feat: add MCP server for the website chatbot over a mirrored TYPO3 content feed

config/packages/security.yaml

@@ -15,6 +15,11 @@ security:
                     mailjet:
                         password: '%env(MAILJET_WEBHOOK_BASIC_PASSWORD)%'
                         roles: [ ROLE_MAILJET_WEBHOOK ]
+        mcp_provider:
+            memory:
+                users:
+                    n8n:
+                        roles: [ ROLE_CHATBOT_MCP ]
 
     role_hierarchy:
         # ROLE_CUSTOMER_EXPERT gates the booking-draft and log surfaces, which used to be
@@ -45,6 +50,12 @@ security:
             provider: mailjet_webhook_provider
             http_basic:
                 realm: 'Mailjet Webhook'
+        mcp:
+            pattern: ^/mcp$
+            stateless: true
+            provider: mcp_provider
+            access_token:
+                token_handler: App\Security\McpAccessTokenHandler
         main:
             lazy: true
             provider: app_user_provider
@@ -58,6 +69,7 @@ security:
     # Note: Only the *first* access control that matches will be used
     access_control:
         - { path: ^/webhooks/mailjet/newsletter$, roles: ROLE_MAILJET_WEBHOOK, requires_channel: https }
+        - { path: ^/mcp$, roles: ROLE_CHATBOT_MCP, requires_channel: https }
         - { path: ^/authorize, roles: IS_AUTHENTICATED_REMEMBERED, requires_channel: https }
         - { path: ^/, roles: PUBLIC_ACCESS, requires_channel: https }