Tools & profiles

Every tool returns {success, message, data}. Read-only tools are ungated. Tools that act sit behind an allow_* flag, and the ones that spawn processes or write code are additionally restricted to the STDIO transport, so they can only be reached by an editor on the same machine.

Introspection (read-only)

Tool	Purpose
`droost_app_info`	Drupal and PHP versions, install profile, database engine, themes, enabled contrib and custom modules with versions.
`droost_entities`	Entity types → bundles → field definitions.
`droost_entity_load`	One entity's raw field values by ID or UUID.
`droost_config_get` / `droost_config_status`	Read a config object (sensitive keys redacted), list names, or report drift between active config and the sync directory.
`droost_routes`	Routes with path, methods, controller and access requirements.
`droost_services`	Service IDs (flagging deprecated ones); with `id`, the class, the interface to type-hint, constructor dependencies, an injection snippet and rename guidance.
`droost_permissions`	The permission catalog and role grants, or which roles grant a permission.
`droost_logs` / `droost_last_error`	Recent dblog entries; the most recent error-level ones.
`droost_db_schema` / `droost_db_read`	Tables and columns; a single read SQL statement.
`droost_update_status`	Pending `hook_update_N` and post-update functions.
`droost_runtime_inspect`	State entries, queues with item counts, cache bins, live hook implementors, event listeners, the theme registry.
`droost_doctor`	Freshness of every knowledge store with the exact rebuild command per stale store.
`droost_guidelines` / `droost_module_docs`	Curated Drupal guidelines topics; README, `*.api.php` and docs across modules.
`droost_deprecations`	"Deprecated in X, removed in Y, use Z" for a core symbol, offline, from the shipped version-keyed ledger.
`droost_capabilities` / `droost_architecture` / `droost_module_patterns`	What this project can do, from the brain: plugin types, entity types, how to extend a module with a real example class to copy.
`droost_search`	Semantic and lexical search over core, contrib, custom code and the wiki, scoped by extension.
`droost_decide`	Walks a shipped decision graph and answers with the exact surface and command. See Decision graphs.
`droost_profile_list` / `droost_profile`	Profiled requests: timing, memory, cache hits and tags, slowest and duplicate queries.

Operations (gated)

Tool	Purpose	Gate
`droost_cache_rebuild`	Rebuild all caches.	ungated, idempotent
`droost_config_set`	Set one value on an existing config object.	`allow_config_write`
`droost_module_install` / `droost_module_uninstall` / `droost_cron_run`	Module operations and cron.	`allow_module_ops`
`droost_entity_create` / `droost_entity_update` / `droost_entity_delete`	Entity writes via the storage handler; delete requires `confirm` and refuses user 0 and 1.	`allow_entity_write`
`droost_db_create` / `droost_db_update` / `droost_db_delete`	Single-statement writes; `WHERE`-less updates and deletes are refused without `confirm`.	`allow_db_write`
`droost_scaffold`	Green-by-default code plus a test from a blueprint (service, plugin, SDC, kernel test, migrate…). STDIO-only.	`allow_scaffold`
`droost_structure_create`	A field (storage reuse-or-create, instance, widget and formatter placement), a bundle, a view mode, a menu. Create-only; collisions refused; returns the read-back. STDIO-only.	`allow_scaffold`
`droost_display_compose`, `droost_views_compose`, `droost_views_alter`	Deterministic display and Views writers, validated by Drupal before saving.	`allow_scaffold`
`droost_verify`	phpcs and phpstan (opt-in phpunit and a deprecations scan) with structured per-finding results. STDIO-only.	ungated, read-only
`droost_eval`	Execute PHP in the bootstrapped site. High risk.	`allow_eval`

Submodules add more: droost_ui_patterns (display sources and composition), droost_canvas (component-tree read, validate and write), droost_devel (test content via devel_generate, gated by allow_destructive), droost_ai (embeddings and generation via the AI module), droost_workflow (the run over MCP).

Profiles

The flags above decide whether a tool may act. A separate setting, tools_profile, decides whether it registers with the MCP server at all. MCP paginates tools/list at 50 per page by default, and clients that ignore the cursor silently see only the first page, which looks exactly like a tool that was never installed.

Profile	Registers	Notes
`lean`	21 tools	Read-only knowledge and introspection.
`standard`	47 tools	Default. Everything except raw SQL, module install, cron, PHP eval, entity deletion, the profiler readers and the generator tools. Fits one page.
`full`	all 65	Every tool the enabled modules provide. Exceeds one page; raise `mcp_server.settings:pagination_limit` (the Droost CMS recipe ships it at 200).

bash

drush config:set droost.settings tools_profile lean
drush config:set droost.settings tools_disable.0 droost_tokens   # remove one tool
drush config:set droost.settings tools_enable.0 droost_eval      # keep one the profile drops

tools_disable beats tools_enable, which beats the profile. Tool IDs Droost does not recognise always register, so a new tool never disappears silently. The status report names the registered count and the remaining margin on the first page, because the next tool that overflows it may come from a project other than Droost.