Repository navigation
docs: update MCP server docs for 6.7.15 - #2544
Merged
Merged
Conversation
Cover symfony/mcp-bundle 0.13, connect-time toolset selection, 401 on OAuth errors, the fail-closed MCP allowlist, and entity tool parameter contracts.
Developer Docs healthcheckStatus: Completed with |
Checked against a trunk lane on mcp-bundle 0.13 / mcp/sdk 0.8.1: the per-server `cache` recipe puts both stores on Psr16SessionStore with separate prefixes, sessions survive losing the local cache dir, and a removed Redis key is refused with "Session not found or has expired." A recipe that is not picked up leaves the file store running silently, so add the debug:container check that tells the two apart. The active session registry that app-driven tools/list_changed broadcasts fan out to lives in cache.system, which is per server. Document pointing both registries at the shared pool, and the lock store they depend on.
The registry is written without a TTL and falls back to the pool's default_lifetime. It is rewritten on every MCP request, so it outlives its sessions unless default_lifetime is shorter than session.ttl.
This was referenced Sep 24, 2026
The 6.7.16.0 changes (unset allowlist grants nothing, entity tool parameter descriptions and criteria errors) move to their own PR, because 6.7.16.0 is not released yet.
Björn Meyer (BrocksiNet)
changed the title
3 of 5 tasks
Björn Meyer (BrocksiNet)
marked this pull request as ready for review
October 7, 2026 07:24
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 6b76d2baea
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "Codex (@codex) review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "Codex (@codex) address that feedback".
Contributor
There was a problem hiding this comment.
Copilot review overview
🟡 Changes recommended
Session migration and service-ID upgrade guidance contain inaccuracies that could mislead users upgrading to 6.7.15.0.
Review effort: Balanced
Findings: 5
Open (5)
What changed in this PR
Updates MCP documentation for Shopware 6.7.15.0.
Changes:
- Documents bundle 0.13 configuration, sessions, CLI, and upgrade steps
- Adds connect-time toolset selection and OAuth 401 behavior
- Corrects allowlist and Store API guidance
| File | Description |
|---|---|
.wordlist.txt |
Adds new terminology |
guides/plugins/plugins/mcp-server.md |
Updates plugin registration guidance |
products/tools/mcp-server/configuration.md |
Documents configuration and migration |
products/tools/mcp-server/getting-started.md |
Adds connection-time toolsets and OAuth behavior |
products/tools/mcp-server/index.md |
Updates version summary |
products/tools/mcp-server/intro.md |
Revises architecture and protocol coverage |
products/tools/mcp-server/store-api.md |
Updates Store API sessions and CLI guidance |
products/tools/mcp-server/tools-reference.md |
Clarifies toolset and aggregation behavior |
products/tools/mcp-server/troubleshooting.md |
Adds new troubleshooting cases |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Both endpoints lose their sessions on the update, the Store API services have direct replacements, the Store API session text no longer claims a shared store, the tool example documents its parameters, and a missing bearer token is told apart from an expired one.
This was referenced Oct 7, 2026
Merged
Su (sushmangupta)
approved these changes
Oct 13, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Brings the MCP server docs up to date with the MCP changes released in Shopware 6.7.15.0. New behaviour is marked with the version it ships in. The 6.7.16.0 changes are in a separate PR, stacked on this one, because 6.7.16.0 is not released yet.
symfony/mcp-bundle0.13 /mcp/sdk0.8: both servers are declared under the bundle'sserverskey. The page size is now theshopware.mcp.pagination_limitparameter. Each server has its own session store, so every client initializes once more after the update, and the Redis setup is rewritten asmcp.servers.<name>.sessionconfig, including how to share the session registry.debug:mcplists tools only (use--nativefor prompts and resources,--scopeper server). A new "Upgrading to 6.7.15.0" section covers the renamed service IDs, the per-server handler tags and the removedscan_dirs. The protocol version is still pinned to the session-based handshake era.?toolsets=order,media/?toolsets=allon/api/_mcpand/store-api/_mcp, for clients like claude.ai that readtools/listonly once./api/_mcp: now return HTTP 401 /-32001instead of 500 /-32000.Fixes to existing text
McpAllowlistProviderin v6.7.15.0).@paramdocblocks, which become theinputSchemadescriptions, and says plugin tools need no namespace or directory configuration. Theshopware-entity-aggregatereference says a single aggregation object is rejected.Related links
?toolsetsresources/references/adr/2026-08-31-mcp-capability-registration-via-container.mdChecklist
PageRefreferences where relevant..gitbook.yamlif pages were moved, renamed, or deleted. (No pages moved.).wordlist.txt(and sorted it) if spellcheck flags new legitimate terms.Notes
rumdl) and the wordlist sort check pass locally. Spellcheck and link check run in CI.sessionblock inconfig/packages/mcp.yamlmerges with the config Shopware ships, both stores becomePsr16SessionStorewith separate prefixes, and sessions survive losing the local cache directory. Not tested on a running shop: whether overridingshopware.mcp.pagination_limitinconfig/services.yamltakes effect. That follows from the core source.