Lifecycle MCP
Enable Lifecycle MCP, connect an OAuth client, and use Lifecycle tools with existing user permissions.
Lifecycle MCP lets external MCP clients use Lifecycle through one authenticated URL. Users add the URL, sign in with Lifecycle, and discover available tools.
Lifecycle MCP is different from an external MCP server that gives Lifecycle Agent more tools. See Connect external MCP servers for that task.
Lifecycle MCP requires administrator enablement. It accepts OAuth bearer tokens only.
Connect an MCP client
Ask your administrator for the Lifecycle MCP URL. The URL ends with /mcp.
- Add the URL as a remote HTTP MCP server in your client.
- Start the sign-in flow.
- Sign in with your Lifecycle account.
- Approve the requested access.
- Let the client discover the available tools.
The client uses OAuth discovery and handles registration automatically. You do not configure an OAuth client, API key, token claim, or Keycloak object.
Lifecycle applies your existing user permissions to every tool call. Lifecycle MCP does not grant access to an Environment, repository, Site, or action.
Understand the available tools
Lifecycle MCP groups its core tools into three capabilities. When Lifecycle Sites is enabled, clients also discover a fourth View Hosted Sites capability.
Understand Environments
| Tool | Result |
|---|---|
get_context | Shows useful Lifecycle context for the current user |
list_repositories | Lists repositories that the user can access |
preview_environment_config | Previews resolved Environment configuration |
validate_lifecycle_config | Validates Lifecycle configuration |
list_environments | Lists visible Environments |
get_environment | Gets bounded Environment state |
wait_for_environment | Waits for a specified Environment state |
Diagnose Environments
| Tool | Result |
|---|---|
diagnose_environment | Summarizes likely Environment problems |
get_logs | Gets a bounded, redacted log tail |
get_kubernetes_state | Gets bounded Kubernetes workload information |
Manage Environments
| Tool | Result |
|---|---|
create_environment | Creates an Environment |
configure_environment | Changes Environment configuration |
deploy_environment | Starts an Environment deployment |
extend_environment | Extends Environment expiration |
destroy_environment | Previews or destroys an exact Environment |
View Hosted Sites
When Sites is enabled, these tools are available:
| Tool | Result |
|---|---|
list_sites | Lists visible Sites |
get_site | Gets one visible Site |
An administrator can turn off all change tools. When change tools are off, clients do not discover them, and Lifecycle rejects their invocation.
Use tools safely
Lifecycle rechecks administrator policy and user authorization for every tool call. Administrator policy can reduce access, but it cannot add user permissions.
Environment reads return an immutable environmentId. Change and wait tools
use that exact identifier instead of a reusable Environment name.
Environment reads and create or deploy receipts include a lifecycleUiUrl
value. Open this URL to view the current deployment status in Lifecycle.
Environment creation uses an idempotency key. Other changes use the concurrency behavior of their underlying Lifecycle service.
Environment destruction uses two calls. The first call previews the exact Environment and returns a short-lived confirmation. The second call uses that confirmation.
Lifecycle bounds and redacts tool output. Treat repository content, logs, and Kubernetes events as untrusted evidence.
Enable Lifecycle MCP
An administrator enables Lifecycle MCP from Platform administration → Lifecycle MCP.
The page shows:
- whether Lifecycle MCP is on or off
- the canonical MCP URL
- an enable or disable control
- the Allow changes control
- capability and tool information
- one issue when enablement fails
Enablement is one bounded request. Lifecycle configures the required Keycloak sign-in settings and verifies them against the MCP URL.
Lifecycle stores the enabled setting only after verification succeeds. If enablement fails, Lifecycle keeps access off and shows one corrective action.
The first enablement makes a durable Keycloak realm configuration change. Disabling Lifecycle MCP does not revert that configuration.
During enablement, Lifecycle can remove Keycloak’s exact stock anonymous
Trusted Hosts component. Lifecycle does not replace a customized or
ambiguous component. A conflict keeps Lifecycle MCP off.
Disabling Lifecycle MCP closes tool access. It does not delete registered
OAuth clients, remove Lifecycle-managed Keycloak objects, or restore the stock
Trusted Hosts component.
When an administrator enables Lifecycle MCP again, Lifecycle reconciles and verifies the Keycloak configuration before it restores access.
The stored administrator policy has two fields:
Use the Settings page for normal administration. The typed administrator API
uses GET /api/v2/config/mcp and PUT /api/v2/config/mcp.
Prepare authentication
For a new bundled Keycloak realm, the supported chart creates private API service credentials during the initial realm import. It does not configure the MCP OAuth contract.
For an existing realm, a platform operator completes one management-client migration before enablement. Read Adopt Lifecycle MCP for the migration steps.
When an administrator enables Lifecycle MCP, Lifecycle API configures the fixed contract in bundled Keycloak. Normal MCP administration does not require a setup job or direct Keycloak changes.
Provisioning does not turn on Lifecycle authentication. Before you enable Lifecycle MCP, enable normal Lifecycle authentication. See Authentication.
Lifecycle validates every token before it runs a tool. It also applies the stored administrator controls and the signed-in user’s permissions.
Troubleshoot access
| Symptom | Action |
|---|---|
| The administrator cannot enable it | Follow the corrective action on the Lifecycle MCP page. |
| Sign-in does not start | Confirm that the client supports remote HTTP MCP with OAuth. |
| A tool is missing | Check Allow changes and your permissions. |
| A tool call is denied | Confirm that your Lifecycle account can perform the action. |
| An Environment change targets old state | Read the Environment again and use its current environmentId. |
| A destructive confirmation expires | Preview the destruction again. |
| Output is truncated | Narrow the request or use the Lifecycle UI, API, or CLI. |
Do not put OAuth tokens or client secrets in client configuration files, support messages, or logs.