Testing Best Practices Skill in Laravel Boost v2.6.0

Laravel Boost v2.6.0 introduces a unified testing best practices skill to guide AI coding agents, database-enforced read-only transactions for the DatabaseQuery MCP tool, and fixes for skill management.

Consolidated Testing Best Practices skill
Database-enforced read-only transactions for DatabaseQuery
Skill installation fixes in boost:add-skill
MySQL schema read compatibility under ANSI_QUOTES
Clean MCP server JSON configuration formatting

What's New

Testing Best Practices Skill

Boost previously shipped multiple testing skills, including pest-testing, enforce-testing, and phpunit-guidelines. Because these skills overlapped, AI agents could produce inconsistent test suites, test framework internals, or add redundant mocks.

This release consolidates testing guidance into a single testing-best-practices skill. Boost composes the skill dynamically based on the testing packages installed in your project, adapting to Pest, PHPUnit, browser testing, and Test Impact Analysis.

The consolidated skill provides guidance across nine core areas:

Assertions: Encourages direct semantic assertions such as assertOk() instead of checking raw HTTP status codes.
Endpoint Tests: Focuses HTTP tests on authorization and core responses rather than testing validation matrices through full requests.
Feature Discovery: Guides agents to locate existing tests before writing new ones.
Isolation: Prevents shared state leaks and limits database transactions to relevant tests.
Naming: Enforces clear naming conventions that describe expected behavior.
Performance: Discourages slow test patterns, such as creating unnecessary database records in setup hooks.
Review: Defines criteria for auditing test suites and pruning duplicate coverage.
Security: Promotes testing hostile inputs and unauthenticated boundaries.
Test Data: Recommends focused model factories over bloated datasets.

PR: #769

Database-Enforced Read-Only Transactions

The DatabaseQuery MCP tool previously used lexical query parsing and keyword filtering to prevent write operations. While keyword checks block obvious INSERT or UPDATE queries, SQL dialects include complex shapes, such as data-modifying common table expressions (CTEs), that lexical parsers can miss.

In v2.6.0, DatabaseQuery executes queries inside a database-enforced read-only transaction:

On MySQL and MariaDB, Boost issues SET TRANSACTION READ ONLY before starting the transaction.
On PostgreSQL, Boost starts the transaction and runs SET TRANSACTION READ ONLY.
On SQLite, Boost sets PRAGMA query_only = ON.

Boost always rolls back the transaction when the query finishes, ensuring that the database engine rejects modifications even if a query bypasses lexical parsing.

PR: #957

Skill Management and Tooling Improvements

This release also includes several tooling fixes:

Safe Skill Installation: boost:add-skill now ignores repository-root SKILL.md files, preventing the command from deleting an entire skills directory during installation. The command also accepts arbitrary skill path shapes (#954, #960).
MySQL ANSI_QUOTES Support: Schema reads now quote table types as string literals, allowing schema tools to work when MySQL runs in ANSI_QUOTES mode (#958).
MCP Server Injection: Boost preserves trailing comments when writing MCP server configurations to JSON files (#977).
Agent Detection: Boost prevents false-positive Antigravity detection when scanning the shared .agents directory (#981).