devLap

Laravel Boost v2: A Practical Agentic Development Workflow

php dev.to

Laravel Boost v2: A Practical Agentic Development Workflow

If you have ever watched an AI agent confidently generate a Livewire v2 component on a project running Livewire v4, you already understand the problem Laravel Boost solves. Without project-specific context, AI agents default to whatever their training data said was "correct" — which is rarely your stack, your conventions, or your current package versions.

Laravel Boost is the official Laravel MCP (Model Context Protocol) server, released in public beta at Laracon US 2025 and updated to v2.0 on January 26, 2026. It gives AI agents — Claude Code, Cursor, Windsurf, Copilot, and Codex CLI — live, structured access to your running Laravel application: its schema, its logs, its routes, its documentation, and its code conventions. This article walks through the v2 workflow end-to-end, with practical commands, real tradeoffs, and the exact mistakes to avoid.

For a broader overview of the ecosystem (Laravel AI SDK, LarAgent, Prism PHP), see the parent guide: Laravel Boost and AI Skills: Agentic Development for Laravel.

Prerequisites and Version Requirements

Before installing, confirm your environment meets these requirements:

  • Laravel: 10, 11, 12, or 13
  • PHP: 8.1 or higher (for Boost itself)
  • AI agent/IDE: must support MCP — Claude Code, Cursor, Windsurf, GitHub Copilot (Workspace), or Codex CLI
  • Composer: 2.x
  • Laravel Boost: v2.4.0+ recommended (adds security audit on skill install)

Important: Laravel Boost is a --dev dependency only. It exposes Tinker (arbitrary PHP execution) and direct database query tools. Never install it in a production environment or expose its MCP server to an untrusted network.

Step 1 — Install Laravel Boost

Installation is a two-command process:

composer require laravel/boost --dev
php artisan boost:install
Enter fullscreen mode Exit fullscreen mode

boost:install does three things:

  1. Publishes a boost/ directory to your project root containing guidelines/ files
  2. Detects packages in your composer.json and auto-installs matching skills
  3. Registers the MCP server configuration for your agent IDE

After install, your AI agent has access to these built-in MCP tools:

Tool What the agent can do
application-info Read PHP/Laravel version, installed packages, Eloquent models
browser-logs Access browser console errors and logs
database-connections List configured DB connections
database-query Execute SQL queries against your app database
database-schema Inspect table structure and column types
get-absolute-url Resolve named routes to full URLs
last-error Read the most recent application error
read-log-entries Parse laravel.log in PSR-3 and JSON formats
search-docs Search 17,000+ pieces of versioned Laravel ecosystem documentation

v2.3.0 breaking change: Six thin MCP tool wrappers were removed — list-artisan-commands, list-routes, tinker, get-config, list-available-env-vars, and list-available-config-keys. If your agent workflows referenced these tool names, update them to use CLI equivalents (php artisan list, php artisan route:list, php artisan config:show).

Step 2 — Understanding Guidelines vs Skills

Laravel Boost v2 separates context into two types:

Guidelines are loaded every agent session. They hold your core project conventions — authentication patterns, naming rules, preferred packages, coding style. Think of them as the project README that every agent reads before touching a file. Guidelines live in boost/guidelines/.

Skills are loaded on-demand for specific tasks. A skill contains deep knowledge about a particular domain — Livewire component patterns, Pest testing conventions, Inertia.js integration rules. Skills are not loaded unless the agent needs them, which keeps context windows lean and token costs low.

The most common mistake here is putting everything into guidelines. A 5,000-token guideline file loaded on every session bloats context for tasks that never touch the relevant technology. If you are building a Livewire-heavy feature, load the Livewire skill. For a routine migration, skip it.

Step 3 — Installing Skills

When boost:install runs, it scans your composer.json and auto-installs matching skills. If Livewire is detected, the Livewire skill installs automatically. The same applies to Pest, Inertia, Tailwind, and other supported packages.

To add skills manually:

# Install from the official Laravel Skills directory (skills.laravel.cloud)
php artisan boost:add-skill laravel/livewire-skill

# Install from any GitHub repository
php artisan boost:add-skill https://github.com/owner/repo

# Short form also works
php artisan boost:add-skill owner/repo
Enter fullscreen mode Exit fullscreen mode

As of v2.4.0, boost:add-skill runs a security audit on the fetched skill before installation. This scans skill contents for anything that modifies code generation conventions in unexpected ways — always review the audit output before confirming installation of community skills.

The Laravel Skills directory at skills.laravel.cloud contains 100+ official and community skills. Community skills vary in quality — read the skill's source before installing, especially for skills that override default Artisan stub patterns.

Step 4 — A Real Agentic Workflow

Here is what agentic development with Boost looks like in practice, using a feature branch as an example.

Scenario: You need to add a document_uploads table with an embedding column for semantic search, wire up a Livewire upload component, and write Pest tests.

4-A — Agent inspects the schema before writing a migration

Without Boost, an agent would guess at your existing table names and column conventions. With Boost, it calls database-schema to read your current structure, then generates a migration that fits:

# The agent calls this MCP tool internally — you do not run it manually
# database-schema → returns column types, indexes, foreign keys for all tables
Enter fullscreen mode Exit fullscreen mode

The agent sees you are on PostgreSQL and that other timestamp columns use timestamptz. It writes the migration accordingly:

// database/migrations/2026_08_01_000000_create_document_uploads_table.php
return new class extends Migration {
    public function up(): void
    {
        Schema::ensureVectorExtensionExists(); // enables pgvector
        Schema::create('document_uploads', function (Blueprint $table) {
            $table->id();
            $table->foreignId('user_id')->constrained()->cascadeOnDelete();
            $table->string('filename');
            $table->text('body')->nullable();
            $table->vector('embedding', 1536); // OpenAI ada-002 dimensions
            $table->timestampsTz();
        });
    }
};
Enter fullscreen mode Exit fullscreen mode

Database requirement: vector column type and whereVectorSimilarTo require PostgreSQL with the pgvector extension. This does not work on MySQL or SQLite. If your project runs MySQL, the embedding column must live in a separate PostgreSQL service or a dedicated vector store.

4-B — Agent checks the last error after a test run fails

You run php artisan test and a test fails. Instead of reading the log yourself, the agent calls last-error and read-log-entries. In v2.3.0, Boost added JSON log format auto-detection, so structured logs from Monolog JsonFormatter, LogstashFormatter, and LogglyFormatter are parsed cleanly:

# Agent calls read-log-entries — returns parsed log entries with level, message, context
# No manual log-reading needed
Enter fullscreen mode Exit fullscreen mode

4-C — Agent generates the Livewire component with the Livewire skill active

With the Livewire skill loaded, the agent generates Livewire v3/v4 syntax — wire directives, #[On] attributes, $wire bindings — rather than defaulting to v2 patterns from training data.

Without the skill: the agent generates @wire and $emit() (Livewire v2).
With the skill: the agent generates wire:model, dispatch(), and proper lifecycle hooks.

4-D — Agent resolves a named route

The agent needs the absolute URL for a redirect. It calls get-absolute-url with the route name and receives the fully resolved URL including the APP_URL prefix — no guessing at the domain.

Step 5 — Testing and Verification

Verify the Boost MCP server is running and accessible from your IDE:

# Check that Boost registered correctly
php artisan boost:status

# Confirm available tools (output lists all registered MCP tools)
php artisan boost:list-tools
Enter fullscreen mode Exit fullscreen mode

For each generated migration, run a dry migration against a test database before committing:

php artisan migrate --database=testing --pretend
Enter fullscreen mode Exit fullscreen mode

For Pest tests generated by the agent:

php artisan test --filter=DocumentUploadTest
Enter fullscreen mode Exit fullscreen mode

If the agent used database-query to inspect data during development, audit the query log:

# Check that agents only ran SELECT statements — not mutations
grep -i 'INSERT\|UPDATE\|DELETE' storage/logs/laravel.log
Enter fullscreen mode Exit fullscreen mode

Common Mistakes and Limitations

Installing Boost in production. The database-query tool allows arbitrary SQL execution against your application database. This is a development tool only — it must never be reachable from a production server or an untrusted network.

Running boost:add-skill before boost:install. Skills extend the guidelines infrastructure that boost:install creates. If you run add-skill first, the skill has no context framework to attach to. Always install Boost before adding skills.

Expecting MCP support from all IDEs. Boost requires your IDE or agent to implement the Model Context Protocol. Plain ChatGPT, standard VS Code Copilot (non-Workspace), and most older agent setups do not support MCP and will not benefit from Boost.

Using Guidelines for everything. If your boost/guidelines/ folder grows beyond 3,000–4,000 tokens of content, you are loading too much on every session. Move domain-specific rules (Livewire conventions, Pest test patterns) into skills.

Assuming the v2.3.0 removed tools still work. The six removed MCP tools (list-artisan-commands, list-routes, tinker, get-config, list-available-env-vars, list-available-config-keys) no longer exist in Boost. Agent workflows or automation scripts that called these by name will silently fail. Use direct Artisan CLI commands instead.

Tradeoffs Worth Knowing

Boost MCP tools vs plain CLI access. Boost gives agents structured, typed output from tools like database-schema and last-error. Plain CLI via shell gives more power but less structure — agents receive raw text and must parse it. Boost v2.3.0 removed the thin wrappers and now points agents to use CLI for the removed six commands, which means your agent IDE needs shell-execution capability for those specific features.

Skills vs dedicated prompt engineering. Skills are effective when your project uses a package with well-defined conventions (Livewire, Pest, Inertia). For highly custom internal systems, you will still need to write custom guidelines — skills from the public directory will not know your bespoke service architecture.

Single-agent vs multi-agent. Boost is optimised for a single AI agent making contextual decisions. Multi-agent workflows (as described in the official Laravel blog) introduce prompt injection risks at the boundary between agents — always validate and sanitize data passed between agents before acting on it.

Frequently Asked Questions

Does Laravel Boost work with any AI assistant?

Laravel Boost requires an AI agent or IDE that supports the Model Context Protocol (MCP). Supported clients include Claude Code, Cursor, Windsurf, GitHub Copilot Workspace, and Codex CLI. Standard ChatGPT, plain VS Code extensions, and other agents without MCP support cannot connect to the Boost server.

Is Laravel Boost safe to use with real application data?

Laravel Boost is a development-only tool and must only connect to development or staging databases. The database-query MCP tool executes arbitrary SQL and the last-error tool exposes application internals. Configure it exclusively with non-production credentials and isolated databases. Laravel Boost v2.4.0 added a security audit to the skill installation flow, but that audit covers skill code, not database access permissions.

What is the difference between a Boost Guideline and a Boost Skill?

Guidelines are loaded at the start of every agent session and contain core project conventions that apply to all tasks — authentication patterns, naming conventions, and project-wide rules. Skills are loaded on-demand for specific domain tasks, such as generating Livewire components or writing Pest tests. Using skills for domain knowledge instead of guidelines reduces token usage per session and keeps the agent context focused on the current task.

Can I write my own custom Boost skill?

Yes. A Boost skill is a structured directory with Markdown context files that follow the Boost schema. You can create a private skill for your internal libraries, domain-specific patterns, or custom Artisan commands, and install it with php artisan boost:add-skill path/to/local-skill or from a private GitHub repository. The Laravel Skills directory at skills.laravel.cloud also accepts community submissions.

Does the Laravel AI SDK require Laravel Boost?

No. Laravel Boost (MCP server for development-time AI agents) and the Laravel AI SDK (laravel/ai, for runtime AI features in production applications) are independent packages that serve different purposes. Laravel Boost helps AI agents write better Laravel code during development. The Laravel AI SDK adds Agent classes, tool-calling, RAG, and provider integrations to your production application. Note that the Laravel AI SDK requires PHP 8.4, while Boost itself works on PHP 8.1+.

If you need Laravel development in Mumbai, Mumbai Web Designer builds production-grade Laravel applications.

Source: dev.to

arrow_back Back to Tutorials