We are pleased to announce the release of n98-magerun2 v9.4.0 (Codename Paris). This release brings a new mageforge:install command for streamlined Hyvä setups, expanded control over MCP tool exposure, and a broad round of security hardening across several core areas. Mage-OS 2.1.0 and 2.2.0 are now part of the installer and test matrix as well.

What’s New?

New Command: mageforge:install

MageForge is a CLI tool for scaffolding and managing Hyvä-based Magento 2 projects. With the new mageforge:install command, you can install MageForge directly from within n98-magerun2 — including an optional post-install compatibility check to verify that your environment is properly set up.

n98-magerun2.phar mageforge:install

Note: MageForge is added as dependency in your project’s Composer setup. Refer to the MageForge documentation for prerequisites.

---

MageForge adds new commands to your local Magento installation. That means that all mageforge commands can be executed via n98-magerun2 (if the installation was successful).

MCP: Include/Exclude Filters for Tool Exposure

The MCP server integration introduced in v9.3.0 now gives you fine-grained control over which commands are exposed as MCP tools. The --include and --exclude options accept glob patterns as well as named group references prefixed with @.

Start the server exposing only cache and cron commands:

n98-magerun2.phar mcp:server:start --include="sys:cron:* cache:*" --exclude="sys:cron:history"

Use a predefined group to expose a read-only inspection set:

n98-magerun2.phar mcp:server:start --include="@read-only" --exclude="@unsafe"

Or limit exposure to a single group like @cron:

n98-magerun2.phar mcp:server:start --include="@cron"

The release ships with a set of predefined command groups out of the box: @admin, @cache, @config, @cron, @database, @development, @index, @integration, @maintenance, @read-only, @repo, @system, and @unsafe. Custom groups can be defined in config.yaml and referenced the same way. Run mcp:server:start --help to see all configured groups and their patterns.

In addition, the MCP server is now documented as extensible — third-party modules can register their own command groups and tools via the module API.

---

New Format Option for sys:store:list

The sys:store:list command now supports a --format option, consistent with the output format options available across other listing commands. Use it to get JSON or CSV output for scripting and automation:

n98-magerun2.phar sys:store:list --format=json

---

Mage-OS 2.1.0 and 2.2.0 Support

The installer and test matrix now include Mage-OS 2.1.0 and 2.2.0. If you are running Mage-OS in your environment, these versions are now fully covered.

---

Improvements

• composer:redeploy-base-packages: Improved initialization and error handling; Mage-OS base packages are now supported.
• db:dump mydumper integration: Better compatibility with newer mydumper versions, non-default MySQL ports, and correct transaction flag handling.
• eav:attribute:list, customer:delete, db:check-tables, config:store:delete: Various internal optimizations for performance and correctness.
• Observer list output: Improved readability and formatting.
• AbstractDatabaseCommand: The _connection magic property is now deprecated. Modules using it should migrate to the explicit connection accessor.

---

Security Fixes

This release includes a focused hardening pass across several areas:

• Hardened argument handling for browser-launched commands.
• Secured database creation and drop flows against unvalidated input.
• Tightened compressor execution and terminal mode handling.
• Composer installer integrity is now verified during setup.

---

---

Full Changelog

• Add: mageforge:install command with optional Hyvä compatibility check
• Add: Support include/exclude command groups for MCP tool exposure
• Add: sys:store:list format option
• Add: Mage-OS 2.1.0 and 2.2.0 support in installer and test matrix
• Imp: Improve composer:redeploy-base-packages initialization/error handling and add Mage-OS base package support
• Imp: Improve db:dump mydumper integration for newer versions, non-default ports, and transaction flag handling
• Imp: Optimize eav:attribute:list, customer:delete, db:check-tables, and config:store:delete
• Imp: Improve observer list output and document MCP server extensibility
• Imp: Deprecate _connection magic property in AbstractDatabaseCommand
• Fix: Harden security for browser argument handling, database creation/drop flows, compressor execution, terminal mode handling, and program lookup
• Fix: Verify Composer installer integrity during setup
• Fix: Restore installer PreCheckPhp subcommand namespace resolution
• Fix: Improve output format compatibility for list and renderer output
• Test: Extend coverage for renderers, project composer handling, curl responses, and mydumper integration
• Docs: Add MageBox and clarify local environment entries
• Build: Update development dependencies, CI actions, and related toolchain packages

---

How to Update

As always, the easiest way to update is via the built-in self-update command:

n98-magerun2.phar self-update

---

Give v9.4.0 a spin and let us know how the new mageforge:install command and the MCP group filtering work for you. Feedback and bug reports are welcome in the comments or via GitHub Discussions.