MCP for J is a free Joomla 5 / 6 extension that turns your Joomla site into its own MCP server. No local Node or Python install. No subprocess to babysit. No third-party proxy. Drop the package on any Joomla install, hand Claude (Desktop, Code, or claude.ai) the resulting endpoint plus a Joomla API token, and Claude can manage the site directly — articles, menus, modules, users, custom fields, ACL, scheduled tasks, Schema.org/SEO, and more — plus a growing catalog of free and Pro add-ons that extend Claude's reach into specific third-party Joomla extensions (4SEO, RSTicketsPro, Akeeba Backup Core, Cybersalt Release Manager, and more being added).
Why this exists
Every other Joomla–Claude integration in late 2025 was a local Node or Python script the user had to install and maintain per machine. If you run ten sites, that's ten local processes to babysit. MCP for J flips the model: the Joomla site itself is the MCP server. Install once on the site, and every Claude instance everywhere can talk to it just by knowing the URL and a Joomla API token.
What's in the package
One installable package bundles three core extensions, all enabled automatically by the install script:
| Element | Type | Job |
|---|---|---|
com_csmcpforj |
Component | Owns the /api/index.php/v1/mcp route, the JSON-RPC server, the tool registry, the ACL gating, and the admin dashboard. |
plg_webservices_csmcpforj |
Web Services plugin | Registers the /api/index.php/v1/mcp route — without it the route 404s. |
plg_system_csmcpforj |
System plugin | Registers the core built-in tools and translates Authorization: Bearer headers into X-Joomla-Token so any standard MCP HTTP client works. |
Add-ons are installed separately. Each Joomla third-party extension that MCP for J supports — 4SEO, RSTicketsPro, Akeeba Backup Core, Cybersalt Release Manager, and more — is a standalone Joomla plugin you install from the in-admin Browse MCP Add-ons catalog. Free add-ons install with one click; Pro add-ons require a Cybersalt Pro membership.
What Claude can do (the tool surface)
Around 108 core tools across 15 domains, plus more from each add-on you install from the catalog. Every tool exposes a JSON schema through the standard MCP tools/list method, so Claude discovers the surface on its own — no out-of-band docs to keep current.
| Domain | Tools | What you can do |
|---|---|---|
| Articles | 6 | List, get, create, update, delete articles plus list categories. |
| Categories | 5 | Full CRUD on any extension's category tree. |
| Tags | 5 | Full CRUD on Joomla tags. |
| Menus | 7 | List menus, items, and installed item types; full CRUD on menu items with params blob support. |
| Users & Tokens | 14 | User CRUD plus user-group CRUD plus the full per-user API token surface (mint, enable, reset, revoke). Provision a service-account user with a pasteable Bearer token in one call. |
| Permissions | 2 | List or set a single ACL cell on any component, including the resolved inheritance walk. |
| Modules | 7 | List modules, positions, and installed module types; full CRUD on modules including menu-item assignment. |
| Extensions | 6 | List installed extensions, toggle them, read/write a plugin's params blob, install an extension from a URL. |
| Templates | 7 | List / get / update template styles (change colour scheme, sticky header, etc. via the style's params blob), set the site-default. Plus list / read / write files under media/templates/<client>/<template>/ — CSS, JS, SCSS, JSON, SVG, images, fonts. PHP intentionally not writable. |
| Languages | 2 | List installed and content languages. |
| Custom Fields | 11 | Field CRUD plus field-group CRUD plus set a field value on a single content item. Full Subform support. |
| System | 6 | Joomla version, site info, clear cache, check for updates, list scheduled tasks, fetch a rendered URL (for AI self-verification). |
| Joomla Update | 3 | Check for a Joomla core update, run a pre-flight healthcheck, apply the update (with explicit confirmation). |
| Admin Menu Presets | 2 | List and read the XML preset files that render the Joomla 4+ admin sidebar (they live on disk under administrator/components/<component>/presets/, not in #__menu). Diagnostic use case: when a sidebar entry is reported missing, diff the on-disk preset against stock via sha256 to spot modifications. Read-only, scoped-allowlist inputs — no arbitrary file read. |
| Schema.org / SEO | 10 | Article-level Schema.org wiring through Joomla's built-in schemaorg plugin plus JSON-LD injection and a site-profile typed wrapper. |
| Add-on catalog | varies | One-click install of optional add-ons that extend Claude into specific Joomla extensions. Free add-ons install with any Joomla API token; Pro add-ons require a Cybersalt Pro membership. Examples shipping today: 4SEO (19 tools), RSTicketsPro (20 tools), Akeeba Backup Core (~8 tools), Cybersalt Release Manager (~12 tools). |
Installing it
- Download the latest release zip from the link near the top of this page.
- In Joomla admin, go to System → Install → Extensions and upload the zip.
- That's it. The install script enables all three bundled extensions automatically. Open Components → MCP for Joomla to see the dashboard.
Connecting Claude
The dashboard offers two setup methods, easiest first:
- Copy a prompt into Claude (recommended). Open the dashboard, paste your Joomla API token into the token field, and click Copy prompt. Paste the result into a fresh Claude conversation. Claude runs a test curl, confirms the connection, and (in Claude Code) offers to install the site as a permanent MCP connector for you. No JSON files to edit, no terminal commands to remember.
- MCP Connector (manual config). Copy the JSON snippet from the dashboard and paste it into Claude Desktop's
claude_desktop_config.json, or use the Add custom connector form in claude.ai → Settings → Connectors.
Permissions and security
The Joomla user who owns the API token is the actor on every tool call. That user's permissions are the MCP client's permissions — period. Super Users, Administrators, and Managers work out of the box; other groups can be granted access via System → Permissions on the MCP for Joomla component. There are two custom ACL actions: Use MCP endpoint (read tools) and Write through MCP endpoint (mutating tools).
Important: only generate tokens for users you would trust to perform those actions directly in the Joomla admin. The MCP layer is just a relay; it doesn't grant additional privileges, but it does make those privileges scriptable.
Add-on catalog
Browse MCP Add-ons is a catalog inside the MCP for J admin (Components → MCP for Joomla → Browse MCP Add-ons) that lets you install one-click extensions for the specific Joomla extensions your site uses. The catalog is growing — new wrappers ship as Cybersalt builds them, and the catalog refreshes automatically.
Two tiers:
- Free add-ons install with one click using any Joomla API token. Examples shipping today: Akeeba Backup Core (backup orchestration), Cybersalt Release Manager (manage your own extension releases).
- Pro add-ons require an active Cybersalt Pro membership. Activate your membership email once on the MCP for J dashboard and every Pro add-on the catalog offers becomes one-click installable. Examples shipping today: 4SEO (Weeblr's SEO suite), RSTicketsPro (RSJoomla's ticket system).
All add-ons are independent of the third-party vendor of the extension they wrap. The MCP wrappers are built by Cybersalt and the third-party extensions themselves are unaffected — install or update an add-on without touching the host extension.
Open source
MCP for J is open source under GPL-2.0-or-later. The full source, issue tracker, and release downloads live at github.com/cybersalt/cs-mcp-for-j.
Add comment