Why this exists. A JCE profile decides what people can upload as well as which buttons they see, so a bad profile is a security problem, not just an untidy toolbar. Attacks on CVE-2026-48907 wrote a profile row that allowed .php uploads, then uploaded a webshell through JCE's own file browser. JCE's profile list won't show you that at a glance. This add-on can.

What the AI can do. 21 tools in 5 groups:

• Profiles (8): list, read, create, change, delete, duplicate, publish or unpublish, and reorder.
• Assignment (3): read and set who a profile is for, and work out which profile a given user gets.
• Editor (4): read and set the toolbar, and read and set profile settings.
• Plugins (2): list JCE's plugins and read one plugin's settings.
• Diagnostics (4): version and edition, global settings, a health check, and the security audit.

Every tool describes itself to the AI app, so there's nothing to configure. Ask in plain language: "Audit my JCE profiles" or "Which profile does Dana get in articles on a phone?"

The security audit is read-only and looks for profiles that allow executable uploads, pin themselves above every other profile or escape the media folder. It also checks whether your JCE version is affected. If it finds something, it tells you to record the profile first, not delete it.

Refuses dangerous writes. Adding an executable file type to an upload list is refused every time, for everyone. There's no override.

Things it handles for you. JCE accepts an unknown toolbar name and then quietly drops the button, so these tools check every name first and refuse the whole change if one is wrong. A button has to be in both the toolbar and the plugin list, and the health check finds those gaps. Setting changes keep everything you didn't name. Deleting a profile shows what would go and needs a confirmation, because there's no trash and no undo.

Permissions. The AI can never do more than the Joomla account it acts for could do in JCE itself. On top of MCP for J's Use and Write permissions, every tool needs JCE's Access Component permission, plus Editor Profiles for profile work or Editor Global Configuration for the settings read. Read-only mode in MCP for J limits it to the reading tools. API keys kept in profile settings, such as the AI Assistant plugin's, are never returned. Profile names, descriptions and component lists refuse HTML, and settings are encoded the way JCE encodes them.

Getting it. You need CS MCP for J and JCE. Install it from Components → MCP for J → Browse MCP Add-ons or with the downloaded ZIP.

Tested on Joomla 6 with JCE 3.0.2 Free and Pro: all 21 tools called with the writes checked in the database, and the permission checks with Super User, Administrator and Manager accounts.

Joomla 5 and 6, PHP 8.2+. GPL-2.0-or-later.

Current release: 1.0.4
Documentation: https://docs.cybersalt.com/extensions/mcp-for-jce
Changelog: https://docs.cybersalt.com/extensions/mcp-for-jce/changelog