Drup-AID v0.1.0: an open-source AI team for Drupal

Field notes from shipping an open-source AI-agent team on Drupal 11 — what we built, what we verified, and why it rides the exact rails Drupal AI is laying down for 2026.

What shipped

Drup-AID v0.1.0 is now open source. A fresh install brings up a working AI team wired to your Drupal site: one master assistant you talk to in plain language, backed by five specialists — a Concierge (greeting + local time/weather/news), an SEO Specialist (technical + AI-search audits), a Content Writer, a Security Monitor, and a Lead Desk. No manual wiring; the recipe brings the whole team up.

The code is on GitHub — github.com/drelf/drup-aid — GPL, built in the open.

The mental model: it's a hot rod

The whole architecture fits one picture. Take a classic, proven platform and drop in an AI engine:

Drup-AID architecture as a hot rod: the LLM is the engine, MCP the intake and couplers, n8n the transmission, and Drupal the chassis.

  • Drupal is the chassis — the proven, secure foundation everything bolts to.
  • The LLM is the engine — the brain that makes decisions and generates content. It can run locally on your server, so your business data never leaves the box.
  • MCP (the Model Context Protocol) is the intake — the standardized connector that pulls in context and tools and plugs them into the engine.
  • n8n is the transmission — the automation layer that routes power into finished work.

Why this shape (and why it's future-proof)

We deliberately checked our design against Drupal's official AI roadmap for 2026 before committing. The verdict was better than we hoped: we're building on the exact rails Drupal AI is laying down.

  • MCP is an official Drupal AI workstream — both a client (so Drupal can consume external tools) and a server (so a Drupal site becomes "AI-discoverable" to tools like Claude, Cursor, and n8n).
  • n8n is named, by name, as an orchestration partner in the roadmap. Our Drupal-to-n8n integration isn't a workaround; it's the sanctioned direction.
  • The Tool API is the 2.0 standard for exposing capabilities to agents — and it's what MCP uses under the hood.

So the architecture isn't a bet against the platform. It's a bet with it.

The modular pattern: thin connectors, real work

Every specialist is the same thin skeleton, which makes the whole system predictable and swappable:

  • The module is a connector. It registers an agent with the master and carries that agent's deterministic tools. One module, one specialist.
  • The tools do the real work. Deterministic where they can be — an SEO audit is just fetch-and-parse, so it's free, fast, and never flakes; the LLM only decides which specialist to call and narrates the result.
  • The master routes, it doesn't do. Its brain can be a small local model because "pick the right specialist" is a light job — the heavy lifting lives in the tools.

The OOTB team is Drupal-native today. The same shelf extends across MCP to n8n minions — a path we verified end-to-end — for deterministic pipelines that belong in n8n.

Two principles you'll feel immediately

  • It prescribes, it doesn't meddle. The read-only specialists (SEO, Security) return the exact fix — they don't change your site behind your back. You stay in control, and the system earns trust before it earns write access. (The Content Writer is the safe exception: Drupal content is revisioned and rollback-able.)
  • Plain English and technical. Every recommendation comes in two tiers — a plain-English fix for the owner, and a precise technical drill-down for the developer.

What we actually verified

This isn't a whiteboard sketch. In a durable local environment (DDEV + Drupal 11.4 + a local Ollama model as the brain), we proved the pieces end-to-end:

  1. A specialist agent runs entirely on a free local LLM — it reasoned about a request, called its tool, read the real result, and wrote a grounded report at $0, no cloud, no data leaving the box.
  2. The Security Monitor reads Drupal's own reports — Update Manager, Status Report, account/form hardening — and translates them, rather than reinventing a parallel scanner.
  3. The Lead Desk captures for real — a contact bubble on the public site emails the owner and logs the lead.
  4. The MCP shelf works across the boundary — from inside Drupal, the MCP client discovered an n8n minion's tool and executed it across MCP (pull-down / run / put-back).

The strategic lesson: ride the platform, don't fight it

Drupal Core (via Canvas + AI Core) is about to give away, for free, a lot of what a generic "AI CMS" tries to sell: page generation, content drafting, an admin chatbot, SEO title/meta suggestions, alt text.

So the defensible value isn't "AI writes your pages." It's the business-vertical specialists Core doesn't ship — deep technical + AI-search (GEO) SEO audits, a security monitor, a lead desk — wrapped in an owner-facing concierge and delivered as a fractional "AI employee." We lean into what Core doesn't do and ride what it does.

What's next

  • Harden the shelf for multi-tenant use (endpoint auth; the alpha MCP client stays in the dev lane until it hits a stable release).
  • Grow the team one specialist at a time — analytics, voice — each the same thin-connector pattern.
  • Graduate read-only agents up the maturity ladder: report → prescribe → act-with-approval → autonomous.

Drup-AID is an open, AI-driven Drupal platform — a modular agent team that sits seamlessly on top of Drupal AI. These are working field notes; we build in the open. Star it on GitHub.

Comments