Frequently asked questions

The Model Context Protocol is an open standard that lets AI assistants use outside tools. With this extension, an assistant can read and search your board, post for a member, or help a moderator work through the queue, instead of the member copying text back and forth. The main use case is moderation: checking new accounts and reported posts, and removing spam quickly.

No. Every call runs as that member and is checked against their live phpBB permissions, on top of the extension’s own switches, per-tool permissions and token scopes. Tools for members never use moderator powers, even when the member is a moderator; moderation has separate tools with their own permissions. Hidden, unapproved and soft deleted content looks the same as content that does not exist.

The Claude, ChatGPT and Gemini apps, and tools such as Claude Code, Gemini CLI and Cursor. Whether custom connectors are available on a free plan depends on the AI provider and changes over time; check the provider’s current plans. The board itself needs no account with any provider.

Yes, for what the member reads through it. The extension sends nothing on its own, but the answers to a member’s requests go to the AI app they use, and a hosted app passes them to its provider. That can be posts, the member’s private messages and, for moderators, reports, notes and warnings. IP addresses are pseudonymous handles by default. Everything is off until you switch it on; mention AI apps in your board’s privacy policy.

Moderators can ask the assistant what is in the queue, whether a new account looks like a spammer (its posts, links, registrations from the same address) and then act: soft delete posts, close reports, ban an account or address, or purge a spammer (accounts with up to 50 posts), which bans the account, hides all its posts and queues the account for deletion after a grace period.

Every moderation change is two calls: a dry run that changes nothing and returns a preview, then a second call with the confirmation token from that preview. Whether a person reviews the preview depends on the AI app; most ask before running a tool marked as destructive, which all moderation actions are. Founders, staff and, by default, established members are protected from warnings and bans, permanent deletion is off unless you switch it on, and actions are rate limited and logged.

Switch the MCP server off in Extensions → MCP server → Settings; every request is refused from that moment. Moderation tools have their own switch. Members can revoke their tokens and disconnect apps in the UCP, and a password change, ban or deactivation ends all of them for that account.

It needs HTTPS: the server and the sign-in refuse plain HTTP, except on localhost or on a test board where an administrator turned on Allow the MCP server without HTTPS (never do that on a public board). Everything runs through phpBB’s app.php, so no rewrite rules are needed, except that Apache with PHP-FPM or CGI must pass the Authorization header on. See Get started.

phpBB 3.3.9 or a newer 3.3 release, PHP 8.1 or newer, and MySQL, MariaDB, PostgreSQL or SQLite 3. MSSQL and Oracle are not supported. phpBB 4 is not supported yet.

Not yet. It will be submitted once version 1.0 is released. Until then, download it here.

Nothing. The extension is free software under the GNU General Public License v2.

Please do not post it in public. E-mail [email protected] with the extension and phpBB versions, what an attacker can do and how to reproduce it. If you want to send details encrypted, first send a short e-mail without details and ask for a key. Test only on your own board, such as a local copy, never on someone else’s forum or the demo board, and do not run denial-of-service or spam tests. You get an answer within a week. Please keep the problem private until the fixed release is out; the fix is then described in the changelog. There is no bug bounty. Problems in phpBB itself go to the phpBB security tracker.