MCP setup

Lumenlan CLI includes an MCP server so a local Model Context Protocol client can discover and call the same strict verification and grant-bound workspace abilities. The current transport is stdio only: the client starts a child process and exchanges protocol messages through standard input and output.

The server command is:

lumenlan mcp serve --transport stdio

In a desktop agent or developer tool that supports MCP, set command to lumenlan and args to ["mcp", "serve", "--transport", "stdio"]. Make sure the client process can find lumenlan on its PATH; otherwise use the absolute path of the installed binary.

After connecting, the client can discover system.capabilities, verification.run, and the workspace process, script, and adapter tools. MCP is another interface over the same rules. Verification still accepts only strict specifications. Workspace still needs a valid ExecutionGrant and local policy, and workspace output cannot replace evidence required by a formal verification.

Network and remote boundaries

The CLI does not open an independent network listener by default, and a non-stdio transport is rejected. Do not expose it through an arbitrary public port or general command forwarding layer. Cross-machine identity, machine selection, transport, approval, leases, and revocation belong to a higher control plane. The CLI validates authorization and performs the local action on the target machine.

Diagnose a connection

First run lumenlan version and lumenlan capabilities in a normal terminal. If the client says the server exited immediately, check the executable path, arguments, and stderr. Protocol messages use stdout, so a wrapper must not print banners or logs there. Restart the client after changing its configuration so it starts a fresh stdio process. If connection still fails, continue with Troubleshooting.