LimaCharlie MCP
Server Configuration
Describes the environment variables required to run the server.
| Name | Required | Description | Default |
|---|---|---|---|
| LC_UID | No | User ID for user-scoped API keys. | |
| LC_API_KEY | No | LimaCharlie API key for env-based authentication. Use with LC_SECRET_PROVIDER=env. | |
| LC_API_ROOT | No | LimaCharlie API root URL. | https://api.limacharlie.io |
| LC_JWT_ROOT | No | JWT exchange root URL. | https://jwt.limacharlie.io |
| LC_AUTH_MODE | No | Auth selector. 'auto' or 'user_api_key'. Default: 'auto'. | auto |
| LC_VAULT_ADDR | No | Vault server URL. Required for Vault provider. | |
| LC_API_KEY_REF | No | Vault reference for the LimaCharlie API key. Default: 'vault://secret/data/limacharlie/mcp#api_key'. | vault://secret/data/limacharlie/mcp#api_key |
| LC_MCP_PROFILE | No | Profile filter: core, fleet, admin, content, detect, contain, evict, recover, review, or full-dev. | full-dev |
| LC_VAULT_TOKEN | No | Vault token value. Alternative to LC_VAULT_TOKEN_FILE. Avoid in shared configs. | |
| LC_USER_API_KEY | No | User-scoped LimaCharlie API key for env-based authentication. Requires LC_AUTH_MODE=user_api_key. | |
| LC_MCP_AUDIT_LOG | No | JSONL audit log path. | platform cache dir |
| LC_CASES_API_ROOT | No | Cases API root URL. | https://cases.limacharlie.io |
| LC_SECRET_PROVIDER | No | Credential provider. 'vault' or 'env'. Default: 'vault' when LC_API_KEY is unset. | vault |
| LC_VAULT_NAMESPACE | No | Optional Vault Enterprise namespace. | |
| LC_AI_SESSIONS_ROOT | No | AI-session governance API root URL. | https://ai.limacharlie.io |
| LC_USER_API_KEY_REF | No | Vault reference for a user-scoped LimaCharlie API key. | |
| LC_VAULT_TOKEN_FILE | No | File containing a Vault token. Alternative to LC_VAULT_TOKEN. | |
| LC_MCP_TIMEOUT_SECONDS | No | Per-command timeout in seconds. | 30 |
Instructions
Guidance the server publishes about itself, which clients place ahead of the tool catalog so the model reads it before choosing anything.
This server publishes no instructions, or was last inspected before Glama recorded them.
Capabilities
Features and capabilities supported by this server
Protocol revision2025-11-25
| Capability | Details |
|---|---|
| tools | {
"listChanged": false
} |
| prompts | {
"listChanged": false
} |
| resources | {
"subscribe": false,
"listChanged": false
} |
| experimental | {} |
Tools
Functions exposed to the LLM to take actions
| Name | Description |
|---|---|
| lc_tool_catalogB | Describe LimaCharlie MCP tools, inputs, bounds, side effects, and use cases. |
| lc_explain_permissionC | Explain LimaCharlie permissions and missing-permission failures in plain English. |
| lc_auth_whoamiB | Return the authenticated LimaCharlie API identity. Pass both oid and check_perm to test a specific permission in an explicit organization context. |
| lc_auth_statusC | Show LimaCharlie credential mode and cached JWT status without exposing secrets. |
| lc_auth_refreshB | Force a LimaCharlie JWT refresh using configured API-key credentials. |
| lc_list_orgsA | List organizations available to the authenticated LimaCharlie API key. |
| lc_list_sensor_download_targetsA | List supported sensor installer target URLs without downloading binaries. |
| lc_list_adapter_download_targetsA | List supported adapter binary target URLs without downloading binaries. |
| lc_review_org_postureC | Review org posture across fleet, outputs, access, content, cases, and optional detection noise. |
| lc_review_fleet_healthC | Summarize bounded sensor and online-sensor evidence for fleet health review. |
| lc_review_detection_noiseC | Summarize bounded detection volume and concentration for a time window. |
| lc_review_content_coverageC | Summarize D&R, FP, logging, integrity, YARA, and MITRE coverage evidence. |
| lc_review_case_backlogC | Summarize bounded case backlog and dashboard evidence. |
| lc_review_output_healthC | Summarize outputs, extension subscriptions, and feedback channel health. |
| lc_review_access_hygieneC | Summarize users, permissions, groups, and API-key hygiene evidence. |
| lc_list_sensorsA | List sensors for an explicit org, optionally filtered by selector. |
| lc_get_sensorB | Fetch one sensor by sensor ID for an explicit org. |
| lc_get_sensor_isolation_statusC | Check whether one sensor is currently network-isolated. |
| lc_get_sensor_seal_statusC | Check whether one sensor is currently sealed. |
| lc_wait_sensor_onlineA | Poll one sensor until it is online or a bounded timeout expires. |
| lc_preview_sensor_taskB | Preview tasking one sensor. No task is queued until confirmation. |
| lc_preview_isolate_sensorC | Preview isolating one sensor from the network. |
| lc_preview_rejoin_sensorC | Preview removing network isolation from one sensor. |
| lc_preview_seal_sensorC | Preview sealing one sensor against uninstall. |
| lc_preview_unseal_sensorC | Preview unsealing one sensor. |
| lc_preview_delete_sensorC | Preview deleting one sensor record. |
| lc_list_online_sensorsB | List currently online sensors or online sensor counts for an explicit org. |
| lc_list_detectionsB | List one bounded page of detections for an explicit org and unix-second time window. |
| lc_get_detectionB | Fetch a single detection by detection ID for an explicit org. |
| lc_list_casesC | List LimaCharlie cases for an explicit org, with optional filters. |
| lc_get_caseA | Fetch a LimaCharlie case by case number for an explicit org. |
| lc_preview_create_caseC | Preview creating a LimaCharlie case through ext-cases. |
| lc_preview_update_caseA | Preview updating a case. No write is sent until confirmation. |
| lc_preview_add_case_noteD | Preview adding a note to a case. |
| lc_preview_update_case_note_visibilityC | Preview changing a case note's public visibility. |
| lc_preview_bulk_update_casesC | Preview bulk-updating up to 200 cases. |
| lc_preview_merge_casesC | Preview merging source cases into a target case. |
| lc_list_case_detectionsC | List detections linked to a case. |
| lc_preview_add_case_detectionC | Preview linking a detection to a case. |
| lc_preview_remove_case_detectionC | Preview removing a detection link from a case. |
| lc_list_case_entitiesC | List entities attached to a case. |
| lc_search_case_entitiesC | Search case entities across an org. |
| lc_preview_add_case_entityD | Preview adding an entity/IOC to a case. |
| lc_preview_update_case_entityC | Preview updating a case entity note or verdict. |
| lc_preview_remove_case_entityC | Preview removing an entity from a case. |
| lc_list_case_telemetryC | List telemetry references linked to a case. |
| lc_preview_add_case_telemetryC | Preview linking telemetry to a case. |
| lc_preview_update_case_telemetryC | Preview updating case telemetry note or verdict. |
| lc_preview_remove_case_telemetryC | Preview removing telemetry from a case. |
| lc_list_case_artifactsC | List forensic artifacts linked to a case. |
| lc_preview_add_case_artifactC | Preview adding a forensic artifact reference to a case. |
| lc_preview_remove_case_artifactC | Preview removing a forensic artifact reference from a case. |
| lc_export_caseC | Export a case with detections, entities, telemetry, and artifacts. |
| lc_get_cases_report_summaryC | Get Cases report summary metrics. |
| lc_get_cases_dashboard_countsC | Get Cases dashboard counts. |
| lc_get_cases_configD | Get Cases configuration for an org. |
| lc_preview_set_cases_configC | Preview replacing Cases configuration for an org. |
| lc_list_case_assigneesC | List unique case assignee emails for an org. |
| lc_list_case_orgsA | List ext-cases organizations accessible to the caller. |
| lc_preview_set_case_tagsC | Preview replacing all tags on a case. |
| lc_preview_add_case_tagsC | Preview adding tags to a case by replacing the exact merged tag list. |
| lc_preview_remove_case_tagsB | Preview removing tags from a case by replacing the exact remaining tag list. |
| lc_list_sensor_eventsC | List one bounded page of historical events for one sensor. |
| lc_get_sensor_event_overviewC | Fetch event timeline overview for one sensor and time window. |
| lc_get_eventC | Fetch one sensor event by atom. |
| lc_list_child_eventsC | Fetch child events for a parent event atom. |
| lc_get_event_retentionC | Fetch retained event count/statistics for one sensor and time window. |
| lc_search_iocC | Search Insight prevalence or locations for one IOC/object. |
| lc_batch_search_iocsC | Batch Insight prevalence or location lookup for bounded IOC groups. |
| lc_get_object_informationD | Lookup one object through Insight with enrichment-oriented naming. |
| lc_get_insight_statusC | Check whether Insight retention appears enabled for an org. |
| lc_validate_search_queryB | Validate LCQL through the org search service before estimation or execution. |
| lc_estimate_search_queryC | Estimate an LCQL query against an explicit unix-second time window. |
| lc_execute_search_queryB | Start a paginated LCQL search and return a query_id for bounded polling. |
| lc_poll_search_queryC | Poll one bounded LCQL search page, returning checkpoint state for resume. |
| lc_cancel_search_queryC | Cancel a running LCQL search job. |
| lc_list_saved_queriesC | List saved LCQL queries stored in the query hive. |
| lc_get_saved_queryC | Fetch one saved LCQL query by name. |
| lc_preview_set_saved_queryC | Preview creating or updating one saved LCQL query. |
| lc_preview_delete_saved_queryC | Preview deleting one saved LCQL query. |
| lc_execute_saved_queryC | Load a saved query and start a paginated LCQL search job. |
| lc_validate_replay_ruleC | Validate a D&R rule through Replay using a dry-run minimal event. |
| lc_replay_scan_eventsC | Dry-run a D&R rule against explicit events through Replay. |
| lc_replay_dry_runB | Dry-run a D&R rule against historical data without creating detections. |
| lc_list_artifactsC | List one bounded page of artifacts for an org, sensor, time window, or cursor. |
| lc_get_artifact_urlC | Request original artifact payload or signed export URL. |
| lc_list_payloadsC | List payload metadata for an org without downloading payload bytes. |
| lc_get_payload_download_urlC | Request payload API metadata, including a signed download URL when returned. |
| lc_preview_payload_upload_urlC | Preview requesting a signed payload upload URL without uploading bytes. |
| lc_preview_delete_payloadD | Preview deleting a payload. |
| lc_get_arlC | Resolve a LimaCharlie authenticated resource locator. |
| lc_list_jobsB | List service jobs for an explicit org and time window. |
| lc_get_jobC | Fetch one service job. |
| lc_wait_jobB | Poll one service job until terminal state or bounded timeout. |
| lc_preview_delete_jobC | Preview deleting one service job record. |
| lc_list_reliable_tasksC | List pending reliable-tasking extension tasks for an org. |
| lc_preview_reliable_taskC | Preview queueing one reliable task through ext-reliable-tasking. |
| lc_preview_delete_reliable_taskC | Preview cancelling one pending reliable task through ext-reliable-tasking. |
| lc_list_audit_logsC | List one bounded page of org audit logs for a time window. |
| lc_list_tagsC | List tags observed across sensors in an org. |
Prompts
Interactive templates invoked by user choice
| Name | Description |
|---|---|
No prompts | |
Resources
Contextual data attached and managed by the client
| Name | Description |
|---|---|
No resources | |
TDQS
Scored across 297 tools
The tool set contains many near-identical resource families, such as list/get/preview_set/preview_delete/preview_set_enabled wrappers for secrets, lookups, cloud adapters, external adapters, playbooks, SOPs, org notes, AI agents, AI skills, and generic Hive records. Memory tools like lc_get_ai_memory, lc_get_ai_memory_record, lc_list_ai_memories, and lc_list_ai_memory_records further blur boundaries, making misselection likely.
Most tools follow a consistent lc_verb_noun pattern, especially list/get/preview_set/preview_delete, which is helpful at scale. However, there are minor deviations such as lc_auth_whoami, lc_tool_catalog, lc_fetch_config, and the mixed use of preview_set versus preview_create/preview_update for similar operations.
297 tools is an extreme count for any MCP server, far beyond the well-scoped range. Even with LimaCharlie's broad platform surface, this volume overwhelms agents and makes tool selection and reasoning impractical.
The tool surface is exceptionally broad, covering org management, sensors, detections, cases, D&R rules, Hive records, vulnerability data, AI sessions, and many extension-based workflows. Minor lifecycle gaps exist, such as no single-output get/update, no case deletion, and no case-note update/delete, but most workflows can proceed without dead ends.