Giving an AI agent Drupal tools without handing it the site

An AI agent that can find an article does not necessarily need permission to publish it. A useful content tool should let those two operations remain separate, even when they are part of the same conversation.

Drupal MCP Connector connects MCP clients to Drupal through structured operations for reading, auditing, and permitted content changes. It can address multiple sites and normalizes JSON:API and GraphQL reads into a common entity shape. Content writes use JSON:API; the GraphQL Compose backend is a read path.

Choose the target and the authority separately

A content workflow should identify the site, inspect its fields, and read the current revision before proposing a change. Selecting a production site is not permission to perform every available operation there. The account, OAuth scopes, connector policy, and Drupal's own access rules all matter.

The roles attached to a service account are not necessarily the roles its token uses. Check the effective request identity when diagnosing a denial. Broadening account permissions without checking token scope can obscure the real problem.

Keep publication under an explicit gate

On a moderated site, draft creation and publication are different transitions. An editorial integration can prepare changes for human review while the server refuses publication by that integration.

MCP Sentinel provides Drupal-side governance for configured agent channels. This complements connector policy: the client-facing tool and the receiving application each have a role. Our write-validation article explains why a policy about the incoming value belongs at validation rather than a field-access check against stored content.

Administrative shell access is a separate authority. A Drupal module cannot protect content from arbitrary database commands run through an operator's shell. Treat any optional Drush bridge as a separately constrained administrative integration.

The operational goal is a reviewable change with an identifiable target, an allowed operation, and a verified resulting revision. The connector documentation describes its backends, policies, and content tools.