MokoSuite MCP Server

The MokoSuite MCP Server connects AI assistants like Claude directly to your MokoSuite client sites, so routine platform work — health checks, dashboards, extension and plugin management, snapshots, and user operations — can be handled in plain language. Built on the open Model Context Protocol, it talks to MokoSuite through the standard Joomla Web Services API and manages every site from a single configuration. Read-only insight, everyday actions, and RSA-signed remote control are all available, with explicit confirmation required before any destructive fleet-wide change.

What it is

The MokoSuite MCP Server is a Model Context Protocol (MCP) server for the MokoSuite platform. It lets AI assistants — Claude Desktop, Claude Code, and any other MCP-compatible client — operate MokoSuite client sites through the MokoSuiteClient Joomla Web Services API.

It exposes 24 tools covering the full platform surface: site health and dashboards, extension and plugin inventory, snapshot management, cache and update control, content sync, and (with the right credentials) provisioning, remote login, and fleet-wide user operations.

Two ideas make it flexible and safe:

• Multi-site by design. Every named connection in your config is one MokoSuite site (or the HQ control plane). Tools act on your default connection unless you name another one, so a single install manages your whole fleet.
• Safety guards. Destructive, fleet-wide operations require an explicit confirm: true, and the remote-control tier requires a second, higher-privilege credential — reads and everyday actions never touch it.

It is TypeScript-first, ships as a modern ESM package, and requires Node.js 20 or newer.

Install (npm)

The package is published to public npm under the @mokoconsulting scope. Install it globally:

npm install -g @mokoconsulting/mcp-mokosuite

Or run it on demand with npx (no global install needed):

npx -y @mokoconsulting/mcp-mokosuite

Requirements: Node.js 20 or newer. Optionally, you can pull the package from the MokoGIT registry mirror by adding this scope-to-registry mapping to your .npmrc:

@mokoconsulting:registry=https://git.mokoconsulting.tech/api/packages/MokoConsulting/npm/

Configure

The server does not read per-tool environment variables. Instead it loads a single JSON config file from ~/.mcp_mokosuite.json, or from the path in the MOKOSUITE_CONFIG environment variable if set. Each named connection is one MokoSuite site.

{
  "defaultConnection": "moko-live",
  "connections": {
    "moko-live": {
      "baseUrl": "https://mokoconsulting.tech",
      "apiToken": "your-joomla-api-token"
    },
    "client-site": {
      "baseUrl": "https://clientsite.example",
      "apiToken": "your-joomla-api-token",
      "healthApiToken": "site-health-api-token-64hex",
      "rsaPrivateKeyPath": "/path/to/hq-signing-key.pem",
      "keyVersion": 1
    }
  }
}

Connection fields:

• baseUrl — the site's URL.
• apiToken — a Joomla Web Services API token (Users → Manage → API Tokens) used by the read and CRUD tools.
• healthApiToken + rsaPrivateKeyPath + keyVersion (optional) — the site's health_api_token plus HQ's RSA-2048 signing key. Required only for the remote-control tools (provision-reset, remote-login, mass user operations).
• insecure (optional) — set true to allow self-signed certificates (e.g. local development).

Register the server with your MCP client (Claude Desktop / Claude Code):

{
  "mcpServers": {
    "mokosuite": {
      "command": "npx",
      "args": ["-y", "@mokoconsulting/mcp-mokosuite"]
    }
  }
}

Tooling

The 24 tools are organized into four tiers. Every tool accepts an optional connection argument to target a specific site.

• Foundation — connection and diagnostics: mokosuite_ping, list_connections, and a generic api_request passthrough.
• Reads — insight without side effects: client_get_health, client_get_dashboard, client_list_extensions, client_list_plugins, client_list_snapshots, client_list_users, and client_export_users.
• Actions — everyday operational changes: client_clear_cache, client_check_updates, client_install_extension, client_toggle_plugin, client_create_snapshot, client_reset_snapshot, and client_sync_push.
• Remote-control (RSA-signed) — high-privilege fleet operations requiring the second credential tier: client_provision_reset, client_remote_login, client_users_reset_passwords, client_users_reset_2fa, client_users_disable_all, client_users_enable_all, and client_users_force_logout. Destructive operations in this tier require confirm: true.

Get help

Need a hand getting connected, or want us to run it for you? Open a support ticket or call (931) 279-6313 and the MokoConsulting team will help.