Write each Laravel operation once.
One Action class answers your web forms, JSON, Artisan, the queue, TypeScript, laravel/ai agents and MCP clients, each through the same checked pipeline.
composer require agentic-actions/laravel:^0.9@betaOne action, every caller
Mark the class #[Expose] for the route, agents and MCP; Artisan and the queue reach it either way.
- Web form and JSON/actions/create-post
- Artisanactions:run create-post
- The queueCreatePost::dispatch()
#[Expose]
final class CreatePost extends Action
{
protected ?Effect $effect = Effect::Write;
public function schema(JsonSchema $schema): array { … }
public function authorize(ActionContext $context): bool { … }
public function handle(ActionContext $context, ValidatedInput $input) { … }
}- TypeScriptcreatePost()
- A laravel/ai agenta tool in its toolset
- MCP clientsthe create-post tool
Every call takes the same steps
Whoever calls, the same checks run. A step before authorize() that says no answers “not found”, so a caller cannot tell a hidden action from a missing one.
- exposure#[Expose] lets the caller in
- token abilitiesactions:write for a Write
- tenant membershipthe person is in the teamnot a member: 404
- authorize()before the input, after validation, or both
- validationschema() as rules
- handle()does the work
- output allowlistonly declared keys leave
Built for a person working with an agent
The copilot
An agent works on the page. Each action call shows as a live row, and the page reloads what the write touched.
Person:Draft a post about the spring meetup.Looked it updoneSaving…runningAgent:Saving it as a draft for you.Confirmations
A Destructive or External call waits until the person confirms it, on a card the server builds.
Person:Delete my old meetup draft.Waiting for your confirmationDelete this post? This cannot be undone.
- Post
- Spring meetup
- Status
- draft
Tenants
Every tenant-scoped call runs inside one team. A stranger gets the same 404 as a team that does not exist.
Team/teams/design/actions/create-posta memberruns/teams/sales/actions/create-postnot a member404MCP and OAuth
Clients connect with a person's token or sign in with OAuth, and reach Read and Write actions only.
Tables and charts
A Read action's rows reach the person as a table. The numbers come from your query; the model reads a short copy.
Looked it updoneAuthor Posts Words Sam 12 9,400 Alex 8 6,100 Robin 5 2,800 Agent:Sam wrote the most words this month.Testing
Fake every action, assert what ran, and pin what each toolset holds, so a widened toolset fails a test.
$ vendor/bin/pest$fake->assertRan(CreatePost::class)$fake->assertNotRan(PublishPost::class)assertToolset('default', ['create-post'])3 passed
Start with one action.
Install the package, write CreatePost, and call it from a form, the CLI and an agent.
composer require agentic-actions/laravel:^0.9@beta