@launchdarkly/mcp-server 0.6.2 → 0.7.1

package/README.md

@@ -1,6 +1,6 @@
-# LaunchDarkly's Model Context Protocol (MCP) Server
+# LaunchDarkly local MCP server
 
-The official [Model Context Protocol (MCP)](https://modelcontextprotocol.io/) server for [LaunchDarkly](https://launchdarkly.com/).
+The local [Model Context Protocol (MCP)](https://modelcontextprotocol.io/) server for [LaunchDarkly](https://launchdarkly.com/) federal and European Union (EU) environments.
 
 <div align="left">
     <a href="https://opensource.org/licenses/MIT">
@@ -8,12 +8,19 @@ The official [Model Context Protocol (MCP)](https://modelcontextprotocol.io/) se
     </a>
 </div>
 
+> [!IMPORTANT]
+> **Use the LaunchDarkly [hosted MCP server](https://launchdarkly.com/docs/home/getting-started/mcp-hosted) where available**
+>
+> LaunchDarkly strongly recommends using the [hosted MCP server](https://launchdarkly.com/docs/home/getting-started/mcp) where it is available. The hosted server is more feature complete and receives more frequent updates than this self-managed server.
+>
+> LaunchDarkly provides this self-managed MCP server for LaunchDarkly **EU** or **Federal** instances, which do not yet support the hosted MCP.
+
 <!-- No Summary [summary] -->
 
 <!-- Start Table of Contents [toc] -->
 ## Table of Contents
 <!-- $toc-max-depth=2 -->
-* [LaunchDarkly's Model Context Protocol (MCP) Server](#launchdarklys-model-context-protocol-mcp-server)
+* [LaunchDarkly local MCP server](#launchdarkly-local-mcp-server)
   * [Installation](#installation)
   * [Requirements](#requirements)
   * [Available Resources and Operations](#available-resources-and-operations)
@@ -28,6 +35,15 @@ The official [Model Context Protocol (MCP)](https://modelcontextprotocol.io/) se
 
 This MCP server can be installed in any AI client that supports the MCP protocol. Refer to your AI client's instructions if it isn't listed here.
 
+### Runtime requirements
+
+> [!IMPORTANT]
+> Some eMudhra intermediate certificate authorities were compromised in October 2026 ([advisory](https://emudhra.we-have-a-problem.com/)). Anyone on your network who holds one of their keys could intercept the server's connection to LaunchDarkly and read your API access token.
+>
+> - **npx and local installs:** use Node.js **22.23.4, 24.22.1, 26.12.1 or later**. These releases reject the compromised intermediates. The server also rejects them itself and prints a warning on startup when your runtime does not.
+> - **Docker:** use image 0.7.1 or later. Those run on Node.js 24.22.1; 0.7.0 and earlier run on Node.js 24.2.0.
+> - **Standalone binaries:** stop using the `mcp-server-bun-*` binaries attached to releases v0.6.1 and earlier. They embed a Bun runtime that does not reject the compromised intermediates, and they are no longer published. Switch to npx with a patched Node.js or to Docker.
+
 ### Cursor installation steps
 
 Create a `.cursor/mcp.json` file in your project root with the following content:
@@ -121,15 +137,6 @@ Specify your API key as found on LaunchDarkly's Authorization page.
 
 For more information, see the [GitHub Copilot CLI documentation](https://docs.github.com/en/copilot/concepts/agents/about-copilot-cli).
 
-### Standalone binary installation steps
-
-You can also run the MCP server as a standalone binary with no additional dependencies. You must pull these binaries from available GitHub releases while specifying the appropriate `tag` value:
-
-```bash
-curl -L -o mcp-server https://github.com/launchdarkly/mcp-server/releases/download/{tag}/mcp-server-bun-darwin-arm64 && \
-chmod +x mcp-server
-```
-
 ### Installation steps from a local clone
 
 You can also run the MCP server locally by cloning this repository. Once cloned, you'll need to install dependencies (`npm install`) and build the server (`npm run build`).
@@ -178,24 +185,21 @@ If installing the MCP server from the AWS Markeplace, pull the image using an au
 To run the container:
 
 ```bash
-docker run --rm -p 8080:8080 709825985650.dkr.ecr.us-east-1.amazonaws.com/launchdarkly/mcp --api-key api-xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx 
+docker run --rm -p 127.0.0.1:8080:8080 709825985650.dkr.ecr.us-east-1.amazonaws.com/launchdarkly/mcp --api-key api-xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx --auth-token "$MCP_AUTH_TOKEN"
 ```
 
-Then, configure your server definition to reference your local clone. For example:
+The container listens on `0.0.0.0`, so `--auth-token` (at least 16 characters) is required. Clients must send `Authorization: Bearer <token>` on `/sse` and `/message`. Outside Docker, the SSE transport listens on `127.0.0.1` by default; pass `--host` to change it, which also requires `--auth-token` for non-loopback hosts.
+
+Then, configure your server definition to point at the running container. For example:
 
 ```json
 {
   "mcpServers": {
     "launchdarkly": {
-      "command": "npx",
-      "args": [
-        "-y", "--package", "@launchdarkly/mcp-server", "--", "mcp", "start",
-        "--api-key", "$LD_ACCESS_TOKEN"
-      ],
-      "env": {
-        "LD_ACCESS_TOKEN": "MCP_LD_TOKEN"
+      "url": "http://localhost:8080/sse",
+      "headers": {
+        "Authorization": "Bearer <your --auth-token value>"
       }
-      "url": "http://localhost:8080/sse"
     }
   }
 }