• CRITICAL
  • REFACTOR
  • AUDIT
  • HUMAN

How to secure Laravel mass assignment with your AI

Connect this MCP to your AI client once. From then on, your agent checks your controllers and models for mass assignment risks.

Ask AI about this page

Short answer

How do I stop mass assignment vulnerabilities using AI?

Your AI scans your existing code to find where raw request data is being passed directly into model methods. It then suggests specific FormRequests or attribute whitelists to lock down your models. You'll get a list of exact code changes to fix these holes.

Where every issue lands.

Security outcomes

The AI categorizes every finding based on how much risk it poses to your application.

CRITICAL

Direct mass assignment

The AI finds instances where `request()->all()` or `request()->only()` hits a model without protection. You get the exact line numbers to fix.

REFACTOR

Missing FormRequests

The agent identifies controllers that should be using dedicated FormRequest classes. It provides the structure for the new request files.

AUDIT

Model attribute checks

The AI reviews your `$fillable` and `$guarded` arrays. It flags missing attributes that should be protected from user input.

HUMAN

Manual code review

The AI flags complex logic that it can't safely automate. You decide if the suggested refactor fits your specific architecture.

The workflow

What your AI does when the code arrives.

The AI acts as a security auditor that lives inside your development environment.

  1. Scan codebase

    Your agent reads your controllers and models to map how data flows from a request to your database.

    validate_laravel_excellence

  2. Identify leaks

    The AI flags any code where unvalidated input reaches a model's create or update methods.

    validate_laravel_excellence

  3. Generate fixes

    It writes the code for new FormRequests or updates your model's fillable properties to close the gap.

    validate_laravel_excellence

  4. Verify compliance

    The agent runs a final check to ensure the new code follows Laravel best practices for mass assignment.

    validate_laravel_excellence

Try it

Copy these to start.

Use these prompts to kick off a security audit of your Laravel app.

Starting points

Swap out the file paths or directory names for your actual project structure.

Laravel Excellence Prover Connector

You're all set. Choose your MCP client and follow the setup instructions.

Connector linkhttps://edge.vinkius.com/vk_preview_xVT6WxKnn5P5RXCAVRvEGptio7bgnTnovi5pfdfY/mcp

Claude Desktop

Follow the steps below to connect in seconds.

  1. 1In Claude Desktop, open Settings → Connectors.
  2. 2Click “Add custom connector” and paste the connector link above as the remote MCP server URL.
  3. 3Click Add and start a new chat — Laravel Excellence Prover capabilities are ready to use.
Configuration · claude_desktop_config.jsonCopy
{
  "mcpServers": {
    "laravel-excellence-prover-mcp": {
      "url": "https://edge.vinkius.com/vk_preview_xVT6WxKnn5P5RXCAVRvEGptio7bgnTnovi5pfdfY/mcp"
    }
  }
}
Copy into chat04

  • Scan my app/Http/Controllers directory for mass assignment vulnerabilities.

  • Check my User model to see if the $fillable array is missing any critical fields.

  • Find all controllers using request()->all() and suggest FormRequests for them.

  • Audit my database migrations against my models to find fillable mismatches.

  • Claude
  • ChatGPT
  • Cursor
  • VS Code
  • Windsurf
  • Claude Code
  • JetBrains
  • Cline

Start here

Connect Laravel Excellence Prover once, then ask.

One connection link is all you need. Your credentials stay encrypted, and you can start auditing code immediately in your preferred IDE or chat client.

Connect Laravel Excellence Prover to your AI

FAQ

Common questions

  • 01

    Can the AI automatically rewrite my files?

    No. The AI suggests the code changes, but you must review and apply them to your files yourself.

  • 02

    Does it scan my entire database?

    No. It only scans the PHP code in your controllers, models, and request classes.

  • 03

    Will it break my existing logic?

    The AI only identifies vulnerabilities. It doesn't touch your running application or change your database schema.

  • 04

    Can it create new files?

    The AI generates the code for new FormRequests, but you are responsible for saving those files to your disk.

  • 05

    Does it work with non-Laravel projects?

    No. This MCP is specifically built for Laravel security patterns.

  • More questions about Laravel Excellence Prover? The Connector page answers them. See everything the Laravel Excellence Prover Connector can do

Connect Laravel Excellence Prover to Claude, Cursor, ChatGPT & more