CLI Commands

The command issues a token directly and thus bypasses the OAuth flow. This is practical for tests and automated environments, but does not belong in regular operation. For everyday use, the backend module “AI Suite” under “MCP” (in a narrow view via “More”) is the right way.

--user takes the UID or the username, without a value UID 1 applies. --client sets the client ID (default mcp-inspector). Without --scopes, the token receives all scopes the user is authorized for. The validity is determined by mcpTokenLifetimeDays.

--workspace=<uid> binds the token to a workspace. --audience sets the canonical resource URI if the CLI host differs from the public URL.

vendor/bin/typo3 ai-suite-mcp:create-token --user=1 --workspace=3
vendor/bin/typo3 ai-suite-mcp:create-token --user=1 --audience="<canonical resource URI>"

The command removes:

• authorization codes older than 10 minutes
• access tokens that expired more than 37 days ago (fixed value, independent of mcpTokenLifetimeDays)
• revoked tokens older than 30 days. They are permanently deleted from tx_aisuite_oauth_tokens to comply with the right to erasure. Until then, they remain as soft deletes, so that the reuse of a rotated refresh token can still be detected as theft. After that, the signal is worthless anyway.
• session files under var/aisuite_mcp_sessions/ older than twice mcpSessionTimeoutSeconds, but at least one hour (so one hour with the default value)
• task files under var/mcp_tasks/ older than 30 days

In production, the command should run at least hourly, via the scheduler or via system cron. If it does not run, the table of authorization codes grows without limit, the directories for sessions and tasks fill up, and expired tokens pile up. On installations with many concurrent users, it is worth looking at the row count in tx_aisuite_oauth_tokens. If it grows faster than it is cleaned up, a smaller value for mcpTokenLifetimeDays helps.