Joomla MCP server: connecting Joomla to ChatGPT and Claude
Joomla can be connected to ChatGPT or Claude today, and it is connected with a Joomla API token rather than a password. What an assistant can then do is decided by two things most guides leave out: which of Joomla's own web services plugins are switched on, and the fact that Joomla's core API does not expose an article's browser page title at all. Everything below came out of Joomla's own source code, and the capability lists further down are printed from our Joomla adapter rather than typed.
·
Joomla has had a Web Services API in core since Joomla 4, and it is better than its reputation. The reason people conclude otherwise is that the useful parts of it depend on plugins, and the error from a plugin that is switched off looks exactly like the error from a token that is wrong.
How the connection is made
There is no password involved anywhere. Joomla issues an API token against one user account, and that account's own permissions become the limit of what anything holding the token can do — so the right move is to make an account for the job rather than using your own.
- In the Joomla administrator, go to Users → Manage and edit the account the assistant should act as.
- Open its Joomla API Token tab and generate a token. Joomla shows it once.
- Under System → Plugins, make sure Web Services - Content and API Authentication - Web Services Joomla Token are both enabled. Without the second one, every request is refused before Joomla ever looks at your token.
- Paste the token in. Nothing is installed on your site for the basic connection.
One trap worth writing down, because it cost us an afternoon. Joomla's web services plugins ship enabled — the redirect routes at `/api/index.php/v1/redirects` are there on a stock Joomla 4.4 with nothing of ours installed, and the claim in our own notes that Joomla registered no such routes was simply wrong. But `plg_system_redirect`, the plugin that actually *performs* a redirect and collects the 404s, ships switched off. So redirect records can be created through the API on a stock site and not one of them will redirect a visitor. Our adapter claims no redirect support on Joomla at all, which is why that row is grey below.
What an assistant can do with a connected Joomla site
These two lists are printed from the Joomla adapter when this page loads, so they are what the software will attempt rather than what a brochure would like to say.
What Joomla lets us ask for
-
Read content
-
Create content
-
Edit content
-
Publish content
-
Schedule content
-
Manage images and files
-
Manage categories and tags
-
Edit SEO information
-
Manage menus
-
Site information
-
Administrative information
What Joomla has no way to do
-
Custom content types
-
Bulk changes
-
Manage redirects
Both lists are generated from that platform's adapter when the page loads, so they are what the software will attempt rather than what we would like to say. Bulk work is the one row that is empty for every platform: no adapter claims it yet, and the automation page says so too.
Three things we found by reading Joomla's own source
The capability notes in this project were wrong about Joomla twice, and both corrections came from the code rather than the documentation. That is the whole argument for doing it this way round.
- Redirects are reachable through the API, and have been since Joomla 4.0. The redirect web services plugin registers full create, read, update and delete routes. What stops them working is the system plugin above, not the API.
- Joomla's version is readable, but only by an account that may see every installed extension. `v1/extensions` renders the `files_joomla` row, and its version is Joomla's own. It needs `core.manage` on the installer component, which is more than a content account normally has — so "Joomla cannot report its own version" was too strong, and "any account can read it" would be too generous.
- What has an update waiting is not readable at all on Joomla 4.4, or on 5.0 to 5.3. The installer's web services plugin registers `v1/extensions` and nothing else. A route for core updates arrived in Joomla 5.4, and even that one covers Joomla itself rather than your extensions.
The browser page title, which is not in the API
An article's browser page title lives in Joomla's `attribs` field, and `attribs` is not in the content component's API view — not in the list fields, not in the item fields. So it is neither readable nor writable through core Joomla, and a request that sent `attribs` whole would wipe every other display setting on that article. This is the sort of gap that makes a bulk SEO change dangerous rather than useful: software that cannot read a field has no way to tell "this one is empty" from "I cannot see this one", and the difference is whether it overwrites work somebody already did. Ours refuses a bulk job whose pattern targets a field it cannot read, which is a refusal we would rather make than explain afterwards.
The four gaps, and the extension that is written but not released
Four things are missing from Joomla's core API however it is configured: a way to prove you own the site, the browser page title, what has an update waiting, and the site's own counts in a single read. We have written three small extensions that answer exactly those four — a meta tag in the page head, one key merged into the display settings rather than the whole field replaced, and two read-only endpoints — and they are not released yet. The Joomla product page tells you that nothing of ours goes onto your Joomla site, and today that is the truth: the connection described above works through Joomla's own API and installs nothing. When the extension is released, that page will say so, and so will this paragraph. Everything that Joomla core can already do stays on Joomla core, because something that works without an install is not a reason to ask anybody to install software.
Honest limit: a green cell above means our Joomla adapter will attempt that job. Whether it has been watched working on a live Joomla site is a separate claim, recorded per capability with the date, and 9 of the 11 platforms have reached that point so far. Joomla's own page says which of its capabilities are in which state rather than leaving it to a sentence here.
Questions we get asked about this
- Do I have to install anything on my Joomla site?
- No. Joomla's own Web Services API does the work and you only make sure two plugins are on. We have written three small extensions for the four things Joomla has no API for, but they are not released, so right now nothing of ours goes onto your Joomla site.
- Which versions of Joomla does this work with?
- Joomla 4.4 and later. The floor is a method the API views need that arrived in 4.4. Joomla 5 and 6 also want MySQL 8, which rules them out on some shared hosting — including ours, which is why 4.4 is the version we can test against.
- Can an assistant publish an article without me?
- Only if you tick the publishing permission when you connect it, and that box starts unticked and cannot be ticked by the assistant. With it off, an assistant can write and change drafts and cannot change anything a visitor sees.