{
  "markdown": "# LightNow MCP Proxy\n\n<!-- mcp-name: io.github.lightnow-ai/lightnow-proxy -->\n\n[![PyPI](https://img.shields.io/pypi/v/lightnow-proxy.svg)](https://pypi.org/project/lightnow-proxy/)\n[![Official MCP Registry](https://img.shields.io/badge/dynamic/json?url=https%3A%2F%2Fregistry.modelcontextprotocol.io%2Fv0.1%2Fservers%2Fio.github.lightnow-ai%252Flightnow-proxy%2Fversions%2Flatest&query=%24.server.version&label=Official%20MCP%20Registry&logo=modelcontextprotocol)](https://registry.modelcontextprotocol.io/?q=io.github.lightnow-ai%2Flightnow-proxy)\n[![Listed on LightNow](https://lightnow.ai/badge/io.github.lightnow-ai/lightnow-proxy?variant=listed)](https://lightnow.ai/servers/io.github.lightnow-ai/lightnow-proxy)\n\n**Connect your AI clients to your MCP servers—securely managed in one place.**\n\nThe LightNow MCP Proxy is the local runtime behind LightNow profiles.\nConnect Codex, Claude Desktop, Cursor, VS Code, or Antigravity once, then manage\nthe MCP servers available to that client in LightNow instead of copying server\nconfiguration and secrets into every tool.\n\n- Keep MCP access organized in personal and organization profiles.\n- Connect local `stdio` and remote Streamable HTTP servers through one entry.\n- Resolve credentials on the user's machine instead of embedding them in MCP\n  client configuration.\n- Apply profile and policy changes without rebuilding every client setup.\n- Observe client, profile, server health, and tool usage. Tool arguments are\n  captured by default with credential-like fields redacted and can be disabled;\n  tool results and resolved secrets are never collected.\n\nThe installed command remains `lightnow-proxy`. It runs locally, uses the\nidentity-bound LightNow CLI session, resolves the selected profile, and routes\ntool and resource requests to the profile's MCP servers.\n\n## Capabilities come from your LightNow profile\n\nThe proxy deliberately does not ship demo tools. Its MCP capabilities are\nthe real tools and resources exposed by the servers selected in the active\nLightNow profile, so the list differs between teams and clients. Names such as\n`github__create_issue` identify both the upstream server and its tool and avoid\ncollisions when several servers use the same tool name.\n\nThe proxy supports the official MCP `2026-07-28` revision with stateless,\nper-request protocol metadata and `server/discover`. It keeps automatic\ncompatibility with handshake-era servers and clients through `2025-11-25`.\n\n## Install\n\nRequirements:\n\n- Python 3.11 or higher\n- `pipx`\n- a [LightNow account](https://www.lightnow.ai/)\n- the LightNow CLI\n\n```sh\npipx install lightnow-cli\nlightnow login\n```\n\nInstall the proxy with Homebrew:\n\n```sh\nbrew tap lightnow-ai/tap\nbrew install lightnow-proxy\n```\n\nOr install it with `pipx`:\n\n```sh\npipx install lightnow-proxy\n```\n\nOr install it with `uv`:\n\n```sh\nuv tool install lightnow-proxy\n```\n\nThe Python package installs the `lightnow-proxy` command used by MCP clients.\n\nFor repository-local development:\n\n```sh\nuv tool install --from . lightnow-proxy\n```\n\nUpdate supported CLI and Proxy installations through the LightNow CLI:\n\n```sh\nlightnow update --check\nlightnow update\n```\n\nHomebrew, pipx and uv are managed. The proxy only reports its observed version\nand update state in metadata-only heartbeats; it never invokes a package manager\nor delays MCP startup to check for releases.\n\n## Configure a Client\n\nUse the LightNow CLI. It writes the client MCP entry and the per-client Local\nProxy config.\n\n```sh\nlightnow sync --client codex --local-proxy\nlightnow sync --client claude-desktop --local-proxy\nlightnow sync --client cursor --local-proxy\nlightnow sync --client vscode --local-proxy\nlightnow sync --client antigravity --local-proxy\n```\n\nRestart the MCP client after syncing.\n\n### Multiple accounts and organizations\n\nUse a distinct `--connection` alias for every account, organization or profile\nthat should appear in the same MCP client:\n\n```sh\nlightnow login\nlightnow sync --client codex --local-proxy \\\n  --connection lightnow-personal --profile default\n\n# Sign in with the organization account before creating this connection.\nlightnow login\nlightnow sync --client codex --local-proxy \\\n  --connection lightnow-acme --tenant <tenant-id> --profile engineering\n```\n\nEach generated proxy config has a stable connection ID and points to one named\nCLI session under `~/.lightnow/sessions/`. It also records the expected issuer\nand subject. The proxy refuses Registry requests when those values do not\nmatch, so a later CLI login cannot silently switch an existing connection. No\naccess or refresh token is written to the proxy YAML.\n\nCheck the local setup:\n\n```sh\nlightnow config-status --client codex\n```\n\nCheck whether the proxy can resolve the selected profile and reach its upstream\nMCP servers:\n\n```sh\nlightnow-proxy --health\nlightnow-proxy --health --json\n```\n\nBy default this reads `~/.lightnow/lightnow-proxy/default.yaml`, which is written\nwhen the default profile is synced into Local Proxy mode. For a client-specific\nconfig, pass the generated path explicitly:\n\n```sh\nlightnow-proxy --config ~/.lightnow/lightnow-proxy/codex.yaml --health\nlightnow-proxy --config ~/.lightnow/lightnow-proxy/codex.yaml --health --json\n```\n\nNamed connections use separate files such as\n`~/.lightnow/lightnow-proxy/codex-lightnow-acme.yaml`. The JSON health report\nshows their non-secret connection alias, ID, account label, scope, profile and\nidentity-binding status. Legacy configs that use `cli_config_path` remain\nreadable, but are restricted to the configured authentication issuer.\n\nWhen telemetry is enabled, active health checks and runtime events are sent to\nthe LightNow Control Plane. Tool-call arguments are captured by default and can\nbe disabled independently in the Local Proxy settings. Credential-like fields\nare redacted before transmission. The proxy also sends device\npresence immediately at startup and every two minutes. The Control Plane can\nthen show which devices, clients and profiles are active, healthy, degraded, or\nfailing, along with CLI/Proxy versions and update status. Tool results, resolved\nLightNow secrets, unredacted authorization values, network addresses, hardware\nidentifiers and local paths are not stored. Credential-like argument fields,\nincluding authorization headers, are replaced with `[REDACTED]` before transmission.\n\nVault providers configured for runtime resolution are resolved on this host,\nafter Registry API has returned a provider reference without credentials or a\nsecret value. HashiCorp Vault Proxy auto-auth on `127.0.0.1:8200` is the\ndefault. Provider-specific loopback listeners can be mapped under\n`runtime_secrets.providers` in the generated YAML; LightNow CLI preserves these\nnon-secret mappings on subsequent syncs. The optional OS-keyring path is\navailable with `lightnow-proxy[keyring]`. Resolution failures are fail-closed\nand plaintext values are never added to the tool-schema cache.\n\n### Managed runtime files\n\nSTDIO servers may attach bounded, non-secret `runtime_files` to their Runtime\nProfile client configuration. LightNow Proxy writes each file set below\n`~/.lightnow/runtime-files` in an immutable content-addressed directory before\nthe upstream process starts. Files use mode `0600`; managed directories use\nmode `0700`.\n\nReference the resolved directory with `${LIGHTNOW_RUNTIME_DIR}` in arguments,\nenvironment values, or the working directory:\n\n```json\n{\n  \"transport\": \"stdio\",\n  \"command\": \"npx\",\n  \"args\": [\n    \"@bytebase/dbhub@latest\",\n    \"--config\",\n    \"${LIGHTNOW_RUNTIME_DIR}/dbhub.toml\"\n  ],\n  \"env\": {\n    \"DBHUB_DSN\": \"${DBHUB_DSN}\"\n  },\n  \"runtime_files\": [\n    {\n      \"path\": \"dbhub.toml\",\n      \"content\": \"[[sources]]\\nid = \\\"analytics\\\"\\ndsn = \\\"${DBHUB_DSN}\\\"\\n\"\n    }\n  ]\n}\n```\n\nRuntime files are UTF-8 text and are limited to 16 files, 64 KiB per file, and\n256 KiB per server configuration. Paths must be relative and cannot contain\ntraversal segments or backslashes. Secret values must remain in LightNow's\nruntime secret buckets; files may refer to the corresponding environment names\nbut must not embed plaintext credentials. Invalid or modified materializations\nfail closed before the upstream starts.\n\n## More Documentation\n\nDetailed setup guides, examples, diagrams, supported client paths, telemetry\nbehavior and troubleshooting live in the LightNow docs:\n\n- [Connect MCP clients](https://docs.lightnow.ai/getting-started/sync-mcp-clients)\n- [CLI reference](https://docs.lightnow.ai/reference/cli)\n- [Release process](https://github.com/lightnow-ai/lightnow-proxy/blob/main/docs/release.md)\n\n## Local Development\n\nFor contributors working on this repository:\n\n```sh\nuv venv\nuv pip install -e .[dev]\nmake test\n```\n\nRun the proxy with the example config:\n\n```sh\nuv run lightnow-proxy --config config.example.yaml\n```\n\nRun the proxy as a stdio MCP server:\n\n```sh\nuv run lightnow-proxy --config config.example.yaml --transport stdio\n```\n\nRun a local health check against the example config:\n\n```sh\nuv run lightnow-proxy --config config.example.yaml --health\n```\n",
  "bytes": 9046,
  "sha": "bcab60a9b8e9e6fd582f5f188190fe6604aa16e610e441e2fc2c8c8ef59fffdf",
  "repo_slug": "lightnow-ai/lightnow-proxy",
  "fonte": "repo",
  "truncated": false,
  "api": "https://agentalog.com/api/listings/mcp_io_github_lightnow_ai_lightnow_proxy_a7937acd/readme"
}