@@ -364,90 +364,6 @@ mcp_yourfeature_create(name: "Example")
364364\`\`\`
365365```
366366
367- ## Security Guidelines
368-
369- ### 1. Always Use AccessManager
370-
371- ``` php
372- // Check write access before any write operation
373- if (!$this->accessManager->hasWriteAccess()) {
374- return ['success' => FALSE, 'error' => 'Write access denied'];
375- }
376-
377- // Check admin access for dangerous operations
378- if (!$this->accessManager->hasAdminAccess()) {
379- return ['success' => FALSE, 'error' => 'Admin access required'];
380- }
381- ```
382-
383- ### 2. Protect Critical Entities
384-
385- ``` php
386- // Never allow deletion of user 1
387- if ($userId === 1) {
388- return ['success' => FALSE, 'error' => 'Cannot modify user 1'];
389- }
390-
391- // Never allow deletion of administrator role
392- if ($roleId === 'administrator') {
393- return ['success' => FALSE, 'error' => 'Cannot modify administrator role'];
394- }
395- ```
396-
397- ### 3. Block Dangerous Permissions
398-
399- ``` php
400- $dangerousPermissions = [
401- 'administer permissions',
402- 'administer users',
403- 'administer modules',
404- 'bypass node access',
405- ];
406-
407- foreach ($permissions as $permission) {
408- if (in_array($permission, $dangerousPermissions)) {
409- return ['success' => FALSE, 'error' => "Cannot grant: $permission"];
410- }
411- }
412- ```
413-
414- ### 4. Validate Input
415-
416- ``` php
417- // Validate machine names
418- if (!preg_match('/^[a-z][a-z0-9_]*$/', $machineName)) {
419- return ['success' => FALSE, 'error' => 'Invalid machine name format'];
420- }
421-
422- // Validate entity references
423- $entity = $this->entityTypeManager->getStorage('node')->load($id);
424- if (!$entity) {
425- return ['success' => FALSE, 'error' => 'Entity not found'];
426- }
427- ```
428-
429- ### 5. Log All Operations
430-
431- ``` php
432- $this->auditLogger->log('operation_type', 'entity_type', $entityId, [
433- 'label' => $entity->label(),
434- // Never log passwords or secrets
435- ]);
436- ```
437-
438- ### 6. Implement Batch Limits
439-
440- ``` php
441- // Limit batch operations to prevent timeouts
442- $maxItems = 50;
443- if (count($items) > $maxItems) {
444- return [
445- 'success' => FALSE,
446- 'error' => "Maximum $maxItems items per batch",
447- ];
448- }
449- ```
450-
451367## Testing
452368
453369### Unit Tests
@@ -499,12 +415,14 @@ class YourFeatureIntegrationTest extends KernelTestBase {
499415
500416## Submitting Your Contribution
501417
502- 1 . Fork the repository
503- 2 . Create a feature branch
504- 3 . Implement your changes following these guidelines
418+ MCP Tools is a Drupal.org project. Contributions follow the standard Drupal.org workflow:
419+
420+ 1 . Create an issue in the [ MCP Tools issue queue] ( https://www.drupal.org/project/issues/mcp_tools )
421+ 2 . Create a merge request from the issue
422+ 3 . Follow the guidelines above in your implementation
5054234 . Add tests for new functionality
506- 5 . Update documentation (README, CHANGELOG)
507- 6 . Submit a pull request
424+ 5 . Update documentation (submodule README, CHANGELOG)
425+ 6 . Mark the issue as "Needs review"
508426
509427### Checklist
510428
@@ -519,4 +437,4 @@ class YourFeatureIntegrationTest extends KernelTestBase {
519437
520438## Questions?
521439
522- Open an issue on the project repository for questions or suggestions .
440+ Open an issue in the [ MCP Tools issue queue ] ( https://www.drupal.org/project/issues/mcp_tools ) .
0 commit comments