@lucern/mcp 0.3.0-alpha.1 → 0.3.0-alpha.11

package/README.md

@@ -6,21 +6,24 @@ Standalone MCP server for Lucern's reasoning runtime.
 
 - Distribution target: private/internal registry
 - License: UNLICENSED
-- Expected auth: `LUCERN_API_KEY` machine credential
+- Expected auth: a Lucern local profile from `lucern auth login`, or `LUCERN_API_KEY`
   - Canonical hosted/remote auth: service principal bearer token (`lk_...` / `lsk_...`)
   - Compatibility auth: tenant API key (`luc_...` / `stk_...`)
 
 ## Run
 
 ```bash
-npx @lucern/mcp --api-key lk_... --base-url https://your-lucern-host
+lucern auth login
+npx @lucern/mcp
 ```
 
 Env vars:
 
-- `LUCERN_API_KEY` (required)
+- `LUCERN_API_KEY` (machine auth)
+- `LUCERN_USER_TOKEN` or `LUCERN_SESSION_TOKEN` (user auth)
 - `LUCERN_BASE_URL` (optional)
-- `LUCERN_PROJECT_ID` (optional)
+- `LUCERN_PROFILE` (optional)
+- `LUCERN_TOPIC_ID` (optional)
 - `LUCERN_MCP_TRANSPORT` (`stdio` or `http`, default: `stdio`)
 - `LUCERN_MCP_HOST` (HTTP only, default: `127.0.0.1`)
 - `LUCERN_MCP_PORT` (HTTP only, default: `8080`)
@@ -50,6 +53,10 @@ Auth behavior:
 - If `--api-key` is provided, the server uses that credential for all upstream Lucern API calls.
 - Otherwise (default), the server accepts inbound `Authorization: Bearer lk_/lsk_...` service principal tokens plus `x-lucern-key` or `Authorization: Bearer luc_/stk_...` tenant API keys and forwards them upstream.
 - If `--server-auth-token` is provided, incoming requests must include `Authorization: Bearer <token>` or `x-lucern-mcp-token: <token>`.
+- MCP does not fetch Master Control deploy keys or run its own Permit checks.
+  It is a client of the same `api.lucern.ai` gateway as the CLI and SDK. The
+  gateway resolves the caller, tenant, workspace, and deployment through Master
+  Control, then enforces Permit before executing generated surface calls.
 
 Canonical hosted endpoint:
 
@@ -89,15 +96,17 @@ See `docs/lucern-replatform/api/mcp-surface-separation.md` for boundary details.
       "command": "npx",
       "args": ["@lucern/mcp"],
       "env": {
-        "LUCERN_API_KEY": "lk_...",
-        "LUCERN_BASE_URL": "https://your-lucern-host",
-        "LUCERN_PROJECT_ID": "project_123"
+        "LUCERN_PROFILE": "default"
       }
     }
   }
 }
 ```
 
+Run `lucern auth login` first. The MCP process loads `~/.lucern/profiles.json`
+and `~/.lucern/credentials`, so CLI and MCP share the same user-level auth
+without copying tokens into every client config.
+
 ## Exports
 
 - `createLucernStandaloneMcpServer`

package/bin/lucern-mcp.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { runLucernMcpCli } from "../dist/lib/platform/mcp/cli.js";
+import { runLucernMcpCli } from "../dist/cli.js";
 
 runLucernMcpCli().catch((error) => {
   console.error(

package/dist/cli.d.ts

@@ -0,0 +1,3 @@
+declare function runLucernMcpCli(argv?: readonly string[]): Promise<void>;
+
+export { runLucernMcpCli };