Open source · TYPO3 · Netresearch

Introduce AI in TYPO3. Keep control of models, costs and access.

Connect language models centrally, support your editors and add the functions you need. Ten open-source components can be combined to suit your use case. The independent browser assistant answers questions about the current page.

Plan the introduction together Compare modules and requirements

Which task do you want to address?

Select a task to see its components. These are functional groups; required technical dependencies are listed in the module table.

Security and identity

Protect access, secrets and HTTP destinations

nr-vault manages API keys with envelope encryption. Passkeys add passwordless sign-in. nr-http-guard checks outbound HTTP destinations on the registered TYPO3 RequestFactory path and bound guard clients.

Task: Manage credentials, limit access and reject disallowed HTTP destinations on the integrated client path.
Audience: Administration · IT security · Identity management
Result: Encrypted secrets with an external master key, separate sign-in and HTTP destination checks under the configured policy. This grouping is not a dependency chain.

Related components

nr-vault nr-http-guard nr-passkeys-be nr-passkeys-fe

Separate sign-in, permissions and HTTP protection

Passkeys authenticate people; TYPO3 permissions define their access. Passkeys are optional for the AI foundation, but nr-passkeys-fe requires nr-passkeys-be. HTTP Guard does not automatically protect Vault: its optional adapter integration is needed. Independent SDK/Guzzle clients and direct cURL/socket calls are outside the protected path.

Protect access, secrets and HTTP destinations

Encrypted secrets with an external master key, separate sign-in and HTTP destination checks under the configured policy. This grouping is not a dependency chain.

Connect language models centrally

nr-llm connects consuming extensions to configured language models. nr-mcp-agent adds a backend assistant and is at alpha maturity.

Shared provider integration, per-user budgets and analytics for calls routed through nr-llm.

nr-llm requires nr-vault. The backend agent is optional. Writing agent tools require approval; the available tools and TYPO3 permissions still need configuration.

Create editorial content

cowriter assists writing in CKEditor. nr-repurpose turns existing sources into further formats. nr-landingpage guides the creation of a landing page.

Three individually selectable tools built on nr-llm; no backend agent required.

nr-repurpose requires TYPO3 14.3 and PHP 8.3. Models must support the functions you need. Review drafts and sources before publication.

Add channel publication

No ready-made social publishing integration verified against the current stack is offered here.

A separate integration with checked maintenance, TYPO3/PHP compatibility, channel API and approval process.

Older examples such as rx-scheduled-social, t3socials and pb_social are not recommendations for TYPO3 13.4/14.3. Importing a feed does not provide outbound publication.

Compare all ten modules

GitHub release and Composer requirements are read from the same release tag where one exists. Maturity comes from the product manifest, portfolio or extension declaration. Each value links to its source.

Sources retrieved: 2026-11-12T06:50:17Z · Download source data

On narrow screens, scroll sideways within this table region.

Module / task	Maturity	GitHub release	PHP / TYPO3	Requires directly	Boundary
nr-vaultSecret management	StableSource	v1.5.02026-11-11	PHP ^8.2TYPO3 ^13.4 \|\| ^14.3Composer	None	Stores encrypted credentials and audit data; not a business knowledge store.
nr-http-guardOutbound HTTP requests and SSRF protection	AlphaSource	v0.1.42026-10-18	PHP ^8.2TYPO3 ^13.4.36 \|\| ^14.3.8Composer	None	Alpha: registered TYPO3 RequestFactory and bound guard clients after activation. Policy, exceptions and operating mode determine protection; Vault needs separate adapter integration, while independent HTTP clients remain outside.
nr-passkeys-beBackend sign-in	StableSource	v1.0.32026-11-01	PHP ^8.2TYPO3 ^12.4 \|\| ^13.4 \|\| ^14.3Composer	None	Authenticates backend users; TYPO3 permissions still apply.
nr-passkeys-feFrontend sign-in	StableSource	v2.0.12026-10-31	PHP ^8.2TYPO3 ^13.4 \|\| ^14.3Composer	nr-passkeys-be	Authenticates frontend users; the site controls data access.
nr-llmShared model integration	BetaSource	v0.43.232026-11-10	PHP ^8.2TYPO3 ^13.4 \|\| ^14.3Composer	nr-vault	Controls connected server-side calls; model answers can be wrong.
nr-mcp-agentBackend assistant	AlphaSource	v0.36.02026-11-10	PHP ^8.2TYPO3 ^13.4 \|\| ^14.3Composer	nr-llm	Alpha for controlled evaluation; writing tools require approval.
nr-browser-aiQuestions about the current page	BetaSource	v0.8.02026-10-31	PHP ^8.2TYPO3 ^12.4 \|\| ^13.4 \|\| ^14.3Composer	None	Supported desktop Chrome and model download; no central logs.
cowriterWriting in CKEditor	StableSource	v3.27.02026-11-08	PHP ^8.2TYPO3 ^13.4 \|\| ^14.3Composer	nr-llm	Editors review generated content before accepting and publishing it.
nr-repurposeTurning content into further formats	AlphaSource	v0.14.02026-11-02	PHP ^8.3TYPO3 ^14.3Composer	nr-llm nr-vault	Alpha; requires TYPO3 14.3/PHP 8.3 and suitable model capabilities.
nr-landingpagePreparing landing pages	BetaSource	v0.3.262026-11-04	PHP ^8.2TYPO3 ^13.4 \|\| ^14.3Composer	nr-llm	Beta; editorial review and approval before publication.

A GitHub release does not independently verify TER/Packagist availability. A selected stack must satisfy the intersection of all requirements. Maturity is not a security certification.

Where is your data processed?

The configured endpoint determines the operator and processing location. API compatibility alone says nothing about either. In a fallback chain, review every endpoint.

External model provider

Processing location: At the selected provider, in the contractually agreed region
Suitable for: Wide choice of managed models
Check before use: Contract, region, retention and data transfer

Azure OpenAI

Processing location: In the selected Azure service and its configured region
Suitable for: Teams with a suitable Azure agreement
Check before use: Deployment, capabilities and data handling of the specific service

OpenAI-compatible API

Processing location: Internal or external, depending on the endpoint
Suitable for: Managed or self-hosted compatible services
Check before use: Check operator, region and supported functions individually

Self-hosted: Ollama / vLLM / LocalAI

Processing location: In the infrastructure you configure for it
Suitable for: Prompts should be processed internally
Check before use: Check hardware, model maintenance, external fallbacks and tools

Browser AI

Processing location: On the visitor’s supported device
Suitable for: Questions about publicly visible page content
Check before use: Model download, browser coverage and fallback; no central audit trail

Who decides what?

Technical functions need owners. This proposed mapping covers the server-side nr-llm path; browser AI has no central usage logs.

Approve providers and data flows

Owner: Architecture and data protection

Endpoints, contracts and fallback configuration

Set budgets

Owner: Finance and administration

nr-llm user budgets and estimated usage cost

Permit tools and writes

Owner: Business owner and IT security

Tool groups, TYPO3 permissions and approval decisions

Review logs and retention

Owner: IT security and operator

Server-side usage, tool calls and configured retention

Change models

Owner: Architecture and business owner

Capabilities, quality evaluation and new model data flow

Handle failures

Owner: Operations and incident process

Shutdown controls, error messages and a named contact

Technical starting points by module

Documentation is linked per module. The English repository manuals refer to the release tag or main branch named in the comparison.

nr-vault

Secret management

Composer packagecomposer require netresearch/nr-vault

Technical documentation (EN)Product / repository

nr-http-guard

Outbound HTTP requests and SSRF protection

Composer packagecomposer require netresearch/nr-http-guard

Technical documentation (EN)Product / repository

nr-passkeys-be

Backend sign-in

Composer packagecomposer require netresearch/nr-passkeys-be

Technical documentation (EN)Product / repository

nr-passkeys-fe

Frontend sign-in

Composer packagecomposer require netresearch/nr-passkeys-fe

Technical documentation (EN)Product / repository

nr-llm

Shared model integration

Composer packagecomposer require netresearch/nr-llm

Technical documentation (EN)Product / repository

nr-mcp-agent

Backend assistant

Composer packagecomposer require netresearch/nr-mcp-agent

Technical documentation (EN)Product / repository

nr-browser-ai

Questions about the current page

Composer packagecomposer require netresearch/nr-browser-ai

Technical documentation (EN)Product / repository

cowriter

Writing in CKEditor

Composer packagecomposer require netresearch/t3-cowriter

Technical documentation (EN)Product / repository

nr-repurpose

Turning content into further formats

Composer packagecomposer require netresearch/nr-repurpose

Technical documentation (EN)Product / repository

nr-landingpage

Preparing landing pages

Composer packagecomposer require netresearch/nr-landingpage

Technical documentation (EN)Product / repository

Frequently asked questions

Do I need all ten modules?

No. nr-llm requires nr-vault. The backend agent and content tools are additional, individually selectable consumers of nr-llm. Passkeys and HTTP Guard are separate choices; nr-passkeys-fe requires nr-passkeys-be. HTTP Guard requires neither Vault nor passkeys. nr-browser-ai works independently. The table lists direct Netresearch dependencies and version requirements.

Does HTTP Guard automatically protect all outbound connections?

No. After activation, nr-http-guard covers the registered TYPO3 RequestFactory path and clients created by its guard factories. Configured policies, exceptions and enforce, observe or disabled modes still apply. Vault needs the optional adapter integration; independent SDK/Guzzle clients, early bootstrap requests and direct cURL/socket calls need their own integration. The published version is alpha for evaluation.

Where are API keys stored?

The local default adapter of nr-vault stores encrypted secret values and encrypted data keys in the database. The master key lives outside it. Consuming extensions use vault identifiers. The goal is to avoid plaintext keys, not database storage itself.

Do budgets and logs cover every use of AI?

User budgets and usage recording are available for server-side calls routed through nr-llm. They do not cover independent SaaS tools. nr-browser-ai runs locally in the browser and deliberately has no central usage history.

Can sensitive data stay inside our environment?

Suitable self-hosted models can support that. Review the complete data flow, including fallback configuration, tools and knowledge sources. OpenAI compatibility describes an interface, not a processing location.

What about social network publication?

It remains a separate integration project. Based on published package requirements, the earlier rx-scheduled-social, t3socials and pb_social examples are not recommendations for TYPO3 13.4/14.3. Verify maintenance, current channel APIs and approvals before choosing a solution.

Choose a suitable first step

We work through your use case, existing TYPO3/PHP versions, permitted data flows and the scope of a controlled evaluation.

Found an error? Open an issue in the page repository

Request a consultation Open the documentation