Official MCP PHP SDK
Official PHP SDK for Model Context Protocol clients and servers, built with the PHP Foundation and Symfony project, published as `mcp/sdk` on Packagist, with framework-agnostic APIs, attribute discovery, manual registration, stdio and HTTP transports, sessions, tools, resources, prompts, sampling, and logs.
Open the source and read safety notes before installing.
Safety notes
- The official PHP SDK is experimental until its first major release; pin versions and review upstream roadmap changes before production use.
- Validate tool arguments, enforce caller permissions, bound file and network access, and sanitize exceptions before returning MCP responses.
- HTTP transports, PSR middleware, and session stores need authentication, TLS, request limits, CORS/host review, logging policy, and abuse protection.
- Attribute-based discovery can expose methods automatically; constrain discovery paths and review every discovered tool, resource, and prompt.
Privacy notes
- PHP MCP clients and servers may expose tool arguments, tool results, resource contents, prompt templates, session identifiers, request metadata, logs, progress events, and exceptions.
- Avoid leaking secrets, customer data, private files, internal identifiers, stack traces, privileged paths, or session contents through schemas, responses, errors, or logs.
- Document which MCP client, PHP runtime, framework layer, session store, model provider, transport, and logging system can observe each request.
Prerequisites
- PHP 8.1+ project with Composer and the required PHP extensions.
- A decision between server, client, or mixed SDK usage.
- A selected transport, such as stdio for local integrations or HTTP for web-based MCP servers.
- Session storage, authorization, and data-exposure boundaries for production deployments.
Schema details
- Install type
- cli
- Troubleshooting
- No
- Scope
- Source repo
- Estimated setup
- 20 minutes
- Difficulty
- intermediate
- Pricing
- free
- Disclosure
- editorial
- Application category
- DeveloperApplication
- Operating system
- Cross-platform
Full copyable content
composer require mcp/sdkAbout this resource
Overview
The official MCP PHP SDK is the Model Context Protocol project's PHP
implementation for building MCP clients and servers. It is published on
Packagist as mcp/sdk and provides framework-agnostic APIs for exposing PHP
tools, resources, and prompts or connecting PHP applications to MCP servers.
The upstream README says the project is a collaboration between the PHP Foundation and the Symfony project. It also states that the SDK is experimental until its first major release, so production users should pin versions and track the roadmap.
Composer Install
Install the package:
composer require mcp/sdk
The Packagist metadata currently resolves mcp/sdk with PHP ^8.1,
Apache-2.0 licensing, PSR dependencies, JSON schema support, and Symfony UID
compatibility ranges.
MCP Fit
Choose the official PHP SDK when a PHP application, Symfony-style codebase, web service, or internal tool needs to act as an MCP server or client. It is a good fit for teams that want to expose existing PHP application capabilities without building a separate Node.js or Python bridge.
The SDK is framework-agnostic, but HTTP deployments still need normal web application controls: authentication, request limits, sessions, logging, and careful capability exposure.
Core Capabilities
| Area | PHP SDK Coverage |
|---|---|
| Package | mcp/sdk Composer package on Packagist |
| Server APIs | Attribute discovery, manual registration, hybrid registration, tools, resources, prompts, and server-initiated communication |
| Client APIs | Connect to MCP servers, list/call tools, read resources, retrieve prompts, completions, progress, sampling, and logging handlers |
| Transports | stdio and HTTP transport coverage in upstream docs |
| Session storage | In-memory, file-based, and PSR-16 session storage options |
| Standards | PSR HTTP, PSR container, PSR event dispatcher, PSR log, and Symfony project practices |
Use Cases
- Expose PHP application methods as MCP tools with PHP attributes.
- Build an MCP server around Symfony or framework-agnostic PHP services.
- Connect a PHP application to local or remote MCP servers.
- Use stdio for local CLI-style MCP integrations.
- Use HTTP transport for web-based MCP servers.
- Store MCP sessions in memory, files, or PSR-16 caches.
Source Review
Verified on 2026-06-18:
- The upstream README identifies this as the official PHP SDK for Model Context Protocol.
- The README says the project is a collaboration between the PHP Foundation and the Symfony project.
- The README states that the SDK is experimental until its first major release.
- The README documents
composer require mcp/sdk, framework-agnostic server and client APIs, attribute discovery, manual registration, stdio transport, HTTP transport, sessions, tools, resources, prompts, sampling, logging, and progress support. composer.jsondeclares packagemcp/sdk, PHP^8.1, Apache-2.0 licensing, PSR dependencies, JSON schema support, and PSR-4 autoloading underMcp\\.- Packagist resolves package metadata for
mcp/sdk.
Safety and Privacy
Attribute discovery is useful, but it can expose methods more broadly than intended if discovery paths are loose. Keep discovery paths narrow, review every registered capability, and avoid exposing administrative methods or raw domain objects as MCP tools.
For HTTP deployments, review authentication, session storage, CORS, host handling, request limits, exception mapping, and log retention before exposing an MCP endpoint.
Duplicate Check
Checked current content/mcp/, content/tools/, content/skills/, open pull
requests, and repository-wide content for modelcontextprotocol/php-sdk,
official MCP PHP SDK, Model Context Protocol PHP SDK, PHP MCP server SDK, PHP
MCP client SDK, mcp/sdk, Packagist MCP SDK, Symfony MCP PHP, and PHP
Foundation MCP. No dedicated official PHP SDK entry, exact source URL duplicate,
target file, or open duplicate PR was found.
Source citations
Add this badge to your README
Show that Official MCP PHP SDK is listed on HeyClaude. Paste this Markdown into your README — it renders the badge and links back to this page.
[](https://heyclau.de/entry/tools/official-mcp-php-sdk)How it compares
Official MCP PHP SDK side by side with 3 alternatives on trust, install, platform support, and disclosed safety notes — all from reviewed registry metadata.
| Field | Official MCP PHP SDK Official PHP SDK for Model Context Protocol clients and servers, built with the PHP Foundation and Symfony project, published as `mcp/sdk` on Packagist, with framework-agnostic APIs, attribute discovery, manual registration, stdio and HTTP transports, sessions, tools, resources, prompts, sampling, and logs. Open dossier | Official MCP C# SDK Official C# SDK for Model Context Protocol servers and clients, maintained by the MCP project in collaboration with Microsoft, with NuGet packages for core MCP APIs, hosting and dependency injection extensions, ASP.NET Core HTTP servers, samples, API documentation, and cross-application access support. Open dossier | Official MCP Go SDK Official Go SDK for Model Context Protocol servers and clients, maintained by the MCP project in collaboration with Google, with packages for MCP, JSON-RPC, OAuth primitives, OAuth protected-resource metadata, clients, servers, transports, examples, and conformance work. Open dossier | Official MCP Java SDK Official Java SDK for Model Context Protocol clients and servers, maintained in collaboration with Spring AI, with Java 17+ support, Maven artifacts, synchronous and asynchronous APIs, Reactive Streams, Project Reactor, JDK HttpClient, Servlet transport, JSON binding modules, and conformance tests. Open dossier |
|---|---|---|---|---|
| Trust | ||||
| Install risk | Review first | Review first | Review first | Review first |
| Notes | Safety ✓ Privacy ✓ | Safety ✓ Privacy ✓ | Safety ✓ Privacy ✓ | Safety ✓ Privacy ✓ |
| Category | tools | tools | tools | tools |
| Source | source-backed | source-backed | source-backed | source-backed |
| Author | Model Context Protocol | Model Context Protocol | Model Context Protocol | Model Context Protocol |
| Added | 2026-06-18 | 2026-06-18 | 2026-06-18 | 2026-06-18 |
| Platforms | CLI | CLI | CLI | CLI |
| Source repo | — | — | — | — |
| Safety notes | ✓The official PHP SDK is experimental until its first major release; pin versions and review upstream roadmap changes before production use. Validate tool arguments, enforce caller permissions, bound file and network access, and sanitize exceptions before returning MCP responses. HTTP transports, PSR middleware, and session stores need authentication, TLS, request limits, CORS/host review, logging policy, and abuse protection. Attribute-based discovery can expose methods automatically; constrain discovery paths and review every discovered tool, resource, and prompt. | ✓The official C# SDK is a protocol library; production risk comes from the MCP tools, resources, prompts, transports, and identity flows you implement with it. Treat every MCP tool handler as an API endpoint: validate arguments, enforce permissions, bound side effects, and sanitize errors. HTTP MCP servers need normal web-service controls, including authentication, TLS, request limits, logging policy, and abuse protections. Cross-application access and identity assertion flows are security-sensitive and should be tested against the current MCP specification and enterprise policy. | ✓The official Go SDK is a protocol library; the risk is in the MCP clients, servers, tools, resources, prompts, and transports you build with it. Validate inputs, enforce capability checks, and bound side effects for every tool handler. Use local transports for local-only integrations, and add authentication, TLS, authorization, logging, and rate limits before exposing network transports. OAuth and protected-resource metadata are security-sensitive surfaces; test them against the current MCP specification and client expectations. | ✓The official Java SDK is a protocol library; production risk comes from your MCP tools, resources, prompts, transports, authorization hooks, and framework integration. Validate tool inputs, enforce caller permissions, bound side effects, and avoid returning raw Java exceptions or internal stack details to MCP clients. Servlet, Spring, and remote transport deployments need authentication, TLS, request limits, observability policy, cancellation behavior, and abuse protection. Spring AI MCP security and annotation support may simplify integration, but application owners still need to review authorization, tenant boundaries, and data retention. |
| Privacy notes | ✓PHP MCP clients and servers may expose tool arguments, tool results, resource contents, prompt templates, session identifiers, request metadata, logs, progress events, and exceptions. Avoid leaking secrets, customer data, private files, internal identifiers, stack traces, privileged paths, or session contents through schemas, responses, errors, or logs. Document which MCP client, PHP runtime, framework layer, session store, model provider, transport, and logging system can observe each request. | ✓MCP clients and servers built with the SDK may expose tool arguments, tool results, resource contents, prompt templates, user identity assertions, errors, traces, and logs. Avoid leaking private resources, customer data, internal identifiers, tokens, privileged paths, or operational metadata in schemas, responses, examples, and logs. Document which MCP client, server, model provider, transport, and logging system can observe each request before production use. | ✓MCP clients and servers built with the SDK may expose request metadata, tool arguments, tool results, resource contents, prompt templates, OAuth state, errors, traces, and logs. Do not leak private resource contents, customer data, internal identifiers, tokens, privileged paths, or operational metadata in schemas, error messages, examples, or logs. Document which model provider, client, server, and transport can observe each request before deploying outside localhost. | ✓Java MCP clients and servers may expose tool arguments, tool results, resource contents, prompt templates, request metadata, correlation IDs, logs, traces, and authorization context. Avoid leaking secrets, customer data, private resources, internal identifiers, stack traces, privileged paths, or token values through schemas, responses, errors, or logs. Document which MCP client, server process, Java framework, model provider, transport, and observability system can observe each request. |
| Prerequisites |
|
|
|
|
| Install | | | | |
| Config | — | — | — | — |
| Citations | ||||
| Claim | Unclaimed | Unclaimed | Unclaimed | Unclaimed |
Signals
Loading live community signals…
A short, calm digest of reviewed Claude resources. Unsubscribe any time.