Training course · Model Context Protocol (MCP) · PHP & Laravel/Symfony

Model Context Protocol (MCP) for PHP Developers

Build and connect MCP servers securely: tools, resources and prompts for Claude Code, Cursor, Copilot and your own AI agents.

Duration
2 days (14 hrs)
Format
Online or on-site
Language
German or English
Participants
open dates or exclusive for your team
Certificate
Certificate of attendance

Overview

This course connects Model Context Protocol (MCP) with the everyday processes of PHP & Laravel/Symfony. Participants work on realistic scenarios and leave with prompts, workflows and checklists they can use straight away.

The Model Context Protocol is an open standard that gives AI applications a uniform way to access external tools, data sources and workflows. Instead of building separate integrations for every assistant, you implement an MCP server once and use it in Claude Code, Claude Desktop, Cursor, GitHub Copilot, VS Code and your own agents. In this two-day course you learn the host, client and server architecture, the three core primitives of tools, resources and prompts, and the stdio and Streamable HTTP transports, applying each of them directly in your own code.

On day one you use the official TypeScript or Python SDK to build an MCP server that exposes internal APIs, databases or files to AI assistants in a controlled way, and you test it with the MCP Inspector. Day two covers remote servers, OAuth-based authorisation, security risks such as prompt injection and tool poisoning, and operations, logging and governance in an enterprise setting. You learn to write tool descriptions that models use reliably, and you leave knowing how to integrate MCP servers safely into your development and agent landscape.

PHP powers a large share of the web – from Laravel and Symfony applications to Shopware and Magento stores and bespoke platforms that have evolved over many years. As a result, modern framework projects frequently sit alongside legacy code without types, tests or Composer structure. AI coding assistants and agents help on both fronts: they write PHPUnit and Pest tests, bring code up to modern language standards with Rector, work through PHPStan findings level by level, generate Eloquent or Doctrine models with migrations and explain tangled legacy logic. The prerequisite is good context on framework conventions, coding standards and the test environment. This course teaches you to use agents so that modernisation becomes predictable and safe.

The course is delivered live – either online in a virtual classroom or on-site in our training rooms in Munich, Salzburg, Berlin, Augsburg, Hanover, Bremen, Stuttgart and Kaiserslautern. We can also run it exclusively for your team.

Who is this course for?

  • PHP developers working with Laravel or Symfony
  • Developers of e-commerce systems such as Shopware or Magento
  • Agency teams juggling many client projects in parallel
  • Teams modernising legacy PHP applications

Typical challenges we address

  • Legacy code without type declarations, namespaces or automated tests
  • Laborious upgrades of PHP versions and major framework releases
  • Security risks from SQL injection, XSS and unsafe file uploads in old code
  • Tight deadlines on agency projects combined with high quality expectations

What you will be able to do

  • You explain the MCP architecture and choose between tools, resources and prompts for each use case.
  • You develop your own MCP server in TypeScript or Python and test it systematically.
  • You connect MCP servers to Claude Code, Cursor, Copilot and custom agents.
  • You run remote servers using Streamable HTTP and OAuth-based authorisation.
  • Use AI agents for tests, static analysis and upgrades in Laravel, Symfony and legacy projects.
  • Modernise legacy code incrementally and safely with AI support.
  • Recognise typical security flaws in generated and existing PHP code and fix them in a targeted way.

Course outline

Day 1

Module 1 Architecture and core concepts
  • Roles of host, client and server and the lifecycle of a connection
  • JSON-RPC messages, capability negotiation and notifications
  • Tools, resources and prompts: choosing the right primitive
  • Client features such as sampling, roots and elicitation at a glance
Module 2 Building your own MCP server
  • Setting up a server with the official TypeScript or Python SDK
  • Defining tools cleanly with JSON Schema for inputs and outputs
  • Exposing resources and resource templates for documents, records and configuration
  • Testing and debugging with the MCP Inspector and meaningful error messages
Module 3 Connecting to Claude Code, Cursor, Copilot and agents
  • Configuring local stdio servers and remote servers in clients
  • Project-level and user-level configuration, approvals and permissions
  • Writing tool descriptions that models reliably select correctly
  • Integrating MCP servers into custom agents built with the Claude Agent SDK or OpenAI Agents SDK
Module 4 Transport, authorisation and operations
  • Streamable HTTP, session management and stateless servers
  • OAuth-based authorisation, token validation and integration with existing identity providers
  • Deploying as containers, on serverless platforms or behind a gateway
  • Logging, monitoring, rate limiting and versioning tool interfaces

Day 2

Module 5 Security and governance
  • Threats: prompt injection via tool results, tool poisoning, confused deputy
  • Least privilege, confirmation requirements and sandboxing
  • Reviewing and approving third-party servers within the organisation
  • Data protection, logging of personal data and requirements under GDPR and the EU AI Act
Module 6 Practice lab: PHP & Laravel/Symfony
  • Generating PHPUnit and Pest tests
  • Raising PHPStan levels step by step
  • Upgrades with Rector
  • Building Laravel and Symfony features
  • Understanding and untangling legacy code
  • Finding security vulnerabilities
Module 7 Data protection, quality & transfer to daily work
  • PHP applications frequently process customer data from shops and portals, so database dumps and logs containing personal data must never go into prompts unfiltered. Check new Composer packages for licence and vulnerabilities, keep credentials from .env files out of context and, as an agency, agree contractually whether client code may be processed by AI services.
  • Ground rules for safe AI use in your team
  • Checking results: facts, sources, tests and the four-eyes principle
  • Personal action plan for the next 30 days
  • Open questions, outlook and resources for further learning

Practical scenarios from your field

Generating PHPUnit and Pest tests

The agent writes unit and feature tests for controllers, services and models, uses factories and database transactions, and runs the tests iteratively until they pass consistently.

Raising PHPStan levels step by step

The AI works through static analysis findings systematically, adds type declarations, generics annotations and return types, and raises the analysis level in controlled steps without changing behaviour.

Upgrades with Rector

Rector rules are configured and run, remaining incompatibilities in PHP or framework upgrades are fixed by hand and deprecations surfaced in logs and tests are cleared systematically.

Building Laravel and Symfony features

From a functional description, the assistant creates migrations, Eloquent or Doctrine entities, form requests or validators, controllers, policies and tests – all in line with framework conventions.

Understanding and untangling legacy code

The assistant explains procedural legacy logic, extracts functions into namespaced classes and introduces Composer autoloading, laying the groundwork for further modernisation. Characterisation tests pin down the existing behaviour first.

Finding security vulnerabilities

The AI checks code for unsafe SQL queries, missing output escaping, CSRF gaps and insecure uploads, replacing problem areas with prepared statements and built-in framework mechanisms.

Possible hands-on projects

Laravel admin panel

A small management back end with authentication, roles, CRUD screens and feature tests, built by an AI agent from a short specification.

Symfony console importer

A Symfony console command that validates CSV or XML data, imports it into Doctrine entities and logs errors in a clear, readable way.

Upgrade readiness check

A script that runs PHPStan, a Rector dry run and Composer audit against a PHP project and produces a plain-language report on upgrade effort.

Prerequisites

Solid programming skills in TypeScript/JavaScript or Python and a basic understanding of HTTP APIs and JSON. Some experience using AI assistants in day-to-day development is helpful. Solid PHP skills and experience with Laravel or Symfony, Composer and Git.

Technical requirements

A laptop with Node.js or Python, Git and a code editor, plus access to at least one MCP-capable client such as Claude Code, Claude Desktop, Cursor or VS Code with Copilot.

Data protection & compliance

PHP applications frequently process customer data from shops and portals, so database dumps and logs containing personal data must never go into prompts unfiltered. Check new Composer packages for licence and vulnerabilities, keep credentials from .env files out of context and, as an agency, agree contractually whether client code may be processed by AI services.

Suggested dates

All dates are suggestions – your preferred date is always possible.

  • Tue, 24 November 2026 – Wed, 25 November 2026 Online Request
  • Thu, 3 December 2026 – Fri, 4 December 2026 Hanover Request
  • Tue, 15 December 2026 – Wed, 16 December 2026 Online Request
  • Thu, 21 January 2027 – Fri, 22 January 2027 Munich Request
  • Tue, 2 February 2027 – Wed, 3 February 2027 Online Request
  • Mon, 15 February 2027 – Tue, 16 February 2027 Stuttgart Request

Frequently asked questions

Why would I need my own MCP server?

Whenever AI assistants need access to internal systems such as ticketing tools, databases, documentation or line-of-business applications. Your own server defines precisely which actions and data are available and can then be reused across several clients. That avoids isolated one-off integrations and keeps access firmly under your control.

Which programming language does the course use?

You can choose between TypeScript and Python, both of which have official SDKs. The concepts are identical and all exercises are available in both versions. Developers working in other languages still benefit, because the protocol is language-agnostic and SDKs for other languages follow a similar structure.

How secure is MCP for enterprise use?

The protocol provides mechanisms for authorisation and permissions, but real-world security depends on implementation and operations. Risks such as prompt injection through tool results or over-privileged servers are genuine. We cover concrete countermeasures, approval processes for third-party servers and how to handle personal data.

Is AI-assisted coding worthwhile for old PHP code without a framework?

That is exactly where it shines. AI assistants explain convoluted procedural logic, write characterisation tests that pin down existing behaviour and then introduce namespaces, autoloading and types step by step. This gives you a safe foundation for modernising legacy applications instead of attempting a risky full rewrite.

How should agencies handle client code and AI?

Agencies should agree with their clients contractually whether, and with which services, source code may be processed. On the course we discuss options such as business licences with no training on your data, exclusion rules for sensitive files and documented review processes that give your clients full transparency.

How much does “Model Context Protocol (MCP) for PHP Developers” cost?

The course costs a flat €949 plus VAT per participant – whether online or on-site. This includes 2 training day(s) with a live trainer, course materials, a lab environment and a certificate of attendance.

Can I suggest my own date?

Yes. Our suggested dates are just a guide. In the request form you can always describe your preferred date or period in free text – we check availability and confirm within one working day.

Is the course online or on-site?

Both are possible: live online in a virtual classroom or on-site in Munich, Salzburg, Berlin, Augsburg, Hanover, Bremen, Stuttgart or Kaiserslautern. We can also run the course exclusively for your team.

More courses for PHP Developers

More Model Context Protocol (MCP) courses

All 29 Model Context Protocol (MCP) courses

Model Context Protocol (MCP) · MunichModel Context Protocol (MCP) · SalzburgModel Context Protocol (MCP) · BerlinModel Context Protocol (MCP) · AugsburgModel Context Protocol (MCP) · HanoverModel Context Protocol (MCP) · BremenModel Context Protocol (MCP) · StuttgartModel Context Protocol (MCP) · KaiserslauternModel Context Protocol (MCP) · Online