Apache 2.0Pre-1.0 · managed cloud and self-hosted previewsRead the open-source commitment

Documentation

Getting started

Run LiteMCP Composer locally and create a governed composition backed by real control-plane APIs.

Development status

LiteMCP Composer is in early open-source development. Use the explicit demo mode only with local or disposable data.

Prerequisites

  • Node.js 22.12 or newer
  • pnpm 10.30
  • Docker with Compose only when evaluating the packaged self-hosted stack

Install the workspace

git clone https://github.com/reachjalil/liteMCP.git
cd liteMCP
pnpm install --frozen-lockfile

The source demo uses in-memory data and a fixed local-only identity. Do not expose it to a shared network or treat it as an authentication test.

Run the local source demo

LITEMCP_DEMO_MODE=true pnpm dev

The web surface defaults to http://localhost:4321 and the management API tohttp://localhost:8787. The root command starts only the portable Node server and Astro site; use pnpm managed-cloud:dev separately for the managed cloud runtime.

Inspect the control plane

curl --fail-with-body http://localhost:8787/api/v1/overview \
  -H 'x-litemcp-tenant: org_demo' \
  -H 'x-litemcp-role: finance-admin'

Those headers are accepted only as the explicit demo identity. Production requests must derive tenant membership and roles from the authenticated server session.

Register an upstream MCP server

curl --fail-with-body -X POST http://localhost:8787/api/v1/servers \
	  -H 'content-type: application/json' \
	  -H 'x-litemcp-tenant: org_demo' \
	  -H 'x-litemcp-role: finance-admin' \
  -d '{
    "slug": "internal-docs",
    "name": "Internal docs",
    "description": "Read-only documentation search",
    "transport": "streamable-http",
    "endpoint": "https://mcp.example.net/mcp",
    "version": "1.0.0",
    "visibility": "private",
    "tags": ["docs", "read-only"],
    "tools": []
  }'

Create a composition

Open Console → Composer, choose a registered server, assign a namespace, and create the composition. The console posts the exact member and alias structure to /api/v1/compositions; it does not maintain a browser-only copy.

Simulate policy before issuing a session

Use Policy simulator to test a subject, action, tool, and risk class. The response explains whether execution is allowed, denied, or requires approval and identifies the matching rule IDs.

Next steps