A month ago I posted about AI Connect (webmcp_connect) — an OAuth 2.0 WebMCP bridge that lets AI agents interact with Drupal sites securely.

Since then I've been using it in production and found some real issues that are now fixed. Here's what changed.

Critical fix: Bearer tokens returning 403

The OAuth flow worked, tokens were issued, but when an AI agent actually tried to call a tool — 403 every time. Turned out Drupal's auth provider was registered with global: FALSE but the tools route had no _auth declaration. So Drupal never applied the Bearer auth and every request stayed anonymous.

One-line fix in ai_connect.routing.yml. If you installed v1.0, just update and run drush cr.

New: One-click token generator

The full OAuth + PKCE flow is the right way for production, but a lot of AI tools (Kiro CLI, Cursor, anything without a browser redirect) can't do it. The /ai-connect page now has a "Generate Token" button for logged-in users.

Click it → get a ready-to-paste prompt that works two ways:

• Option A — for MCP clients (Claude Desktop, OpenCode): calls webmcp_addSite with manifest URL + token
• Option B — for any agent that can make HTTP requests: direct POST /api/ai-connect/v1/tools/{tool} with Authorization: Bearer

The prompt auto-lists every registered tool with its exact name, so the agent can call them immediately without searching.

Permission-aware UI

• Users with access → see the Generate Token button
• Logged-in without permission → see "You do not have permission"
• Anonymous → see "Log in to generate a token"

No more confusing 403 pages.

11 languages

ar, de, es, fr, he, it, ja, nl, pt-BR, ru, zh-CN — all validated with msgfmt --check.

Links

• Drupal.org: https://www.drupal.org/project/webmcp_connect
• Source: https://git.drupalcode.org/project/webmcp_connect
• Project page: https://webmcp-connect-drupal.gold-t.co.il/
• Live demo: https://webmcp-connect-drupal.gold-t.co.il/ai-connect

Previous post: https://www.reddit.com/r/drupal/comments/1rlj6gu/

What tools would be most useful for your Drupal site? I'm thinking about adding content creation (createNode) and user management next.

I wanted AI agents to be able to search and retrieve content from my Drupal site without exposing passwords or bypassing Drupal's permission system. I couldn't find anything that did this securely, so I built it.

AI Connect (webmcp_connect) is a Drupal module that lets AI agents interact with your site via OAuth 2.0 + PKCE — the same standard as Google and GitHub.

Real example: Tell Claude: "Search my site for articles about climate change and summarize the top 5" — it authenticates as you, with your permissions, and returns only what you're allowed to see.

What's included: - 7 tools: search nodes, get content, search/get comments, current user info, translation - Auto-registration of OAuth clients (no pre-configuration needed) - Localhost redirect URI support for Claude Desktop / MCP clients - Token lifecycle management (refresh, revocation, rate limiting)

Installation:

composer require drupal/webmcp_connect drush en ai_connect -y 

Links: - Drupal.org: https://www.drupal.org/project/webmcp_connect - Docs: https://git.drupalcode.org/project/webmcp_connect

This is v1.0 — what tools would be most useful for your use case?