Lifecycle MCP
Enable Lifecycle MCP, connect an OAuth client, and use Lifecycle tools with existing user permissions.
Lifecycle MCP lets external MCP clients use Lifecycle through one authenticated URL. Users add the URL, sign in with Lifecycle, and discover available tools.
Lifecycle MCP is different from an external MCP server that gives Lifecycle Agent more tools. See Connect external MCP servers for that task.
Lifecycle MCP requires administrator enablement. It accepts OAuth bearer tokens only.
Connect an MCP client
Ask your administrator for the Lifecycle MCP URL. The URL ends with /mcp.
- Add the URL as a remote HTTP MCP server in your client.
- Start the sign-in flow.
- Sign in with your Lifecycle account.
- Approve the requested access.
- Let the client discover the available tools.
The client uses OAuth discovery and handles registration automatically. You do not configure an OAuth client, API key, token claim, or Keycloak object.
Lifecycle applies your existing user permissions to every tool call. Lifecycle MCP does not grant access to an Environment, repository, Site, or action.
Understand the available tools
Lifecycle MCP groups its core tools into three capabilities. When Lifecycle Sites is enabled, clients also discover the View Hosted Sites and Manage Hosted Sites capabilities.
Understand Environments
| Tool | Result |
|---|---|
get_context | Shows useful Lifecycle context for the current user |
list_repositories | Lists repositories that the user can access |
preview_environment_config | Previews resolved Environment configuration |
validate_lifecycle_config | Validates Lifecycle configuration |
list_environments | Lists visible Environments |
get_environment | Gets bounded Environment state |
wait_for_environment | Waits for a specified Environment state |
Diagnose Environments
| Tool | Result |
|---|---|
diagnose_environment | Summarizes likely Environment problems |
get_logs | Gets a bounded, redacted log tail |
get_kubernetes_state | Gets bounded Kubernetes workload information |
Manage Environments
| Tool | Result |
|---|---|
create_environment | Creates an Environment |
configure_environment | Changes Environment configuration |
deploy_environment | Starts an Environment deployment |
extend_environment | Extends Environment expiration |
destroy_environment | Previews or destroys an exact Environment |
Only the user who created an Environment or an administrator can destroy it.
View Hosted Sites
When Sites is enabled, these tools are available:
| Tool | Result |
|---|---|
list_sites | Lists visible Sites |
get_site | Gets one visible Site |
These tools return the user’s private sites and public sites. mineOnly
selects ownership rather than creator or updater email. deleted lists the
user’s deleted sites that the user can restore.
Results include visibility and openUrl.
A private site’s URL does not grant access to another user.
Manage Hosted Sites
When Sites is enabled and Allow changes is on, these tools are available:
| Tool | Result |
|---|---|
create_site | Publishes one text file as a new Site |
update_site_content | Replaces the content of an owned Site |
set_site_visibility | Makes an owned Site private or public |
extend_site | Extends the expiration of an owned Site |
delete_site | Deletes an owned Site |
restore_site | Restores an owned Site during its retention |
New Sites are private by default.
create_site and update_site_content accept one text file: HTML, Markdown, text, JSON, CSV, XML, or SVG.
They do not accept ZIP archives, more than one file, or binary files.
To publish a Site with assets, use the UI or lfc sites create.
set_site_visibility, delete_site, and restore_site require the current expectedAccessRevision.
For set_site_visibility and delete_site, get it from get_site.
For restore_site, get it from list_sites with deleted.
A deleted Site stays restorable until restorableUntil.
The tools do not send email invitations.
An administrator can turn off all change tools. When change tools are off, clients do not discover them, and Lifecycle rejects their invocation.
Use tools safely
Lifecycle rechecks administrator policy and user authorization for every tool call. Administrator policy can reduce access, but it cannot add user permissions.
Environment reads return an immutable environmentId. Change and wait tools
use that exact identifier instead of a reusable Environment name.
Environment reads and create or deploy receipts include a lifecycleUiUrl
value. Open this URL to view the current deployment status in Lifecycle.
Environment creation uses an idempotency key. Other changes use the concurrency behavior of their underlying Lifecycle service.
Environment destruction uses two calls. The first call previews the exact Environment and returns a short-lived confirmation. The second call uses that confirmation.
Lifecycle bounds and redacts tool output. Treat repository content, logs, and Kubernetes events as untrusted evidence.
Enable Lifecycle MCP
An administrator enables Lifecycle MCP from Platform administration → Lifecycle MCP.
The page shows:
- whether Lifecycle MCP is on or off
- the canonical MCP URL
- an enable or disable control
- the Allow changes control
- capability and tool information
- one issue when enablement fails
Enablement is one bounded request. Lifecycle configures the required Keycloak sign-in settings and verifies them against the MCP URL.
Lifecycle stores the enabled setting only after verification succeeds. If enablement fails, Lifecycle keeps access off and shows one corrective action.
The first enablement makes a durable Keycloak realm configuration change. Disabling Lifecycle MCP does not revert that configuration.
During enablement, Lifecycle can remove Keycloak’s exact stock anonymous
Trusted Hosts component. Lifecycle does not replace a customized or
ambiguous component. A conflict keeps Lifecycle MCP off.
Disabling Lifecycle MCP closes tool access. It does not delete registered
OAuth clients, remove Lifecycle-managed Keycloak objects, or restore the stock
Trusted Hosts component.
When an administrator enables Lifecycle MCP again, Lifecycle reconciles and verifies the Keycloak configuration before it restores access.
The stored administrator policy has two fields:
Use the Settings page for normal administration. The typed administrator API
uses GET /api/v2/config/mcp and PUT /api/v2/config/mcp.
Prepare authentication
For a new bundled Keycloak realm, the supported chart creates private API service credentials during the initial realm import. It does not configure the MCP OAuth contract.
For an existing realm, a platform operator completes one management-client migration before enablement. Read Adopt Lifecycle MCP for the migration steps.
When an administrator enables Lifecycle MCP, Lifecycle API configures the fixed contract in bundled Keycloak. Normal MCP administration does not require a setup job or direct Keycloak changes.
Provisioning does not turn on Lifecycle authentication. Before you enable Lifecycle MCP, enable normal Lifecycle authentication. See Authentication.
Lifecycle validates every token before it runs a tool. It also applies the stored administrator controls and the signed-in user’s permissions.
Troubleshoot access
| Symptom | Action |
|---|---|
| The administrator cannot enable it | Follow the corrective action on the Lifecycle MCP page. |
| Sign-in does not start | Confirm that the client supports remote HTTP MCP with OAuth. |
| A tool is missing | Check Allow changes and your permissions. |
| A tool call is denied | Confirm that your Lifecycle account can perform the action. |
| An Environment change targets old state | Read the Environment again and use its current environmentId. |
| A destructive confirmation expires | Preview the destruction again. |
| Output is truncated | Narrow the request or use the Lifecycle UI, API, or CLI. |
Do not put OAuth tokens or client secrets in client configuration files, support messages, or logs.