Freento MCP Audit Tools for Magento 2

Add-on for Freento_Mcp that registers a set of audit and diagnostic MCP tools. The tools are designed for AI-driven store audits — collecting structured data about the filesystem, database, configuration, logs, indexers, cron, third-party modules, code quality and email delivery, all exposed over the standard MCP protocol provided by Freento_Mcp.

Features

• 16 ready-to-use audit tools registered into the parent module's ToolRegistry
• Single admin toggle to hide every audit tool everywhere (tools/list, tools/call, ACL UI)
• Log error grouping with smart message normalization (UUIDs, IDs, quoted values, emails)
• Two-step on-demand SQL query counter for any frontend URL (bypasses FPC)
• Sensitive env.php keys (passwords, secrets, hosts, ports, etc.) automatically masked
• Curated critical-settings check (deployment mode, 2FA, MySQL optimizer, Xdebug/APCu, key rotation, …)

Requirements

• Magento 2.4.x
• PHP 8.1+
• freento/module-mcp ^1.2 (loaded as a module sequence dependency)
• magento/magento-coding-standard (declared as a composer dependency; required by run_code_sniffer)

Installation

Via Composer

composer require freento/module-mcp-audit
php bin/magento module:enable Freento_McpAudit
php bin/magento setup:upgrade
php bin/magento cache:flush

Manual

Copy the module to app/code/Freento/McpAudit/ and run:

php bin/magento module:enable Freento_McpAudit
php bin/magento setup:upgrade
php bin/magento cache:flush

Configuration

Stores > Configuration > Freento > MCP > MCP Audit

The toggle is enforced at the ToolRegistry level via Plugin\ToolRegistryPlugin, which filters out every tool whose class lives under the Freento\McpAudit\ namespace when the module is disabled.

Available Tools

Database & Filesystem

Logs & Errors

Indexers & Cron

Configuration

Modules & Code Quality

Catalog & Customer

Performance & Email

Architecture

How tools are registered

etc/di.xml extends the parent module's Freento\Mcp\Model\ToolRegistry constructor's tools array argument, plus attaches ToolRegistryPlugin:

<type name="Freento\Mcp\Model\ToolRegistry">
    <arguments>
        <argument name="tools" xsi:type="array">
            <item name="get_table_sizes" xsi:type="object">Freento\McpAudit\Model\Tool\GetTableSizes</item>
            <!-- … 15 more entries … -->
        </argument>
    </arguments>
    <plugin name="freento_mcp_audit_tool_registry"
            type="Freento\McpAudit\Plugin\ToolRegistryPlugin"
            sortOrder="100"/>
</type>

How the SQL counter works

Plugin\SqlCounterPlugin is wired (in etc/frontend/di.xml, frontend area only) as a before plugin on Magento\Framework\DB\LoggerInterface::logStats. When a storefront request includes the _sql_counter=<id> parameter:

1. The plugin reads var/tmp/sql_counter/<id>.pending (created by count_sql_queries with action=start).
2. Every call to LoggerInterface::logStats increments an in-memory counter. Any SQL whose text contains the literal substring sql_counter is skipped as a defensive guard against self-counting.
3. On plugin instance teardown (__destruct, end of request lifecycle), the result is written to var/tmp/sql_counter/<id>.result and the pending file is deleted.
4. A subsequent count_sql_queries call with action=get returns the result and cleans up.

The _sql_counter parameter doubles as a cache-busting query string, so the counted response is guaranteed not to be served from FPC.

API Reference

All tools are invoked through the parent Freento_Mcp JSON-RPC endpoint (/freento_mcp/index/index). The audit module only adds tools — the request format, authentication, and transport are documented in the parent module README.

List audit tools

tools/list returns every registered tool; audit tools are the ones whose names appear in the table above.

curl -X POST https://your-store.com/freento_mcp/index/index \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer <token>" \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}'

Call an audit tool

get_table_sizes — top 10 largest tables

curl -X POST https://your-store.com/freento_mcp/index/index \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer <token>" \
  -d '{
        "jsonrpc":"2.0","id":2,"method":"tools/call",
        "params":{"name":"get_table_sizes","arguments":{"limit":10}}
      }'

get_log_errors — grouped errors for a date range

curl -X POST https://your-store.com/freento_mcp/index/index \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer <token>" \
  -d '{
        "jsonrpc":"2.0","id":3,"method":"tools/call",
        "params":{"name":"get_log_errors","arguments":{
          "from_date":"2026-04-01","to_date":"2026-04-30",
          "sort_by":"count","sort_dir":"desc","limit":20
        }}
      }'

get_config_data — read a subtree across all scopes

curl -X POST https://your-store.com/freento_mcp/index/index \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer <token>" \
  -d '{
        "jsonrpc":"2.0","id":4,"method":"tools/call",
        "params":{"name":"get_config_data","arguments":{
          "paths":["dev/css","dev/js"],"all_scopes":true
        }}
      }'

get_deployment_config — values from app/etc/env.php

Sensitive segments (password, host, dbname, …) are silently omitted.

curl -X POST https://your-store.com/freento_mcp/index/index \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer <token>" \
  -d '{
        "jsonrpc":"2.0","id":5,"method":"tools/call",
        "params":{"name":"get_deployment_config","arguments":{
          "paths":["session/save","cache"]
        }}
      }'

get_php_ini_settings

curl -X POST https://your-store.com/freento_mcp/index/index \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer <token>" \
  -d '{
        "jsonrpc":"2.0","id":6,"method":"tools/call",
        "params":{"name":"get_php_ini_settings","arguments":{
          "keys":["memory_limit","max_execution_time",
                  "opcache.memory_consumption","opcache.validate_timestamps"]
        }}
      }'

count_sql_queries — two-step flow

# 1. Start: get a counter ID and a visit URL
curl -X POST https://your-store.com/freento_mcp/index/index \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer <token>" \
  -d '{
        "jsonrpc":"2.0","id":7,"method":"tools/call",
        "params":{"name":"count_sql_queries","arguments":{
          "action":"start","url":"https://your-store.com/"
        }}
      }'

# 2. Visit the returned URL (browser or curl). The _sql_counter param bypasses FPC.
curl -s "https://your-store.com/?_sql_counter=<counter_id>" >/dev/null

# 3. Get the result
curl -X POST https://your-store.com/freento_mcp/index/index \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer <token>" \
  -d '{
        "jsonrpc":"2.0","id":8,"method":"tools/call",
        "params":{"name":"count_sql_queries","arguments":{
          "action":"get","counter_id":"<counter_id>"
        }}
      }'

run_code_sniffer

curl -X POST https://your-store.com/freento_mcp/index/index \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer <token>" \
  -d '{
        "jsonrpc":"2.0","id":9,"method":"tools/call",
        "params":{"name":"run_code_sniffer","arguments":{
          "path":"Freento_McpAudit","severity":"errors","limit":50
        }}
      }'

send_test_email

curl -X POST https://your-store.com/freento_mcp/index/index \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer <token>" \
  -d '{
        "jsonrpc":"2.0","id":10,"method":"tools/call",
        "params":{"name":"send_test_email","arguments":{
          "email":"[email protected]","store_id":1
        }}
      }'

Entity-list tools (get_cron_schedule, get_customer_groups, get_eav_attributes)

These extend the parent module's entity-tool framework, so they accept the same filters / function / field / group_by / limit / sort_by / sort_dir parameters as the rest of Freento_Mcp (see parent README — Filters / Aggregation).

# Failed cron jobs in the last 7 days, grouped by job_code
curl -X POST https://your-store.com/freento_mcp/index/index \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer <token>" \
  -d '{
        "jsonrpc":"2.0","id":11,"method":"tools/call",
        "params":{"name":"get_cron_schedule","arguments":{
          "filters":{
            "status":{"in":["error","missed"]},
            "scheduled_at":{"gte":"2026-04-29"}
          },
          "function":"count","group_by":"job_code","limit":20
        }}
      }'

License

MIT