Setup and Accounts

AI access should be configured like normal system access: install the required packages, choose an authentication model, and assign permissions explicitly.

Required Packages

Install the MCP server package in the QUIQQER installation:

./console composer require quiqqer/ai-mcp

quiqqer/ai-mcp depends on the REST and OAuth packages used for authenticated access. QUIQQER's Composer integration runs the required setup steps during the package operation.

After installation, verify that the package is installed:

./console package --show=quiqqer/ai-mcp

The MCP endpoint is available below the installation host:

https://www.example.com/mcp

quiqqer/ai-mcp installs a compatible quiqqer/oauth-server dependency. Automatic OAuth clients also require Dynamic client registration in the OAuth settings. The setting is enabled by default in current versions.

Authentication Models

Use interactive OAuth authorization when a person connects a local MCP client such as Codex. The user logs in to QUIQQER, reviews the available MCP functions, and grants access. The client obtains and refreshes its tokens automatically; no API token has to be copied into the client configuration.

Use a manually created API token for unattended automation or clients that do not support OAuth discovery and authorization-code flows.

In both models, MCP actions run with the permissions of the associated QUIQQER user:

• With interactive OAuth, this is the user who approves the consent request.
• With an API token, this is the owner of that token.

AI User Accounts

Create separate QUIQQER users for unattended AI clients and agents. For an interactive OAuth connection, use a normal account with only the permissions required for the intended MCP work. Avoid administrator or superuser accounts unless the workflow explicitly requires those privileges.

Recommended account model:

Account	Use
ai-content-editor	Can read and edit selected project content.
ai-media-assistant	Can upload or update media where needed.
ai-maintenance	Can run selected maintenance tools such as cache clearing.

Use groups to keep permission assignment repeatable. If multiple AI clients need different rights, create separate groups and separate tokens.

API Tokens

API tokens are created for a QUIQQER user. They work like personal access tokens and are used as bearer tokens when connecting to the MCP endpoint. This section is only required for manual token configuration; OAuth-capable clients obtain their tokens through the browser flow.

In the administration interface:

1. Open the user that should own the token.
2. Open the API tokens tab.
3. Create a token with a clear title, for example Codex local workstation or Claude content review.
4. Store the token securely. Do not paste it into public documentation, chats, or tickets.

If users manage their own profile and the OAuth token profile view is enabled, they can also create and delete their own API tokens from their profile.

Permissions

Grant permissions to the AI user or its group. MCP access is not enabled by the token alone.

Core MCP permissions:

Permission	Use
Can use the core MCP tools (quiqqer.core.mcp.canUse)	Allows use of the core MCP tools.
Can clear the QUIQQER cache via MCP (quiqqer.core.mcp.clearCache)	Allows cache clearing through MCP. Grant only to maintenance accounts.

Bricks MCP permission:

Permission	Use
Can edit bricks via MCP (quiqqer.bricks.mcp)	Allows use of the Bricks MCP tools when quiqqer/bricks is installed.

The user still needs the normal QUIQQER permissions for the target action. For example, a user that updates a site through MCP also needs the relevant project and site edit permissions.

Activation Checklist

Before connecting an AI client:

• quiqqer/ai-mcp is installed.
• For automatic OAuth, dynamic client registration is enabled.
• The QUIQQER user exists and is not a shared administrator account.
• For manual authentication, the user has an API token.
• The AI user has Can use the core MCP tools (quiqqer.core.mcp.canUse) when core tools should be available.
• Optional maintenance rights such as Can clear the QUIQQER cache via MCP (quiqqer.core.mcp.clearCache) are only enabled when required.
• Package-specific MCP permissions are enabled only for packages the AI should use.
• Project, site, media, and module permissions match the intended workflow.
• The target project and language are known.