Most AI coding assistants write Laravel the way it was written three years ago. They reach for $request->validate() patterns from old blog posts, invent Eloquent methods that never shipped, register routes in files your application does not use, and confidently guess at package APIs. The problem is not the model — it is that the model cannot see your application. It does not know your Laravel version, which packages you installed, what your database schema looks like, or what your config/queue.php actually says.
Laravel Boost fixes that. It is a first-party package that runs an MCP (Model Context Protocol) server inside your own application and exposes it to whichever agent you use — Claude Code, Cursor, Copilot, Codex, Windsurf, PhpStorm's assistant and others. This tutorial installs it, walks through the tools it provides, and covers the conventions we put around it on client projects so that AI-assisted work stays reviewable.
What Boost actually adds
Three things, and it is worth separating them:
- MCP tools that let the agent query the running application: list routes, inspect the database schema, read config values, tail the log, run Tinker, read the last browser errors.
- Version-aware documentation search across the Laravel ecosystem, scoped to the exact versions in your
composer.json. Ask about queues on a Laravel 11 app and you get Laravel 11 documentation, not Laravel 13. - Generated guidelines — a composed set of instructions written into your repository describing how code should be written in this project, assembled from the packages Boost detects.
One and two stop hallucination. Three stops style drift, which on a long engagement is the more expensive of the two.
Install
Boost is a dev dependency. It should never be in production.
composer require laravel/boost --dev
php artisan boost:install
The installer detects your editors and agents, asks which ones to configure, and asks whether to install the guidelines. It writes MCP server configuration into the right place per tool — .mcp.json for Claude Code, .cursor/mcp.json for Cursor, and so on — plus a guidelines file such as CLAUDE.md, AGENTS.md or .github/copilot-instructions.md.
Requirements are modest: PHP 8.1+ and Laravel 10, 11, 12 or 13. Boost works on Herd, Sail, Valet and plain artisan serve.
Verify the server starts:
php artisan boost:mcp
It speaks MCP over stdio, so it will sit there waiting for input. Ctrl-C out; the agent is what drives it.
The tools, and when each one earns its keep
Once connected, the agent can call:
application-info— Laravel version, PHP version, installed packages and their versions, Eloquent models. This is the single most valuable call. It is why the agent stops suggestingRoute::resourcein an API-only app that uses route attributes.search-docs— semantic search over versioned ecosystem documentation: Laravel, Inertia, Livewire, Filament, Pest, Pennant, Nightwatch and more. Boost queries a hosted index scoped to your versions.database-schema/database-query— real tables, real columns, real indexes. Read-only queries by default; keep it that way.tinker— executes PHP inside your application context. Extremely useful for "does this relationship actually return what I think" and extremely dangerous pointed at anything but local.list-routes,get-config,read-log-entries,last-error— the four calls that turn "why is this 500ing" from a guessing game into a lookup.browser-logs— recent console output from the browser, which closes the loop on Livewire and Inertia work.
A good prompt now looks like: "Read the application info and the orders table schema, then add a POST /api/orders/{order}/refund endpoint following the conventions already used in app/Http/Controllers/Api." The agent has no reason to invent anything.
Guidelines: the part teams skip and regret
php artisan boost:install composes guidelines from the packages it finds — Pest versus PHPUnit, Livewire versus Inertia, Filament version, Pennant, Fortify — so the instructions match the stack rather than generic Laravel advice. Re-run the installer after adding a significant package so the guidelines stay current.
Project-specific rules belong in .ai/guidelines/*.blade.php, which Boost merges into the generated file. Keep them short, imperative and testable:
{{-- .ai/guidelines/project.blade.php --}}
- All money values are integer minor units. Never use floats for currency.
- Write feature tests with Pest. One assertion focus per test; no `assertTrue(true)` filler.
- Controllers stay thin: validation in Form Requests, logic in actions under `app/Actions`.
- Never edit files in `database/migrations` that are already deployed. Add a new migration.
- Queue jobs must be idempotent and must not accept full Eloquent models as constructor arguments.
Commit both the generated file and .ai/guidelines. Reviewers should be able to see, in the diff, which rules the agent was working under.
Guardrails we insist on
Boost hands a model a live connection to your application. Treat it with the same seriousness as a database console.
- Local only.
--devin Composer, and assert it: add a check that throws ifboost:mcpruns whileapp()->environment('production'). - Point it at seeded data, never a production dump. If you must debug production-shaped data, restore an anonymised copy first.
- Read-only database access. Give your local user SELECT-only credentials for the MCP path if your tooling allows it; the small friction is worth it.
- Tinker is a review surface. Any change an agent makes after a
tinkercall deserves a closer read than usual. - Tests are still yours. Boost makes agents better at producing plausible code. Plausible is not correct. A Pest feature test written by a human against the acceptance criteria remains the thing that decides whether the work shipped.
Fitting it into CI
Nothing about Boost belongs in CI, but AI-assisted code changes the emphasis of what CI should catch. We tighten three things on projects where agents contribute:
./vendor/bin/pint --test
./vendor/bin/phpstan analyse --level=6
./vendor/bin/pest --coverage --min=70
Static analysis in particular earns its cost here: it catches the invented method signature and the nullable that was never handled long before review does. Add Laravel's Model::preventLazyLoading() and preventSilentlyDiscardingAttributes() in a local service provider too, so sloppy generated Eloquent fails loudly in development rather than quietly in production.
Where this leaves the developer
Boost does not make an agent a Laravel developer. It removes the class of errors caused by the agent working blind, which is most of the annoying ones. What remains — architecture, data modelling, knowing which requirement is actually wrong, deciding what not to build — was always the part worth paying for.
If you are rolling AI-assisted development across a Laravel team and want the conventions, guidelines and review process set up so the output survives contact with production, get in touch. We do this on client codebases every week.