php-sdk
The official PHP SDK for Model Context Protocol servers and clients. Maintained in collaboration with The PHP Foundation.
No outside reports on file
Use this tool only with MCP servers you fully trust, validate all incoming messages in your PHP code, and never pass sensitive credentials through unencrypted connections.
Based on public adoption and transparency signals as of Oct 22, 2026. Our opinion, not a code audit or security guarantee.
What it can access
- Local filesNo local folder access notedLOW
- Command executionNo shell command runner notedLOW
- Network reachConnects to outside service APINOTED
- CredentialsNo API token requiredLOW
- Package sourceGitHub (modelcontextprotocol/php-sdk)PUBLIC
Inferred from this listing’s public package details and description. Check the project’s source before installing.
Install
No npm or PyPI package is listed. Install from source: github.com/modelcontextprotocol/php-sdk ↗
About Php Sdk
This is an official PHP library that lets PHP applications talk to Model Context Protocol (MCP) servers and clients. It handles the technical details of sending and receiving messages between PHP code and AI tools or other services using the MCP standard.
Who it’s for
PHP developers who want to build AI-powered applications or connect their PHP services to Claude and other AI systems through the Model Context Protocol. It's made for teams using PHP who need structured communication with AI models.
Alternatives
- Python SDK for Model Context Protocol: Official MCP support for Python applications if you can switch languages.
- Node.js/JavaScript SDK for MCP: Official MCP library for JavaScript and server-side JavaScript environments.
- Direct REST API integration: Some AI services offer HTTP APIs as an alternative to MCP protocol implementation.
Setup
Check these steps against the project’s own instructions before running anything.
Follow the project's README for installation and configuration instructions specific to your PHP environment and use case.
Why this grade
Signal-based grade (3/7 points): well starred on GitHub, public source code. This reflects adoption and transparency, not a code review.
Popularity and upkeep
- GitHub stars
- 1.7k
- Listing last refreshed
- 2026-10-29
These are public popularity signals, not a maintenance check. Look at the repository’s commit history and open issues.
Security reports
No reports found for this package in our research (last checked 2026-10-29).
Risks to watch for
- Direct server access: The SDK can connect your PHP application to remote MCP servers, which could read files, run commands, or access databases if those servers are compromised or malicious.
- Input confusion: If PHP code doesn't carefully validate messages coming from MCP servers, an attacker could send fake commands disguised as legitimate protocol messages.
- Credential exposure: API keys, database passwords, or authentication tokens could be passed through MCP connections and leak if the connection is intercepted or logged improperly.
- Supply chain risk: If this package is compromised in a repository, malicious code could be installed into thousands of PHP applications automatically.
- Unvalidated external data: The SDK processes structured data from servers—malformed or malicious data could trigger unexpected behavior in your PHP code.
How to lower the risk
Least-privilege permissions
- Only grant PHP processes access to resources they actually need.
- Restrict which MCP servers your application is allowed to connect to.
Network isolation
- Only allow connections to known, trusted MCP server addresses.
- Use encrypted connections (TLS/SSL) for all MCP communication.
Monitoring
- Log all messages sent and received through MCP connections.
- Alert if unusual commands or data patterns appear in logs.
Red flags to watch for
- MCP servers asking for passwords or sensitive credentials directly.
- Unexpected changes to file systems or database permissions after connecting.
- Connection attempts to unknown or unauthorized servers.
Questions
How do I install Php Sdk?
Php Sdk does not publish a standalone npm or PyPI package. Clone or follow the setup instructions in its source repository at github.com/modelcontextprotocol/php-sdk.
Are there security reports about Php Sdk?
No reports found for this package in our research (last checked 2026-10-29). Php Sdk currently holds Grade C (Moderate risk signals) based on public adoption and transparency signals. Key risk areas to watch include direct server access, input confusion, credential exposure.
Is Php Sdk actively maintained?
Php Sdk has 1.7k GitHub stars. Our directory data was last refreshed on 2026-10-29. Check recent commit activity, release tags, and open issues at github.com/modelcontextprotocol/php-sdk before pinning it in production.
What are alternatives to Php Sdk?
Notable alternatives to Php Sdk include Python SDK for Model Context Protocol (Official MCP support for Python applications if you can switch languages), Node.js/JavaScript SDK for MCP (Official MCP library for JavaScript and server-side JavaScript environments), Direct REST API integration (Some AI services offer HTTP APIs as an alternative to MCP protocol implementation). You can also compare Php Sdk side by side with other MCP servers in the Related tools section on this page.
README badge and team notes
Maintain or use Php Sdk? Show its live grade in your GitHub README, docs site, or run a check from the terminal before you install.
GitHub README Markdown:
[](https://agentarmorhq.com/skills/modelcontextprotocol-php-sdk)HTML embed:
<a href="https://agentarmorhq.com/skills/modelcontextprotocol-php-sdk"><img src="https://agentarmorhq.com/api/badge/modelcontextprotocol-php-sdk" alt="AgentArmorHQ Risk Grade for Php Sdk" height="20" /></a>Terminal check:
curl -fsSL https://agentarmorhq.com/api/cli | node --input-type=module - check "modelcontextprotocol-php-sdk"Share with your security lead
Need sign-off to use php-sdk? Copy this note for Slack, a ticket or a pull request.
### AgentArmorHQ Security Review Memo: php-sdk
- **Listing URL:** https://agentarmorhq.com/skills/modelcontextprotocol-php-sdk
- **Type:** App connector
- **Risk Grade:** Grade C (Moderate risk signals)
- **Outside Security Advisories on File:** 0
- **Public Adoption:** 1.7k GitHub stars
#### Permission & Blast-Radius Signals
- **Local files:** No local folder access noted
- **Command execution:** No shell command runner noted
- **Network reach:** Connects to outside service API
- **Credentials:** No API token required
- **Package source:** GitHub (modelcontextprotocol/php-sdk)
#### Recommended Hardened Setup
- **Source Repo:** https://github.com/modelcontextprotocol/php-sdk
- **Controls:** Pin an exact version in `.mcp.json`, scope access to a single workspace folder, and use a least-privilege read-only token where supported.
_Based on public adoption and transparency signals as of Oct 22, 2026. Our opinion, not a code audit or security guarantee._Key facts
- Type
- App connector
- Publisher
- modelcontextprotocol
- Source code
- github.com/modelcontextprotocol/php-sdk
- Est. context load
- ~850 tokens / turn (~5 tool schemas, 0.43% of 200k context)
- Popularity
- 1.7k GitHub stars
- Last updated
- 2026-10-29
- Last graded
- 2026-10-22
Community
Discussions for Php Sdk
Ask questions or share configuration tips. Governed by our Community Rules & Terms.
No posts match this filter yet.
Be the first to ask a question or share a working tip.
Check before you install, in Claude
Your assistant answers Block, Review or No known issues for any package before it installs it.
Get this check inside Claude