a fees:read + fees:write token also lists send-reminder;
#   * an attendance:read token lists no tool, and calling list-overdue-fees by name fails;
#   * no token at all is refused by auth:sanctum with 401 before the server runs.
run(
    """
composer require laravel/sanctum --no-interaction --quiet
php artisan vendor:publish --tag=sanctum-migrations --no-interaction
php artisan migrate --no-interaction
php seed.php
# The server's route: POST carries JSON-RPC; GET and DELETE answer 405.
php artisan route:list --path=mcp
# A client with a fees:read token asks which tools it may use, then calls one.
php rpc.php --token tok-read.txt tools/list
php rpc.php --token tok-read.txt tools/call list-overdue-fees
# A token that may also write sees the reminder tool as well.
php rpc.php --token tok-write.txt tools/list
# A token with no fee ability sees no fee tool, and naming one does not help.
php rpc.php --token tok-att.txt tools/list
php rpc.php --token tok-att.txt tools/call list-overdue-fees
# No token: auth:sanctum answers before the MCP server runs.
php rpc.php tools/list
""",
    app=True,
    fixture="pathshala-mcp",
    overlay=("pathshala",),
    repos=("repo-ai",),
)

$ composer require laravel/sanctum --no-interaction --quiet
$ php artisan vendor:publish --tag=sanctum-migrations --no-interaction
   INFO  Publishing [sanctum-migrations] assets.

  Copying directory [vendor/laravel/sanctum/database/migrations] to [database/migrations]  DONE
$ php artisan migrate --no-interaction
   INFO  Running migrations.

  2026_02_01_000000_create_pathshala_fee_tables ......................... DONE
  YYYY_MM_DD_HHMMSS_create_personal_access_tokens_table ................. DONE
$ php seed.php
Seeded: North 3 students, South 1 students.
Tokens for Asha (North): fees:read x2, fees:read+fees:write, attendance:read.
# The server's route: POST carries JSON-RPC; GET and DELETE answer 405.
$ php artisan route:list --path=mcp
  GET|HEAD   mcp/pathshala .... vendor/laravel/mcp/src/Server/Registrar.php:45
  DELETE     mcp/pathshala .... vendor/laravel/mcp/src/Server/Registrar.php:47
  POST       mcp/pathshala .... vendor/laravel/mcp/src/Server/Registrar.php:49

                                                            Showing [3] routes
# A client with a fees:read token asks which tools it may use, then calls one.
$ php rpc.php --token tok-read.txt tools/list
POST /mcp/pathshala  tools/list  ->  HTTP 200
  list-overdue-fees  [readOnlyHint]  arguments: as_of, limit
  (1 tools; * = required)
$ php rpc.php --token tok-read.txt tools/call list-overdue-fees
POST /mcp/pathshala  tools/call list-overdue-fees  ->  HTTP 200
isError: false
{
    "count": 2,
    "total_paise": 750000,
    "rows": [
        {
            "instalment_id": 1,
            "student": "Aarav Shah",
            "amount_paise": 450000,
            "days_overdue": 40
        },
        {
            "instalment_id": 2,
            "student": "Diya Rao",
            "amount_paise": 300000,
            "days_overdue": 12
        }
    ]
}
# A token that may also write sees the reminder tool as well.
$ php rpc.php --token tok-write.txt tools/list
POST /mcp/pathshala  tools/list  ->  HTTP 200
  list-overdue-fees  [readOnlyHint]  arguments: as_of, limit
  send-reminder  [destructiveHint]  arguments: instalment_id*, confirm*
  (2 tools; * = required)
# A token with no fee ability sees no fee tool, and naming one does not help.
$ php rpc.php --token tok-att.txt tools/list
POST /mcp/pathshala  tools/list  ->  HTTP 200
  (0 tools; * = required)
$ php rpc.php --token tok-att.txt tools/call list-overdue-fees
POST /mcp/pathshala  tools/call list-overdue-fees  ->  HTTP 400
JSON-RPC error -32602: Tool [list-overdue-fees] not found.
# No token: auth:sanctum answers before the MCP server runs.
$ php rpc.php tools/list
POST /mcp/pathshala  tools/list  ->  HTTP 401
{
    "message": "Unauthenticated."
}

The fees:read token sees one tool and reads two overdue rows, 750,000 paise; the write token also sees send-reminder. The attendance token sees none, and naming one returns “Tool [list-overdue-fees] not found.”; no token gets a 401.

What Laravel Boost gives a coding agent

Laravel BoostLaravel Boost: A first-party development package that gives a coding agent an MCP server, AI guidelines and skills for your Laravel app's packages, so it writes version-specific code. It starts only when the app is local or debug is on. points the other way: instead of your app serving an outside agent, Boost serves the coding agent you build with. After composer require laravel/boost --dev and php artisan boost:install, Boost runs a local MCP server that reads your package versions and database schema, runs read-only queries and searches version-specific documentation.

It also writes instruction files: agent guidelinesagent guideline: An instruction file a coding agent reads at the start of every task, with broad conventions for the Laravel packages an app uses. Boost writes it into the editor's guidelines file, adding custom ones from .ai/guidelines. load upfront, agent skillsagent skill: A knowledge module a coding agent loads on demand for one domain, such as testing: a SKILL.md that Boost installs into the editor's skills folder, with custom skills kept under .ai/skills. load on demand, and a project ruleproject rule: Committed Markdown in .ai/rules that teaches a coding agent your own application's decisions and traps, scoped to file globs, with an index agents read to find which rule applies to a file. you record captures your own app’s conventions, which the ecosystem guidelines never describe. One question an agent asks Boost before it writes code:

Boost is a development dependency that starts only when the environment is local or debug is on, so it stays out of production.

Choosing a tool, a route, or Boost’s own tools

Three surfaces are not interchangeable: a custom MCP tool an outside AI client discovers, a plain REST route for your own apps, and Laravel Boost’s development-only tools. Answer two questions about the caller:

In short: a tool for an AI client, a route for an app you code, Boost’s tools while you build.

The first in-depth part writes the server’s tools, catches a cross-centre leak with a test and measures a rate limit. The second runs boost:install, records a project rule and sets a review checklist.

Writing the Pathshala MCP server: tools, a leak caught by a test, and a measured rate limit Pro: opens with a Pro, Premium or Ultimate pass

Boost's artefacts: what boost:install writes, a project rule, and reviewing AI-written code Pro: opens with a Pro, Premium or Ultimate pass

Practise

In your Pathshala project, with Sanctum and laravel/mcp:

1. Put the server behind auth:sanctum and give ListOverdueFees a shouldRegister() that needs fees:read; list the tools with a fees:read and an attendance:read token.
2. Run php artisan boost:install and open the instruction files it writes.
3. For one capability, choose between a custom MCP tool, a plain REST route and Boost’s own tools.

Interview questions

Warm-up (fresher to 2–5 years): when is an MCP tool a better choice than a plain REST route for the same capability?

When the caller is an AI client that must discover and read a schema itself. A tool is advertised through tools/list with its name, description and input schema; a REST route is invisible to that client. For your own app, coded against the endpoint, a route with the same Sanctum abilities is simpler. Often you keep both, with one handler behind them.

Three longer questions on these servers and on agent-written code:

Key takeaways

• An MCP server publishes tools, resources and prompts an AI client calls over JSON-RPC, so an agent runs named actions instead of touching the database.
• Every MCP tool is an API endpoint: it validates arguments, authorises the user with Sanctum abilities, reads only that user’s data, and is rate-limited.
• Three surfaces serve different callers: a custom MCP tool for an AI client, a plain REST route for an app you code, and Boost’s tools only while you build.
• Laravel Boost gives the coding agent you build with an MCP server, guidelines and skills for your app’s packages, and it runs only in development.