Get started · phpBB MCP Server

Install the extension, switch it on for the groups you choose, and connect an AI app. Try it on a copy of your board first.

1. Check the requirements

phpBB 3.3.9 or a newer 3.3 release
PHP 8.1 or newer, with the curl extension for app sign-in through Client ID Metadata Documents
MySQL, MariaDB, PostgreSQL or SQLite 3 (MSSQL and Oracle are not supported)
HTTPS, with the board reachable from the internet if members use the hosted Claude, ChatGPT or Gemini apps

2. Install

Download the zip and unpack it into your board’s ext/ folder, so the files end up in ext/paul999/mcp/.
In the ACP, go to Customise → Manage extensions and enable phpBB MCP Server.
Go to Extensions → MCP server → Settings and switch the MCP server on.
Give the groups that should use it the permission Can use the MCP server. The read tools are already in the standard user roles; writing, private messages and moderation tools need their own permissions in the MCP server category.

3. Check your server

Server settings. Server configuration → Server settings in the ACP (protocol, domain, port, script path) must match the address members use. Tokens are issued for exactly that address, and the server answers only over https:// (or on localhost; test boards can also turn on Allow the MCP server without HTTPS, never a public one).
The Authorization header. Apache with PHP-FPM or CGI drops it unless you set CGIPassAuth On (Apache 2.4.13 and later) or add this rewrite rule:
```
RewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}]
```
Board online. The board must not be disabled, and the install/ folder must be gone.

4. Connect an app

Members find the server address on the MCP server page of their User Control Panel. It looks like this:

https://your.board/app.php/mcp

Claude, ChatGPT and Gemini apps

Add a custom connector with the server address. The app sends the member to the board, where they log in, choose what the app may do and confirm with their password. Connected apps are listed in the UCP and can be disconnected there.

Claude and ChatGPT identify themselves with a Client ID Metadata Document, which is on by default.
The Gemini app registers itself, so it needs dynamic client registration, which is off by default (ACP settings).

Claude Code, Gemini CLI, Cursor and other tools

These can use the same sign-in, or a personal access token the member creates on the UCP page. The UCP shows these snippets with the board’s address and the new token filled in.

Claude Code (the command stores the token in your shell history; clear it afterwards if others use your computer):

claude mcp add --transport http phpbb https://your.board/app.php/mcp --header "Authorization: Bearer YOUR_TOKEN"

Gemini CLI (~/.gemini/settings.json):

{
  "mcpServers": {
    "phpbb": {
      "httpUrl": "https://your.board/app.php/mcp",
      "headers": { "Authorization": "Bearer YOUR_TOKEN" }
    }
  }
}

Cursor (~/.cursor/mcp.json) and other clients with an mcpServers file:

{
  "mcpServers": {
    "phpbb": {
      "url": "https://your.board/app.php/mcp",
      "headers": { "Authorization": "Bearer YOUR_TOKEN" }
    }
  }
}

Treat a token like a password. It can be revoked at any time in the UCP.

5. Moderation tools (optional)

Moderation tools need all of these:

Enable moderation tools in the MCP server settings.
The tool’s moderator permission in the MCP server category, for example Can soft delete posts and topics through the MCP server. Nobody has these after installation.
The core moderator permission the moderator control panel checks, such as m_softdelete, in the forum of every post.
A token or app with a moderation scope: moderate:read (review), moderate (content) or moderate:users (members).

Permanent deletion, bans of IP and e-mail addresses, permanent bans and raw IP addresses each have their own ACP setting as well. See the tool list for what each tool does.