opschain mcp serve

Included from Basic tier

opschain mcp serve [--http <addr>] [--auth-token <token>]

Serves OpsChain's curated tool vocabulary to a Model Context Protocol client. The command speaks MCP (JSON-RPC 2.0) to the assistant on one side and the OpsChain API to the targeted server (--server, OPSCHAIN_SERVER or the active context) on the other. It holds no enforcement logic of its own: every tool call is an API call under the configured credential, so a change an assistant raises still queues behind its approval policy, a denied read answers not found, and every invocation lands in the server's request log and audit trail with the tool name carried in the client identification.

Transports

• stdio (default) — for local assistants and IDEs: the client launches this command as a child process and exchanges one JSON-RPC message per line on stdin/stdout. Logs go to stderr (or --log-file), never stdout.
• streamable HTTP (--http <addr>) — for hosted clients: JSON-RPC messages POST to /mcp and each answers a single JSON response. This server does not offer SSE streaming — a client asking for the stream (HTTP GET) is refused politely, and every response fits one JSON body. TLS termination is the operator's reverse-proxy concern, as for any sidecar.

The handshake negotiates the protocol revision (2025-06-18 preferred; older clients are accepted per the protocol's negotiation rule) and advertises the toolset. Sampling and elicitation requests — a server asking the client's model or user for input — are refused by name.

Authentication

The credential decides the principal: --auth-token wins, the stored login for the targeted server otherwise. For unattended assistant use, configure a service-account token enrolled for that purpose so calls are attributed to a governed identity; a personal login is appropriate when the assistant acts as you. The server enforces exactly what that principal may see and do — tools whose underlying surface the licence does not entitle are omitted from the tool listing, and an authorisation refusal surfaces to the assistant verbatim as a tool error.

Flags

Flag	Meaning
--http <addr>	Serve the streamable HTTP transport on this listen address (e.g. 127.0.0.1:8137) instead of stdio.
--auth-token <token>	API token to authenticate with (default: the stored login for the targeted server).

Exit codes

0 after a clean shutdown (stdin closed on stdio, interrupt on HTTP); 2 for a usage error (no server targeted); 1 when the transport fails.

See also

• opschain docs integrations-mcp — connecting Claude Desktop, an IDE or a hosted client, with configuration samples.
• opschain docs cli/login — storing the credential the default lane uses.