Install on an existing site

The install is two paths. The first is complete on its own: an agent that answers from this site's real modules, entities, fields and versions. The second adds the governed pipeline.

Requirements

Drupal ^11.1 || ^12, PHP 8.3 or newer.
drupal/mcp_server (pulled in below). Semantic search additionally wants a local embedding backend; Ollama and anything OpenAI-compatible both work, and lexical search is a complete separate store without one.
The pipeline's gates need drupal/core-dev for phpcs and phpstan. Match its constraint to your core minor.
Under DDEV, prefix every command with ddev. You do not need Drush first; a plain recommended-project does not ship it, and Droost pulls it in.

Path 1: the toolset

bash

composer require --dev 'drupal/droost:^2.0@alpha' 'drupal/mcp_server:^2.0@alpha'
drush en droost -y          # module on AND your editor wired
drush droost:install        # submodules + knowledge layer; asks two questions

Enabling the module wires the project root by itself: .mcp.json, AGENTS.md, CLAUDE.md, .claude/. Then droost:install enables every submodule whose backend is present, asks which editor you use (auto-detected) and whether to arm allow_scaffold, explaining what a write gate is and what each of the three tools it arms may write, and builds the knowledge layer.

Then open Claude Code, Cursor or Codex in the project and ask "what does this site know about itself?". It answers from droost_app_info and droost_entities with real numbers.

One security advisory has to be allowed

mcp_server pins mcp/sdk ^0.6, and v0.6.0 carries CVE-2026-53965. Until the next mcp_server release, Composer refuses to resolve without this, run before the require above:

bash

composer config --json policy.advisories.ignore-id '["PKSA-p9gd-j6gr-6f9t"]'

The upstream fix is merge request !62 on mcp_server; Droost's KNOWN_LIMITATIONS.md #6 tracks it.

Path 2: the pipeline

bash

composer require --dev 'drupal/core-dev:^11.4' -W   # the gates need phpcs + phpstan
drush droost:workflow:install                        # asks about enforcement, offers the Playwright MCP

This enables droost_workflow, writes a site-shaped droost.workflow.yml (analysis paths measured from your layout, require_run: hard) and a site-shaped phpunit.xml so the mandatory phpunit gate can run, materializes the pack (/droost:workflow:start, /droost:workflow:continue, /droost:workflow:status, one skill per phase, five agents including the adversarial seeker, and the guard hook), and rebuilds the brain.

The wall is on from this moment

With the pipeline installed, a require_run wall stands while no run is active: the editor guard blocks edits to modules/custom and themes/custom, and Droost's own build tools refuse over MCP. Start a run with /droost:workflow:start, or grant a reasoned bypass with drush droost:workflow:bypass "<why>". Set require_run: soft for a one-time nudge, or off to disable it.

Check where a site stands

bash

drush droost:setup:status     # both paths, what is wired, what is armed
drush droost:doctor           # freshness of every knowledge store + the rebuild command per stale store

Both paths are reversible. droost:install also ships three guided slash commands: /droost:configure (profiles, write gates, embedding backend, workflow levers), /droost:upgrade (walks the shipped upgrade bulletins in order) and /droost:init (finishing setup from inside an editor on a project someone else wired).