Joomla MCP Server - AI connector for ChatGPT and Claude
Joomla MCP Server - that is what people search for when they want to connect Claude or ChatGPT directly to their own Joomla website. The idea is compelling: you ask the AI in plain language, "Are all my pages up to date?" or "Create a draft article for me," and it does it - via a standardized interface called MCP. This article explains what an MCP server is, what options there are for Joomla, and why we built AI control in the HTProtect dashboard so that this works without any custom server tinkering - and without the AI wreaking havoc on your site with unrestricted access.
Contents
What is an MCP server? A brief explanation of the Model Context Protocol
MCP stands for Model Context Protocol - an open standard that connects AI assistants with external tools and data. Claude and ChatGPT both support it; in both, such an integration is added as a "Connector". The basic idea is simple: an MCP server tells the AI which tools are available - "list articles", "check security status", "create menu item" - and the AI decides in the conversation itself when to use which tool. You describe what you need in plain language, and the AI translates it into specific calls.
A Joomla MCP Server is therefore an integration through which an AI assistant can read and manage a Joomla website. Instead of clicking through the backend, you ask: "Which of my articles mention the old phone number?" - and you get an answer with the relevant references. This is not a toy, but real practical assistance. Provided the integration is built properly. And that is where it gets interesting.
Connecting Joomla with AI: what options are there?
Anyone searching for "Joomla MCP Server" will first land on open-source projects on GitHub. Such projects are an interesting toolkit for developers, and it is good that they exist. You only need to be clear about what you are taking on: you run such a server yourself. You have to host it, keep it up to date, secure it, and equip it with credentials and permissions for your website.
That means three tasks at once - operations, security, and permissions. And the third is the tricky one, because the AI has to use some account. Anyone who carelessly stores a Super User login there gives a language model the master key to their own website - with everything that entails: user management, configuration, extension installer. Why central master keys are generally a bad idea, we explained in detail in the article on Joomla Multisite Management. For an AI integration, this applies twice over: language models make mistakes, and access stored on a third-party or your own server can be leaked.
For a single developer sandbox, all of this is manageable. But anyone who manages several Joomla sites - or simply does not feel like maintaining an additional server service - needs a different approach.
The simple solution: AI control in the HTProtect dashboard
HTProtect is our security and management system for Joomla: a server shield component on the website plus the central dashboard at htprotect.app. The AI control is the built-in Joomla MCP server of this system - and it connects your AI assistant to the entire Joomla fleet via one address, not just a single site.
Setup is deliberately a one-click process: you enter the address in Claude or ChatGPT as a custom connector and confirm the connection once. No token to copy, no password, no server process to run. After that, you can ask for the security status of all websites in plain language - and where you have explicitly allowed it, also maintain content.
Availability: Claude supports custom connectors in all plans (exactly one in the free plan), on desktop and in the browser. ChatGPT can use it in the browser on paid plans, currently as a beta in developer mode. On the Joomla side, you need Joomla 4 or newer.
This is what it feels like in practice
A few real examples of what such a conversation looks like: "Give me the security status of all sites" returns the fleet's traffic-light overview. "Where are updates still pending?" lists the affected sites. "Search the articles for the old address" scans all approved websites in one go. And on a site with write permission: "Create a draft article on topic X and first show me what you would create" - the AI uses the dry_run preview, which shows the planned change before anything is actually saved.
What the AI assistant can do with Joomla
The AI control provides the AI with a fixed, documented toolbox - no more and no less. At a glance:
Read (default access)
- Account and fleet: whoami, list_sites, fleet_overview, fleet_search_articles
- Security: security_status, list_updates, site_check
- Content: list_articles, get_article, list_categories, get_category, list_tags, get_tag, list_menus, list_menu_items, get_menu_item, list_modules, get_module, list_media, list_languages, list_template_styles
Write (only with write permission per website)
Every write tool offers a dry_run preview, so you can review a change before it happens. And deletion always moves items to the trash - never straight into nothing.
- Articles: create_article, update_article, delete_article
- Categories: create_category, update_category, delete_category
- Tags: create_tag, update_tag, delete_tag
- Menu items: create_menu_item, update_menu_item, delete_menu_item
- Modules: create_module, update_module, delete_module
Level 2 (enabled separately and for a limited time)
- Extensions: list_extensions, set_extension_state (enable or disable a plugin)
That covers everyday work: keeping an eye on status, maintaining content, and switching a plugin in exceptional cases. What is deliberately missing is explained in the next section - because that is the real point.
Security concept: why the AI is never a super user
An AI with write access to its own website - that should at least make every site owner a little uneasy. Our answer is not a "just trust us", but architecture:
Two levels, individually per website
The default is read only. You enable writing separately for each website - not globally for the entire fleet. And level 2, managing extensions, is enabled explicitly and for a limited time per website. Level 2 is the only level with more weight - this is where the AI can switch extensions on or off. That is why it is separated, should be used deliberately and only briefly, and then automatically falls back to the lower level again.
A tightly restricted service account - never a super user
The AI access on the website runs through its own tightly restricted service account. It has no access to user management, not to the global configuration, and not to the installer. Everything runs through Joomla's official Web Services API and the permissions of exactly this account. The consequence can be stated plainly: as long as the AI stays with reading and content (default and level 1), even with a leaked or abused token, the worst conceivable case is a defacement - annoying, but repairable. The account simply lacks the rights needed to take over the website completely.
Zero-knowledge: your browser signs, not our servers
Activating a website is signed only by your unlocked operator browser - our servers never get to see the login credentials. That is the same zero-trust principle built into the entire HTProtect dashboard: the server is a messenger, not a commander.
Immediate shutdown and throttling
The entire AI access can be blocked at any time with a single click - and just as easily restored at any time. A kill switch for when something feels off. In addition, all outgoing requests to the websites are throttled and protected: a rate limit plus safety switch ensures that no website gets overloaded, no matter how hard the AI is working.
In short: the exciting question with a Joomla MCP server is not what the AI is allowed to do - but what it absolutely cannot do. That is exactly why we built the limits into the architecture itself instead of hiding them in a configuration option.
Frequently asked questions
What is a Joomla MCP Server?
A connection based on the Model Context Protocol (MCP) that allows an AI assistant such as Claude or ChatGPT to read and manage a Joomla website. In the AI, it is added as a connector; the AI then calls defined tools through it, such as "list articles" or "query security status".
Does this work with ChatGPT and Claude?
Yes, with both. Claude supports its own connectors in all plans, on desktop and in the browser. ChatGPT can use it in the browser in paid plans, currently as a beta in developer mode. The AI control in the HTProtect dashboard uses the same address for both.
Can the AI take over or break my Joomla website?
Take over, no: the service account is never a Super User and has no access to user management, global configuration, or the installer. By default it can only read; writing is enabled per website, deletion first goes to the trash, and the kill switch blocks full access with one click. As long as the AI stays with reading and content, the worst conceivable case is a defacement - annoying, but repairable. Only level 2 (enabling extensions) carries more weight - which is exactly why it is separated, can only be enabled explicitly and temporarily, and is intended for short use. With self-hosted MCP servers, the answer depends entirely on which account you configure.
What requirements do I need?
Joomla 4 or newer, HTProtect on the website, and an account in the htprotect.app dashboard. The connection itself is a one-liner: enter the address in Claude or ChatGPT as a connector, confirm once, done.
Conclusion: AI yes - master key no
Connecting an AI assistant to Joomla in 2026 is no longer a hacky side project, but a question of the right approach. Self-hosted open-source MCP servers are a great playground for developers - but for productive use on real client sites, you do not want to maintain an extra server service or trust a language model with super-user access. AI control in the HTProtect dashboard solves both: one address for the whole fleet, one-click connection with Claude or ChatGPT, and a permissions model that never makes the AI a super-user - limiting the damage, as long as it stays on reading and content, in the worst case to a repairable defacement. How this fits into the rest of your sites' security concept is explained in the Guide to securing Joomla.
Questions or something unclear? Feel free to write it in the comments below the article.
- Details
- Last Updated: 03 August 2026
