DrupalCon Europe took place in Rotterdam from September 28 to October 1, 2026. In the September 29, 2026 Driesnote, Dries Buytaert showed Drupal CMS, Drupal Canvas, Drupal AI, and a demo in which an AI assistant unpublishes a page while respecting the editor's permissions. If you decide what goes into the roadmap of an enterprise portal, the useful question after seeing that is how much of what was shown already has a stable release covered by the Drupal Security Team.
The keynote's underlying message was that Drupal is ahead of its reputation. As evidence, Dries said that an AI coding agent, tested in June, did not mention Drupal CMS or Site Templates. Closing that gap takes better communication, and for anyone who operates platforms it also takes knowing precisely what is ready.
Here we sort what was announced by maturity level, with the status of each piece read on its official page on October 15, 2026. If you read our reading of the program before the event, this piece picks up from what happened afterward.
How Do the Rotterdam Announcements Sort by Maturity?
What was announced splits into three levels: two stable pieces, three in beta, and three in alpha or experimental stages. The table summarizes the status of each one on October 15, 2026.
| Piece | Status | Security advisory coverage | Reasonable use today |
| Drupal Canvas 1.12.0 | Stable, Sep 25, 2026 | Yes | Production, with Drupal 11.3 or higher |
| Drupal AI 1.5.1 | Stable, Oct 14, 2026 | Yes | Production, with Drupal 10.5, or 11.2 and higher |
| Tool API 1.0.0-beta11 | Beta, Oct 1, 2026 | No supported stable release yet | Staging pilot |
| MCP Server 2.0.0-beta6 | Beta, Oct 14, 2026 | No supported stable release yet | Staging pilot |
| Canvas Tools 1.0.0-beta2 | Beta, Sep 29, 2026 | Not covered | Staging pilot |
| Agent Access 1.0.0-alpha2 | Alpha, Sep 25, 2026 | Not covered | Lab |
| Canvas Headless | Experimental, off by default | Not applicable | Proof of concept |
| PHP attributes for Tool API | Prototype in an experimental branch | Not applicable | Watch |
A stable release with coverage means the Drupal Security Team publishes advisories and fixes for that project. Agent Access and Canvas Tools state on their pages that they don't have that coverage, and Tool API and MCP Server state that no supported stable release exists yet. Statuses change quickly: the latest betas of Tool API and MCP Server are from October 1 and October 14, 2026. Before you decide, confirm each row on the project's page.
01. Which of the Announcements Is Already Stable?
Drupal Canvas and Drupal AI have a stable release covered by the Drupal Security Team. Canvas 1.12.0 was released on September 25, 2026 and requires Drupal 11.3 or higher. Drupal AI 1.5.1 came out on October 14, 2026 and works with Drupal 10.5, or with 11.2 and higher.
Drupal is an open source CMS, and Drupal CMS, formerly known as Starshot, is the product that brings together Site Templates, recipes, Drupal AI, and Canvas on top of Drupal Core. In Rotterdam, Dries announced multilingual support in Canvas, and Acquia's recap, signed by Martin Anderson-Clutz, adds that Drupal CMS 2.2 brings a language selector to the installer and translation in Canvas, with review and optional AI translation. Acquia is an ecosystem provider for Drupal and publishes that analysis from its position as a primary actor.
For an architect, Canvas's version requirement makes migration a prerequisite: a portal on Drupal 10 can't install it, while Drupal AI does run on Drupal 10.5. The criteria for that migration are in Drupal 11 and Three Reasons to Migrate Your Enterprise Portal in 2026. And if what you're evaluating is who uses Canvas in your organization, our analysis of Drupal CMS for marketers covers the enterprise decision. The Drupal page summarizes how the platform fits into an enterprise portal.
02. What Is in Beta and Ready for a Pilot?
Tool API, MCP Server, and Canvas Tools are in beta, and none of them has a stable release with security advisory coverage today. Together they form the surface an AI agent uses to operate Drupal.
Tool API, in the drupal/tool module, is a framework for defining executable logic with typed inputs and outputs, validation, and access control. A single definition can be used from AI agents, MCP clients, ECA, Drush, or PHP code. MCP Server, Drupal's MCP server, exposes tools, resources, and prompts to AI assistants through the Model Context Protocol, over STDIO or HTTP. Canvas Tools lets an AI agent create Canvas pages and templates through typed operations, and saves each change as a draft until a person publishes it.
Matt Glaman presented a session at Rotterdam on SDC components, Canvas, and agent skills, and the data in his blog post is a useful reference for what sits behind all this. Canvas Tools exposes 21 operations: three are destructive (deleting a page, deleting a component, and discarding the auto-save) and the other 18 write to a draft. Glaman also reports that Canvas has no public API, so Canvas Tools depends on specific Canvas versions, and that updating to Canvas 1.11.0 forced an adaptation of the bridge. Remote access over HTTP requires OAuth, and the module that provides it is in alpha.
Glaman also moved his plan from MCP to the command line. A coding agent that already works in the terminal can call Drush without an extra server, transport, or authentication, and he concludes that MCP only matters when the site isn't on your machine. For your architecture, that separates two cases. The development agent working next to the code is served by the CLI. The agent that operates a remote site on behalf of an editor needs MCP, OAuth, and that person's permissions.
In the Driesnote demo, an editor asks an assistant to unpublish a page; Drupal checks the editor's permissions and applies the site's publishing rules. That is the governance model to require of any pilot: the agent acts with the permissions of the person using it. esinergia has a developer dedicated to the Drupal AI Initiative and contributes continuously to drupal.org, and from that position the recommendation for an enterprise portal is to treat these betas like any dependency without a stable release: staging first, with read-only scope. The Drupal AI page summarizes how we apply AI on Drupal in enterprise portals.
03. What Is Still Experimental or Alpha?
Agent Access is in alpha, Canvas Headless is experimental, and the PHP attributes for Tool API are a prototype in an experimental branch. None of the three has security coverage today.
Agent Access is a recipe that brings together Simple OAuth, Tool API, and MCP Server to connect Drupal with AI assistants such as ChatGPT. Each person connects with their own Drupal account and their permissions apply. Version 1.0.0-alpha2 was released on September 25, 2026, requires Drupal 11.4 or higher, and is not covered by the security advisory policy; its page warns that it may have publicly disclosed vulnerabilities. A portal with patient or student data should wait for a covered release before putting it into production.
Canvas Headless lets the Canvas editor show its preview through your own frontend application, and lets you place that application's components on a page from the editor. Drupal.org presents it as official support for five frameworks, with Angular added recently. The Acquia quickstart describes it as experimental: it arrived in Canvas 1.9.0 on July 29, 2026, is off by default, can change or be removed without notice, and its SDK is below version 1.0. It requires Node.js 22 or higher and ships templates for Next.js, Astro, Nuxt, and TanStack Start. The preview depends on partitioned third-party cookies, and behavior differs between templates: the TanStack Start one doesn't send the content-security-policy header on the components route.
In the keynote, Dries showed a real case with Canvas Headless and Astro: the Blue Drop Labs site, already live, which published an article the next day. It is a result reported by the project itself. Canvas Headless shows the distance between announced and ready: the announcement calls it available and the documentation marks it experimental. For headless CMS architecture decisions with Drupal, the criteria on our Drupal headless page still apply.
The PHP attributes for Tool API are a change that Dries and Matt Glaman prototyped: Dries's photo album module needed about 1,000 extra lines of code to expose its capabilities as tools, and with attributes it came down to about 20. It is a single module in an experimental branch, so the figure doesn't generalize to other projects.
What Should You Decide This Week If You Run an Enterprise Portal on Drupal?
Three things are worth deciding: the base Drupal version, a staging pilot, and who approves what an AI agent can touch. None of them depends on Tool API or MCP Server reaching stable.
01. Base version. Canvas requires Drupal 11.3 or higher and Agent Access requires 11.4 or higher. Drupal 10 reaches end of life on December 9, 2026, and the Drupal release calendar expects Drupal 12.0.0 stable the week of December 7, 2026, with the caveat that not every release window gets used. If your DXP architecture is still on Drupal 10, that date orders everything else.
02. A staging pilot. Pick a single surface, for example Canvas Tools to build page drafts, and start with read-only tools. If your team needs a primer on what a DXP is before widening the scope, this analysis covers it.
03. Who approves. Define in writing what an agent can do without review and what requires a person's approval. The DropTimes argues that deciding which combinations are mature enough revolves around permissions, human review, and traceability. The table translates those three criteria into pilot conditions.
| Condition | What it looks like in practice |
| The agent acts with a person's permissions | The Agent Access and Driesnote demo model: each user connects with their own account |
| Draft before publishing | Canvas Tools saves changes as a draft until a person publishes them |
| Destructive operations need approval | In Canvas Tools, three of the 21 operations are marked as destructive |
| Traceability of every call | A record of which tool the agent ran and with which inputs, defined before the pilot |
Frequently Asked Questions About the DrupalCon Rotterdam 2026 Driesnote
What Was Announced at the DrupalCon Rotterdam 2026 Driesnote?
Dries Buytaert presented the state of Drupal on September 29, 2026: multilingual support in Canvas, code components in React, Canvas Headless with five frameworks, the Drupal AI demo, and a change to Tool API using PHP attributes. He also announced the Drupal Advocacy Program, which grants contribution credits for spreading the word about Drupal, and a four-day Rosetta Sprint with maintainers, with no confirmed date. The details are in the official drupal.org summary.
Is Drupal Canvas Ready for Production?
Yes, Drupal Canvas is ready for production. Version 1.12.0 has been stable since September 25, 2026, has security advisory coverage, and requires Drupal 11.3 or higher. Within Canvas, Canvas Headless is experimental and Canvas Tools is in beta.
What Is Tool API and How Does It Relate to MCP?
Tool API is a Drupal framework for defining executable logic with typed inputs and outputs, validation, and access control. MCP Server exposes those tools to AI assistants through the Model Context Protocol (MCP), an open protocol that lets an AI assistant use the tools of another system. Both are in beta as of October 15, 2026, and neither has a stable release with security support yet.
When Is Drupal 12 Coming Out?
The Drupal core calendar expects the Drupal 12.0.0 release candidate the week of November 9, 2026 and the stable release the week of December 7, 2026. The calendar page notes there is no guarantee that every window will be used to publish a new version. If your portal is still on an earlier version, the modernization and migrations page describes how we approach those upgrades.
What Comes After Rotterdam?
The Rosetta Sprint aims to have Drupal describe its capabilities once, in a form readable by AI agents, other systems, and people. It will bring key maintainers together for four days and doesn't have a date or venue yet. Tool API points in that direction, and according to Glaman it will land, at least in part, in core.
When Tool API and MCP Server have a stable release, whoever has already defined what an agent can do in their portal, and who approves it, will put it into production first. That work doesn't depend on the version and can start with today's betas.