Documentation
Getting started
Run LiteMCP Composer locally and create a governed composition backed by real control-plane APIs.
LiteMCP Composer is in early open-source development. Use the explicit demo mode only with local or disposable data.
Prerequisites
- Node.js 22.12 or newer
- pnpm 10.30
- Docker with Compose only when evaluating the packaged self-hosted stack
Install the workspace
git clone https://github.com/reachjalil/liteMCP.git
cd liteMCP
pnpm install --frozen-lockfileThe source demo uses in-memory data and a fixed local-only identity. Do not expose it to a shared network or treat it as an authentication test.
Run the local source demo
LITEMCP_DEMO_MODE=true pnpm devThe web surface defaults to http://localhost:4321 and the management API tohttp://localhost:8787. The root command starts only the portable Node server and Astro site; use pnpm managed-cloud:dev separately for the managed cloud runtime.
Inspect the control plane
curl --fail-with-body http://localhost:8787/api/v1/overview \
-H 'x-litemcp-tenant: org_demo' \
-H 'x-litemcp-role: finance-admin'Those headers are accepted only as the explicit demo identity. Production requests must derive tenant membership and roles from the authenticated server session.
Register an upstream MCP server
curl --fail-with-body -X POST http://localhost:8787/api/v1/servers \
-H 'content-type: application/json' \
-H 'x-litemcp-tenant: org_demo' \
-H 'x-litemcp-role: finance-admin' \
-d '{
"slug": "internal-docs",
"name": "Internal docs",
"description": "Read-only documentation search",
"transport": "streamable-http",
"endpoint": "https://mcp.example.net/mcp",
"version": "1.0.0",
"visibility": "private",
"tags": ["docs", "read-only"],
"tools": []
}'Create a composition
Open Console → Composer, choose a registered server, assign a namespace, and create the composition. The console posts the exact member and alias structure to /api/v1/compositions; it does not maintain a browser-only copy.
Simulate policy before issuing a session
Use Policy simulator to test a subject, action, tool, and risk class. The response explains whether execution is allowed, denied, or requires approval and identifies the matching rule IDs.
Next steps
- Review identity and gateway sessions.
- Read the security boundary overview.
- Inspect the Kubernetes deployment preview and its remaining runtime proof.