SkillFoxx

Read-only MCP server for 1C-Bitrix

MCP-сервер для 1С-Битрикс (только чтение)

A 1C-Bitrix module with 35 read-only MCP tools: catalog, orders, reports, code files and SQL, with per-group access rights

  • 1 ★ on the repository
  • Last commit
  • MIT
MCP server

Extended access

Why this level

  • With the orders and forms groups enabled, it reads customer personal data: name, phone, address
  • The sql and files groups, once enabled, allow access to arbitrary database tables and the site's source code
All reasons and checks
Russian stack

shelezyaka/bitrix-mcpAuthor:shelezyaka

Install

Services

In your terminal, with SkillFoxx CLI

npx skillfoxx add mcp/mcp-server-dlya-1s-bitriks-tolko-chtenie

Detects the agents on your machine, shows the access level and pins the version.

Other ways to install

Access and checks

How we review

Extended accessThe tool runs code or makes network calls and only reads external data.

  • With the orders and forms groups enabled, it reads customer personal data: name, phone, address
  • The sql and files groups, once enabled, allow access to arbitrary database tables and the site's source code

This is third-party code. Review the repository files before installing.

What it does

This installable 1C-Bitrix module runs an MCP server over Streamable HTTP at a separate entry point, /mcp/index.php, without hooking into storefront page handlers. The code has no database write command at all, only SELECT. Tools are split into eight groups, each toggled separately in module settings and granted separately per token: catalog (product search and cards, prices, per-warehouse stock), orders (search, cards, statuses, stats, customers, discounts), reports (sales, top products, abandoned carts, slow movers, stock shortages, zero-result search phrases), form submissions, API introspection of the install itself (classes, methods, source, events, agents, highload blocks), code file reading with hard folder and extension boundaries, and arbitrary SELECT against the database, with tables containing passwords, keys and payment-gateway credentials closed off by column name from the schema rather than a hardcoded list. A token is shown once at issue, rights are granted by explicitly enabling a group per token, and every request is logged, including rejected ones.

Who it is for. For boxed 1C-Bitrix store owners who want a safe, read-only AI agent view into their catalog, orders and reports with no risk of breaking anything.

Good fit when

  • You need safe agent access to the catalog, prices and stock with no write risk
  • You need reports on sales, top products, abandoned carts and stock shortages
  • You need to introspect your own install's code: classes, methods, event handlers, agents

Not a fit when

  • You need the agent to write data: the module is physically incapable of writing to the database
  • Your portal is cloud Bitrix24, not a boxed 1C-Bitrix site with the iblock module
  • You have no admin ready to carefully configure iblock whitelists and permission groups

Example request

Show products with less stock than a week of sales needs, and what visitors searched for but did not find

MCP

Transport
http
Authentication
API key

Limitations

Requires 1C-Bitrix 22 or newer, PHP 8.2+ and the iblock module; field-tested on Bitrix 26.650.0 and PHP 8.5. Orders, reports, forms, files and SQL are disabled by default and must be deliberately opened by an admin. The sql and files groups, once enabled, allow arbitrary reading of site code and tables, so the README explicitly warns against opening them unless needed. The local/modules/ folder is reachable over HTTP unlike bitrix/modules/, so it needs a separate web server rule to block it.

How to disable. Revoke all tokens on the Tokens tab and remove the module via Marketplace, Installed Solutions.

FAQ

Can the module change anything on the site?

No, there is no write command in the code at all, the only database instruction the module can send is SELECT.

How does the module protect passwords and keys in the SQL group?

It closes any table whose database schema has a column named like PASSWORD, SECRET, API_KEY or ACCESS_TOKEN rather than relying on a hardcoded list, and additionally closes system tables like b_user and b_option.

Discussion

No questions or reviews yet.

All 1C-Bitrix tools
Russian stack

A 1C-Bitrix CMS module that turns the website itself into an MCP server exposing infoblocks and the user profile via tokens

MCP serverExtended access2
Russian stack

A module for 1C-Bitrix Site Manager that runs an MCP right on the CMS server for working with infoblock content from Cursor and Claude Desktop

MCP serverExtended access

MCP adapter for 1C-Bitrix

MCP-адаптер для 1С-Битрикс

Russian stack

The dimkox.mcp module for 1C-Bitrix: the site exposes infoblocks and orders to an agent over MCP within user permissions, writing disabled

MCP serverBroad access1
Russian stack

A 1C-Bitrix module with an MCP server: the agent inspects the site environment, searches core functions, and can run PHP, shell and SQL on the server

MCP serverBroad access26
Russian stack

A reference to your own 1C-Bitrix API for an agent: a core index with module versions so it stops mixing methods from different versions

MCP serverExtended access1

README in short

The detailed README explains how it differs from ready-made solutions (a separate entry point rather than an OnProlog handler, an iblock whitelist, a token shown only once), step-by-step install into local/modules/itb.mcp with a warning about the folder being reachable over HTTP, token and per-group permission setup, a full list of 35 tools across eight groups with examples of what each returns and its PII warnings, file-read and SQL boundaries in an allowed-versus-forbidden table, two catalog read engines (legacy and ORM) with speed measurements, ready prompt scenarios, and a list of Bitrix-independent tests. MIT license.

README badge

Report a problem