The AI Suite MCP comes with three console commands.

The command issues a token directly, bypassing the OAuth flow. This is useful for testing and automated environments, but it does not belong in regular operation. For everyday use, the MCP dashboard in the AI Suite backend module is the right way.

--user takes the UID or username. Without --scopes, the token receives all scopes the user is entitled to. The validity is determined by mcpTokenLifetimeDays.

The command removes:

• Authorization codes older than 10 minutes
• Access tokens older than the token lifetime plus 7 days buffer, so with the default values, 37 days
• Revoked tokens older than 30 days. They will be permanently deleted from tx_aisuite_oauth_tokens to comply with the right to deletion. Until then, they remain as soft-deletes so that the reuse of a rotated refresh token can still be recognized as theft. After that, the signal is worthless anyway.
• Session files under var/aisuite_mcp_sessions/ that are older than 7 days
• Task files under var/mcp_tasks/ that are older than 30 days

In production, the command should run at least hourly, via TYPO3 Scheduler or system cron. If it does not run, the table of authorization codes grows indefinitely, the directories for sessions and tasks fill up, and expired tokens accumulate. On installations with many concurrent users, it is worth taking a look at the row count in tx_aisuite_oauth_tokens. If it grows faster than it is cleaned up, a smaller value for mcpTokenLifetimeDays helps.