Craft 6 puts an MCP server in core. A Drupal dev reads the permissions screen first.
The headline writes itself: Craft is putting an AI server in core. And if that's all you take from the Craft 6 alpha, you'll miss the part that actually matters. I didn't open the feature list first — I went looking for the permissions screen, the way I would with any new write surface on a Drupal site. What I found is a design that's more careful than the hype, bolted onto an alpha that's still admittedly rough.
What landed
The Craft 6 line — the big Laravel rebuild — now ships built-in Model Context Protocol servers. An AI client can inspect and edit content, the content model, users, plugins and project config through them. It arrived in 6.0.0-alpha.20 (dated 2026-10-07 in the changelog), via PR #19846 — "[6.x] Add MCP servers," authored by riasvdv, merged by Brandon Kelly on Oct 6 after 74 commits.
There are three servers: an authenticated one at {cpTrigger}/mcp, a public one at a configurable route that's disabled by default, and a stdio server you run as a named user via php craft mcp:serve --user=…. The toolset is the obvious CRUD-plus: elements.* (list, read, create, update, delete, restore, validate, duplicate), activity.list, activity.comments.create. A week later, PR #20006 ("AI connections," merged Oct 18) added a Settings → AI screen where you bring your own provider keys — stored in the app's config/ai.php, with Craft keeping none itself, and no silent fallback to a default ("Craft never falls back to ai.default," so features stay off until you configure them). Note that #20006 merged after alpha.20, so it isn't in a tagged build yet.
Reading the checkbox tree
Here's why I'm not rolling my eyes. The auth story is OAuth 2.1 through Laravel Passport — discovery metadata, dynamic client registration, PKCE, and no static tokens described anywhere. Using it requires a new "Use Craft MCP" permission on top of control-panel access. Public access isn't a single toggle; it's approval in Settings → MCP per capability and per content source — sites, sections, volumes, user groups, element types. And in sections with an approval workflow, entries.create and entries.update save enabled entries as drafts rather than publishing, flagging the result with savedAsDraft. MCP actions even show up with an "MCP" origin in element timelines, including the queued jobs they kick off.
That's the design I'd have asked for: an explicit permission, public exposure off by default, per-source opt-in, and writes that land as drafts where a workflow exists. Whoever specced this read the threat model before the demo.
The catch
Two of them, actually. First, this is an alpha — the codebase is fully on Laravel, the control panel is being rebuilt in Vue/Inertia, and the team itself says to expect "many rough edges." Adding a new authenticated, programmatic write surface to a CMS whose Twig sandbox spent this autumn getting escaped (I wrote about that one) is exactly the kind of thing you want hardened, and alpha code isn't hardened yet. Second — and this is the honest tell — there are no docs. I went looking: craftcms.com/docs/6.x/system/mcp.html returns a 404, and the 6.x docs are sparse by the team's own description. I'm reading pull requests because that's the only documentation that exists. So treat everything above as intent described in a PR, not shipped-and-audited behavior, and treat my summary as a reading of that PR, not a hands-on report — I haven't run it, and I'd only do so on a throwaway install.
I'll also resist the urge to tell you how Drupal compares. I believe there are contrib MCP and AI modules in the Drupal world, but I didn't verify their state for this post, so I'm not going to pretend I did. The point here isn't "Craft beat Drupal to it." It's that when a CMS hands an AI a write key, the interesting question is the permissions screen — and Craft's, on paper, is the right shape.
The takeaway
If you run Craft and you're tempted by the AI story, do the boring thing first: stand up alpha.20 somewhere disposable, open Settings → MCP, and read the capability-and-source tree before you connect a single client. The feature is designed to make you make those choices explicitly. That's a gift, not friction — right up until an undocumented alpha surprises you, which it will.