MCP server of LUXenterprise 

Prerequisites 

You need to enable the MCP server in the backend settings first. See For Administrators.

1. Create an api key 

Every backend user has its own api key in the backend user record(field "Lux MCP Server API Key").

A MCP client acts with the permissions of the backend user of the api key, so the data of the tools is restricted in the same way as in the LUX backend modules. Deleting the api key of a backend user (or disabling the user) revokes the access immediately.

2. Connect a client 

Example for a registration in Claude Code:

claude mcp add --transport http luxenterprise https://your-domain.org/typo3/mcp/lux \
  --header "Api-Key: <apikey>"

Example for a configuration file of a MCP client:

{
  "mcpServers": {
    "luxenterprise": {
      "type": "http",
      "url": "https://your-domain.org/typo3/mcp/lux",
      "headers": {
        "Api-Key": "<apikey>"
      }
    }
  }
}

A quick check on command line:

curl -X POST https://your-domain.org/typo3/mcp/lux \
  -H 'Content-Type: application/json' \
  -H 'Api-Key: <apikey>' \
  -d '{"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2025-06-18","capabilities":{},"clientInfo":{"name":"curl","version":"1.0"}}}'

The server uses the streamable HTTP transport of MCP (POST requests with json-rpc messages) and expects the api key in one of these headers:

Authorization: Bearer <apikey>
Api-Key: <apikey>

The Api-Key header is a fallback for webserver configurations that do not pass the authorization header to php (e.g. apache with mod_proxy_fcgi without CGIPassAuth On).

Activate the MCP server 

The endpoint of the server is /typo3/mcp/lux. It is located in the backend context, because the tools of LUXenterprise need a backend user to decide which visitors and pages can be read.

Rate limiting 

The rate limit can be configured with $GLOBALS['TYPO3_CONF_VARS']['SYS']['rateLimiter']['luxenterprise-mcp'] (keys limit and interval). A successful authentication resets the limit, so only failing requests are counted.

Error responses