# LucidLink (pypi · lucidlink-mcp)

Read, write, search, lock and audit files in LucidLink filespaces, plus workspace admin tools.

- Trust score: 44/100 (low)
- Change this week: +3
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-11-05

## Components

- pypi · `lucidlink-mcp`: 44/100 (this document), [markdown](https://verifymcp.io/servers/com-lucidlink-mcp/lucidlink-mcp.md), [page](https://verifymcp.io/servers/com-lucidlink-mcp/lucidlink-mcp)

## Channel facts

- Registry: `pypi`
- Package: `lucidlink-mcp`
- Version: `1.0.1`
- Transport: `stdio`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-11-05.

- **Supply Chain Security**: 26/100
  - Malware scan not yet available for this package.
  - CVE check failed: a known high-severity CVE affects mcp 2.0.0, a direct dependency. A fixed version is available.
  - Declares code that runs automatically (setup.py, a custom setup.py cmdclass) and that we could not recognise. It may be perfectly ordinary, but we have not established what it does.
  - 1 of 32 dependencies flagged as unhealthy.
- **Provenance & Transparency**: 6/100
  - Repository check failed: no source repository is declared.
  - Provenance check failed: no build-provenance attestation is published.
  - License check failed: the license (LicenseRef-Proprietary) isn't a recognized OSI-approved license.
  - Actively maintained (last published 11 days ago).
  - Disclosure check failed: no security disclosure policy was found in the source repository.
- **Schema Quality & AI Usability**: 64/100
  - AI-judged instruction clarity (good).
  - Context-footprint check failed: tool/resource definitions use about 7491 tokens (~159/item across 47 items; 47 tools + 0 resources), over budget; trim descriptions and params.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 53/100
  - Stability observed for 16 of 30 days with no destabilising changes; credit accrues until the full window elapses.
- **Tool Coverage**: 79/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 28% of tool parameters carry a description.
  - Structured output schemas are declared (100% of tools); any adoption earns full credit.
- **Tool Safety**: 100/100
  - No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.
  - All 7 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation.
  - An AI judge read all 48 captured unit(s) of tool text and found none that tries to manipulate the model reading it.
- **Capabilities**: 100/100
  - Implements a current MCP spec version (2026-07-28).

## Install

### How do I install the LucidLink MCP server?

LucidLink runs locally as a PyPI package, launched with uvx lucidlink-mcp. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.

### Claude

```bash
claude mcp add com-lucidlink-mcp -- uvx lucidlink-mcp
```

### Cursor

```json
{
  "mcpServers": {
    "com-lucidlink-mcp": {
      "command": "uvx",
      "args": [
        "lucidlink-mcp"
      ]
    }
  }
}
```

### VS Code

```json
{
  "servers": {
    "com-lucidlink-mcp": {
      "command": "uvx",
      "args": [
        "lucidlink-mcp"
      ]
    }
  }
}
```

### Codex

```bash
codex mcp add com-lucidlink-mcp -- uvx lucidlink-mcp
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "com-lucidlink-mcp": {
      "type": "local",
      "command": [
        "uvx",
        "lucidlink-mcp"
      ],
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add com-lucidlink-mcp --command uvx --arg lucidlink-mcp
```

### Hermes

```yaml
mcp_servers:
  com-lucidlink-mcp:
    command: "uvx"
    args: ["lucidlink-mcp"]
```

### Netclaw

```json
{
  "McpServers": {
    "com-lucidlink-mcp": {
      "Transport": "stdio",
      "Command": "uvx",
      "Arguments": [
        "lucidlink-mcp"
      ]
    }
  }
}
```

### Vellum

```bash
assistant mcp add com-lucidlink-mcp -t stdio -c uvx -a lucidlink-mcp
```

### Other

```json
{
  "mcpServers": {
    "com-lucidlink-mcp": {
      "command": "uvx",
      "args": [
        "lucidlink-mcp"
      ]
    }
  }
}
```

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-11-04 (score 44, +1)

No change was recorded against any check on this day. Stability & Change Management went from 47 to 50. That category is still filling its 30-day observation window: 14 days of observed history at the previous scan, 15 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-11-03 (score 43, −15)

- [security regression] Malware scan: pass → unverified

### 2026-11-02 (score 58, +1)

No change was recorded against any check on this day. Stability & Change Management went from 40 to 43. That category is still filling its 30-day observation window: 12 days of observed history at the previous scan, 13 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-10-31 (score 57, +16)

- [security improvement] Malware scan: unverified → pass

### 2026-10-29 (score 41, −15)

- [security regression] Malware scan: pass → unverified

### 2026-10-28 (score 56, +1)

- [security regression] CVE-2026-116685 affects this package: high
- [security regression] CVE-2026-116686 affects this package: high
- [security regression] CVE-2026-116684 affects this package: high

### 2026-10-26 (score 55, +1)

No change was recorded against any check on this day. Stability & Change Management went from 17 to 20. That category is still filling its 30-day observation window: 5 days of observed history at the previous scan, 6 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-10-25 (score 54, +15)

- [security improvement] Malware scan: unverified → pass

## MCP tools (47)

### `list_filespaces` (~79 tokens)

List filespaces visible to a service account.

Returns a newline-separated list of ``name (id)`` entries, marking the
ones currently linked. Call this first if you don't know which
filespace to operate on. ``account`` selects a configured account
(default: the current one; see ``list_accounts``).

Input parameters:

- `account`

Output parameters:

- `result` (string)

### `link_filespace` (~211 tokens)

Make a filespace the current one for filesystem / locking / audit
tools, linking it if needed.

\``name`` accepts the short name, the id, or the globally unique full
name ``<filespace>.<workspace>``. Resolution is CROSS-ACCOUNT: when
the current account can't see it, the other configured accounts are
searched and the current account switches automatically (the output
says so) — no use_account needed first.

ADDITIVE: any previously linked filespaces stay live (their locks and
subscriptions survive), so switching back later is instant. Links
count against a per-account cap (``maxLinkedFilespaces``);
\``unlink_filespace(name=...)`` frees a slot. A linked filespace
allocates a 1 GiB disk cache that stays until the server exits.
\``account`` pins the lookup to one configured account; a successful
link always makes its account the current one.

Input parameters:

- `account`
- `name` (string, required)

Output parameters:

- `result` (string)

### `current_filespace` (~30 tokens)

Return the current account's linked filespaces (current one first),
or a hint if none is linked.

Output parameters:

- `result` (string)

### `unlink_filespace` (~141 tokens)

Detach ONE linked filespace (the current one when ``name`` is
omitted); other links stay live.

Releases that link's connection to the hub and frees a slot under the
link cap; its disk cache stays until the server exits.
Its byte-range locks and change subscriptions are dropped — locks and
subscriptions on OTHER filespaces are untouched. A named filespace is
resolved across every account's live links. The next filespace
operation falls back to another linked filespace, or re-links
automatically (the default/only filespace, or it asks you to pick).

Input parameters:

- `account`
- `name`

Output parameters:

- `result` (string)

### `list_accounts` (~71 tokens)

List the configured named accounts (service-account identities).

Marks the current account (the one tools use when no ``account``
argument is given) and shows each account's login state and linked
filespaces. Switch with ``use_account(name)``. Single-token setups
have exactly one account named "default".

Output parameters:

- `result` (string)

### `use_account` (~69 tokens)

Switch the current account for subsequent tool calls.

Filespace links (and their locks/subscriptions) are PER ACCOUNT and
stay live across switches — switching back restores that account's
context as you left it. Authentication happens lazily on the first
filespace operation.

Input parameters:

- `name` (string, required)

Output parameters:

- `result` (string)

### `register_account` (~146 tokens)

Register a minted credential as a named account for THIS session.

Reads the bearer token from a credential file that
\``mint_service_account_admin`` / ``create_identity_admin`` wrote
(``~/.lucidlink/sa-<frag>.id-<frag>.token`` — the mint output prints
the exact path); the token itself never appears in tool output.
Session-scoped: gone on server restart — persist an account with
\``lucidlink-mcp-setup --account NAME`` instead. Switch to it with
\``use_account(name)``; authentication happens lazily on first use.

Input parameters:

- `name` (string, required)
- `token_path` (string, required)

Output parameters:

- `result` (string)

### `unregister_account` (~96 tokens)

Drop a session-registered account (the inverse of ``register_account``).

Unlinks its filespaces and closes its client. Only accounts added via
\``register_account`` can be dropped — configured accounts can't (they
would come back on restart), and neither can the CURRENT account
(switch away with ``use_account`` first). Typical teardown order:
switch home → revoke/delete the credential → unregister.

Input parameters:

- `name` (string, required)

Output parameters:

- `result` (string)

### `whoami` (~65 tokens)

Return the current agent's identity and session state.

Includes service account name + id, workspace id, token status/expiry,
and the currently-linked filespace (if any). Use it at the start of a
multi-agent session so each agent knows which identity it is acting as.

Output parameters:

- `result` (string)

### `read_file` (~201 tokens)

Read file content from the linked filespace.

\``offset``/``length`` are byte counts (use ``read_lines`` for line
ranges). With no ``length``, a file over the read cap is refused —
pass a ``length`` slice; a ``length`` over the cap is clipped and the
result says so. The cap is the ``readSizeCap`` config key.

\``encoding``: ``auto`` (default) returns plain UTF-8 text for text
content (``OK text N bytes:``) and base64 for binary
(``OK base64 N bytes:``); ``text`` forces text (errors on binary);
\``base64`` forces base64 (binary-safe round-trips).

Input parameters:

- `encoding` (string)
- `length`
- `offset` (integer)
- `path` (string, required): POSIX-style filespace path, rooted at / (e.g. /data/file.txt)

Output parameters:

- `result` (string)

### `write_file` (~227 tokens)

Write file content to the linked filespace.

\``content`` is plain UTF-8 text by default; pass ``encoding='base64'``
with base64-encoded content to write binary bytes.

Missing parent directories are created automatically; pass
\``create_parents=false`` to error on a missing parent instead.

\``exclusive=true`` holds a whole-file exclusive lock for the write
(released on close) to coordinate with other clients writing the same
file.

\``sync=true`` (default) flushes to the hub immediately, so the write is
durable and visible to other clients. ``sync=false`` skips that flush
for fast bulk writes; you MUST call ``sync_filespace`` afterward or the
unsynced writes are LOST when the session ends.

Input parameters:

- `content` (string, required)
- `create_parents` (boolean)
- `encoding` (string)
- `exclusive` (boolean)
- `path` (string, required): POSIX-style filespace path, rooted at / (e.g. /data/file.txt)
- `sync` (boolean)

Output parameters:

- `result` (string)

### `write_at` (~345 tokens)

Overwrite bytes at a byte ``offset`` in an existing file, preserving
the rest.

Unlike ``write_file`` (which replaces the whole file), this patches in
place: it writes the given bytes starting at ``offset`` and leaves every
other byte untouched. It never truncates and never creates the file.
Use it for fixed-layout edits — a header, a fixed-width record, a
reserved placeholder. To coordinate the same range with other writers,
take a ``lock_byte_range`` first, or pass ``exclusive=true`` for a
one-call whole-file-locked patch.

\``content`` is plain UTF-8 text by default; pass ``encoding='base64'``
with base64-encoded content to write binary bytes.

Mirrors POSIX ``pwrite``: an ``offset`` past the end of the file
zero-fills the gap, so a large ``offset`` grows the file with zero bytes.
When a write grows the file the result says ``GREW file old->new bytes``
— for a fixed-layout patch that usually means the ``offset`` was wrong.

\``sync=true`` (default) flushes to the hub immediately; ``sync=false``
skips the flush for bulk writes — you MUST call ``sync_filespace``
afterward or the unsynced writes are LOST when the session ends.

Input parameters:

- `content` (string, required)
- `encoding` (string)
- `exclusive` (boolean)
- `offset` (integer, required)
- `path` (string, required): POSIX-style filespace path, rooted at / (e.g. /data/file.txt)
- `sync` (boolean)

Output parameters:

- `result` (string)

### `sync_filespace` (~53 tokens)

Flush all pending writes to the hub, making them durable and visible
to other clients. Call this after ``write_file(sync=false)`` batches;
unsynced writes are lost if the session ends before a sync.

Output parameters:

- `result` (string)

### `list_files` (~62 tokens)

List entries in a directory of the linked filespace.

\``pattern`` is an fnmatch glob applied to entry names.

Input parameters:

- `path` (string): POSIX-style filespace path, rooted at / (e.g. /data/file.txt)
- `pattern`

Output parameters:

- `result` (string)

### `get_entry` (~115 tokens)

Return metadata for a single file or directory.

\``ctime``/``mtime`` are epoch nanoseconds; the ``*_iso`` twins are
the same instants in ISO 8601 UTC — paste them straight into
\``read_audit_trail``'s ``time_range`` (e.g. ``'<ctime_iso>/'``) to
scope an audit query to the entry's lifetime.

Input parameters:

- `path` (string, required): POSIX-style filespace path, rooted at / (e.g. /data/file.txt)

Output parameters:

- `result` (string)

### `create_directory` (~59 tokens)

Create a directory, including any missing parent directories
(``mkdir -p``). Succeeds if the directory already exists.

Input parameters:

- `path` (string, required): POSIX-style filespace path, rooted at / (e.g. /data/file.txt)

Output parameters:

- `result` (string)

### `delete_path` (~70 tokens)

Delete a file or directory.

For directories, pass ``recursive=true`` to delete non-empty ones.
Hosts that honor tool annotations prompt before this fires.

Input parameters:

- `path` (string, required): POSIX-style filespace path, rooted at / (e.g. /data/file.txt)
- `recursive` (boolean)

Output parameters:

- `result` (string)

### `truncate_file` (~125 tokens)

Truncate or extend an existing file to exactly ``size`` bytes.

\``size=0`` clears the file in place (keeps the path); a smaller size
drops the tail; a larger size pads with zero bytes. Moves no file data,
so it is cheap on large files. Use it to roll back an append, repair a
partial write, or empty a file. Syncs to the hub after.

Input parameters:

- `path` (string, required): POSIX-style filespace path, rooted at / (e.g. /data/file.txt)
- `size` (integer, required)

Output parameters:

- `result` (string)

### `move_path` (~71 tokens)

Move/rename within the same filespace (atomic where possible).

Input parameters:

- `dst` (string, required): POSIX-style filespace path, rooted at / (e.g. /data/file.txt)
- `src` (string, required): POSIX-style filespace path, rooted at / (e.g. /data/file.txt)

Output parameters:

- `result` (string)

### `find_files` (~142 tokens)

Find files / directories by name (fnmatch glob).

\``name_pattern``: shell-style glob, e.g. ``'*.py'``, ``'*report*'``.
\``limit``: max paths returned (clamped to 1000).

Walks the filespace tree under ``path_prefix``. Stops at the configured
walk budget (default 5000 entries / 30s) and reports partial results.

Input parameters:

- `limit` (integer)
- `name_pattern` (string, required)
- `path_prefix` (string): POSIX-style filespace path, rooted at / (e.g. /data/file.txt)
- `type_filter`

Output parameters:

- `result` (string)

### `grep_files` (~217 tokens)

Search file CONTENTS via Python regex (re.search).

\``pattern`` is a Python regex applied per line. ``include_pattern`` /
\``exclude_pattern`` are fnmatch globs filtering filenames before reading;
an excluded directory is skipped whole (``exclude_pattern='node_modules'``
never enters one). ``path_prefix`` itself is never excluded.
Files larger than ``max_file_size_bytes`` are skipped. ``limit`` is
clamped to 1000; the walk stops at the global budget and reports
partial results.

Walking the tree via the SDK is slower than native grep on a local FS —
prefer narrow ``path_prefix`` and ``include_pattern`` for large filespaces.

Input parameters:

- `case_sensitive` (boolean)
- `exclude_pattern`
- `include_pattern`
- `limit` (integer)
- `max_file_size_bytes` (integer)
- `path_prefix` (string): POSIX-style filespace path, rooted at / (e.g. /data/file.txt)
- `pattern` (string, required)

Output parameters:

- `result` (string)

### `tree` (~260 tokens)

Map the directory hierarchy, grouped under full directory paths.

\``ls -R`` style: every directory is named in full once, with its entries
beneath it and a blank line between directories, so each path in the
output is usable as-is — nothing has to be rebuilt from indentation.
A directory shown with a trailing ``…`` was not expanded because
\``max_depth`` stopped there; a header with nothing beneath it is an
empty directory. ``max_entries_per_dir`` caps each listing; out-of-range
arguments are clamped and the clamp is reported.

\``exclude_pattern`` (fnmatch on entry names) hides matching entries and
skips their subtrees entirely, so they cost nothing against the walk
budget. The default hides the audit trail — query that with
\``read_audit_trail``, or map it via ``tree(path="/.lucid_audit")``,
which works because exclusion never applies to ``path`` itself. Pass
null to map everything.

Input parameters:

- `exclude_pattern`
- `max_depth` (integer)
- `max_entries_per_dir` (integer)
- `path` (string): POSIX-style filespace path, rooted at / (e.g. /data/file.txt)

Output parameters:

- `result` (string)

### `read_lines` (~97 tokens)

Read a line-range from a text file.

Lines are 1-indexed and inclusive. Omit ``end_line`` to read to EOF.
Useful for inspecting a specific section of a large file without
pulling the whole thing across the wire.

Input parameters:

- `end_line`
- `path` (string, required): POSIX-style filespace path, rooted at / (e.g. /data/file.txt)
- `start_line` (integer)

Output parameters:

- `result` (string)

### `edit_lines` (~262 tokens)

Replace lines [start_line, end_line] (inclusive, 1-indexed) with ``new_content``.

\``new_content`` may be empty (deletes those lines) or contain newlines
(multi-line replacement). A trailing newline is added to the file body
if missing. Pass ``dry_run=true`` for a preview without writing.

\``expected_content`` (recommended): the text you believe lines
[start_line, end_line] currently contain. If the file has changed
since you read it, the edit is refused and the actual content is
shown — so you never clobber lines that drifted under you. In
multi-agent filespaces, pair this with ``claim_file``.

NOTE: the file is rewritten with LF line endings — CRLF (and unicode
line separators) are normalized to ``\n`` across the whole file. Use
\``search_replace`` to edit a CRLF file without changing its endings.

Input parameters:

- `dry_run` (boolean)
- `end_line` (integer, required)
- `expected_content`
- `new_content` (string, required)
- `path` (string, required): POSIX-style filespace path, rooted at / (e.g. /data/file.txt)
- `start_line` (integer, required)

Output parameters:

- `result` (string)

### `append_file` (~116 tokens)

Append to a file (creates if missing).

\``content`` is plain UTF-8 text by default; pass ``encoding='base64'``
with base64-encoded content to append binary bytes. Use for log-style
writes where you don't want to read-modify-write the whole file.
Syncs to the hub after the append.

Input parameters:

- `content` (string, required)
- `encoding` (string)
- `path` (string, required): POSIX-style filespace path, rooted at / (e.g. /data/file.txt)

Output parameters:

- `result` (string)

### `search_replace` (~152 tokens)

sed-style find-and-replace within a single text file.

\``regex=false`` does literal substring replace. ``regex=true``
treats ``find`` as a Python regex; ``\1`` etc. in ``replace`` reference
groups. ``dry_run=true`` reports what would change without writing.
Omit ``max_replacements`` to replace every match.

Input parameters:

- `case_sensitive` (boolean)
- `dry_run` (boolean)
- `find` (string, required)
- `max_replacements`
- `path` (string, required): POSIX-style filespace path, rooted at / (e.g. /data/file.txt)
- `regex` (boolean)
- `replace` (string, required)

Output parameters:

- `result` (string)

### `copy_file` (~126 tokens)

Copy/duplicate/back up a file within the filespace.

Streams ``src`` to ``dst`` in chunks through the daemon's encryption
layer (ZK preserved end-to-end; memory stays bounded, so large media
files are fine). Set ``overwrite=true`` to replace an existing
destination.

Input parameters:

- `dst` (string, required): POSIX-style filespace path, rooted at / (e.g. /data/file.txt)
- `overwrite` (boolean)
- `src` (string, required): POSIX-style filespace path, rooted at / (e.g. /data/file.txt)

Output parameters:

- `result` (string)

### `filespace_stats` (~49 tokens)

Summarize the linked filespace: entry count, stored size, and
external-file totals. For a files-vs-directories breakdown, use
\``count_files`` (a tree walk).

Output parameters:

- `result` (string)

### `count_files` (~163 tokens)

Count files and directories under a path, optionally filtered by name pattern.

Walks the tree like ``tree`` / ``find_files`` but only returns totals —
useful for quick "how big is this directory?" checks before deciding to
grep through it. Honors the global walk budgets.

\``include_pattern``/``exclude_pattern`` are fnmatch globs on the entry
NAME (``*.mp4``), not the path; exclude wins, and an excluded directory
is skipped whole: nothing below it is counted or visited.
\``path_prefix`` itself is never excluded.

Input parameters:

- `exclude_pattern`
- `include_pattern`
- `path_prefix` (string): POSIX-style filespace path, rooted at / (e.g. /data/file.txt)

Output parameters:

- `result` (string)

### `lock_byte_range` (~305 tokens)

Acquire a byte-range lock on a file in the current filespace.

\``mode``: ``exclusive`` excludes every other lock taker; ``shared``/
\``read`` (synonyms) admit other shared takers; ``write`` is a protected
write lock. Locks are advisory: they exclude other lock takers
(``lock_byte_range``, ``claim_file``, ``exclusive=true`` writes), never
plain reads or writes, so every writer to be kept out must take the
lock too.
\``blocking=true`` waits until acquired, up to the daemon's IO timeout
(then errors — call again to keep waiting); ``false`` returns
immediately with ``BLOCKED`` when the range is held.

Returns an opaque handle_id token. Pass it to ``unlock_byte_range``
to release (works even after switching filespace or account — the
handle remembers where it lives).

To modify the locked range, use ``write_at(path, offset, ...)`` for a
positional patch (or ``write_file`` to replace the whole file).

Input parameters:

- `blocking` (boolean)
- `length` (integer, required)
- `mode` (string): exclusive = no other locks; shared = concurrent readers ('read' is an alias for it); write = protected write lock
- `offset` (integer, required)
- `path` (string, required): POSIX-style filespace path, rooted at / (e.g. /data/file.txt)

Output parameters:

- `result` (string)

### `unlock_byte_range` (~72 tokens)

Release a byte-range lock and close the underlying handle.

Pass both ``offset`` and ``length`` to unlock that range, or neither
to unlock every range on the handle — one without the other is
rejected.

Input parameters:

- `handle_id` (integer, required)
- `length`
- `offset`

Output parameters:

- `result` (string)

### `claim_file` (~222 tokens)

Acquire an exclusive (or shared) lock over an ENTIRE file.

Convenience over ``lock_byte_range`` — gets the file's current size and
locks from offset 0. Useful when an agent just wants "let me edit this
file safely without worrying about byte ranges."

Returns an opaque handle_id; pass it to ``release_file`` when done.
\``blocking=false`` returns ``BLOCKED`` instead of waiting. Advisory,
like ``lock_byte_range``: it excludes other lock takers, not plain writes.

Note: if the file grows after you claim it, the new bytes are NOT
covered by your lock. For files that may grow during your edit, use
\``lock_byte_range`` with an explicit, conservative length.

Input parameters:

- `blocking` (boolean)
- `mode` (string): exclusive = no other locks; shared = concurrent readers ('read' is an alias for it); write = protected write lock
- `path` (string, required): POSIX-style filespace path, rooted at / (e.g. /data/file.txt)

Output parameters:

- `result` (string)

### `release_file` (~60 tokens)

Release a previously claimed file (companion to ``claim_file``).

Releases all byte-range locks held on the handle and closes it.
Equivalent to ``unlock_byte_range(handle_id)`` with no offset/length.

Input parameters:

- `handle_id` (integer, required)

Output parameters:

- `result` (string)

### `list_locks_held` (~124 tokens)

List byte-range locks currently held by THIS MCP process.

Shows handle_id, filespace, path, byte range, mode, and how long held
— across every linked filespace and account. Process-local — locks
held by other agents (other MCP servers / other clients) won't appear
here, and no API exists to enumerate them. To probe whether someone
else holds a lock, attempt a non-blocking acquire (``blocking=false``):
a ``BLOCKED`` answer means it's held. The audit trail records file
operations, not lock events.

Output parameters:

- `result` (string)

### `read_audit_trail` (~511 tokens)

Query the linked filespace's audit trail (NDJSON under .lucid_audit/).

Events are returned NEWEST FIRST; ``limit`` keeps the newest N, so
"what changed last?" is one call: mode=search, a small limit, and
optionally action=FileWritten / FileCreate to exclude reads.

Note a recording-to-readable LAG: an event can take a short while to
appear here after the operation. Don't treat a just-made change being
absent as "not recorded" — re-read after a moment.

Mode extras: user_activity needs user, file_history needs path_prefix,
aggregate needs group_by — and ignores limit (top 50 groups).
path_prefix scopes to one entry: the exact path or
anything under it as a directory (/reports does not match
/reports-archive). time_range accepts '24h' / '7d' / '30m' or an ISO
range 'from/to' with either side omittable ('2026-01-01/2026-02-01',
'2026-07-01/'); range ends are midnight-UTC of the named day, so an
inclusive "through June" range ends at 07-01. Epoch seconds/millis/
micros/nanos also work as range endpoints. Pass time_range=None for no
time filter — '' is rejected, as is path_prefix=''.

SCOPING FOR SPEED: logs are month-partitioned and pruned by
time_range BEFORE any I/O — a tight range skips whole months of
reading. For one existing file's history, call get_entry(path)
first and start the range at creation: time_range='<ctime_iso>/'.
Its mtime_iso is a safe UPPER bound only for content-write history
(moves/renames do not bump mtime; reads never do) — for
move/delete/read history leave the range open-ended. Deleted files
have no get_entry: fall back to path_prefix (or action=FileDelete)
over an explicit wider range. Renames change entry_path, so
path_prefix misses pre-rename history regardless of time scoping.

Input parameters:

- `action`
- `group_by`
- `limit` (integer)
- `mode` (string)
- `path_prefix`: scope to this entry and everything under it (/reports does not match /reports-archive)
- `time_range`
- `user`

Output parameters:

- `result` (string)

### `verify_token` (~67 tokens)

Check whether the CURRENT account's LucidLink token is accepted.

Follows use_account switches. Does NOT require the daemon. Single
HTTPS round-trip (~0.5s). Returns a one-line status; a missing or
rejected token is an error carrying a hint to fix it.

Output parameters:

- `result` (string)

### `subscribe_changes` (~163 tokens)

Open a cursor on audit events under a path prefix of the CURRENT filespace.

Returns a ``subscription_id``. Call ``poll_changes(subscription_id=...)``
to retrieve events newer than the last poll — the cursor stays bound to
this filespace even if you switch to another one. Call
\``unsubscribe_changes`` to stop; unlinking the filespace drops it.

PULL-based: nothing arrives between your ``poll_changes`` calls, and the
FIRST poll replays up to an hour of pre-subscribe history rather than
starting empty. ``poll_interval`` is an advisory pacing hint only.

Input parameters:

- `path_prefix` (string): POSIX-style filespace path, rooted at / (e.g. /data/file.txt)
- `poll_interval`

Output parameters:

- `result` (string)

### `poll_changes` (~100 tokens)

Return audit events newer than the last poll, oldest-first.

Rows are raw audit records: ONE user-visible action can fan out to many
(a macOS safe-save of a single file emits create/write/move/move/delete
across a temp sibling). Read the sequence, don't count it.

\``limit`` clamps to 200; anything over stays queued for the next poll.

Input parameters:

- `limit` (integer)
- `subscription_id` (string, required)

Output parameters:

- `result` (string)

### `unsubscribe_changes` (~29 tokens)

Close a subscription's cursor (on whichever filespace it lives).

Input parameters:

- `subscription_id` (string, required)

Output parameters:

- `result` (string)

### `list_data_stores` (~24 tokens)

List data stores registered on the linked filespace, with their kind.

Output parameters:

- `result` (string)

### `link_external_file` (~102 tokens)

Link an S3 object as a read-only file in the linked filespace.

\``data_store_name`` is an S3 data store; ``object_id`` is the S3 object
key, which the daemon looks up in the bucket before linking.

Input parameters:

- `data_store_name` (string, required)
- `object_id` (string, required)
- `path` (string, required): POSIX-style filespace path, rooted at / (e.g. /data/file.txt)

Output parameters:

- `result` (string)

### `link_external_url` (~184 tokens)

Link a direct HTTP/HTTPS URL as a read-only file in the filespace.

On filespace format 3.8 and newer the link belongs to an HTTP-link data
store: pass its ``data_store_name`` (list_data_stores shows them,
register_data_store(kind="http_link") makes one). Below 3.8 omit it; a
wrong choice is answered with the rule for this filespace. The URL is
passed as an argument, so avoid embedding long-lived secrets; prefer
public or short-lived signed URLs.

Input parameters:

- `data_store_name`
- `path` (string, required): POSIX-style filespace path, rooted at / (e.g. /data/file.txt)
- `url` (string, required): Direct http(s) URL; the daemon fetches it server-side (internal/loopback hosts refused unless the operator allows them)

Output parameters:

- `result` (string)

### `update_external_url` (~130 tokens)

Repoint an existing HTTP/HTTPS external-file link to a new URL.

\``path`` is an existing link created by ``link_external_url``. The new
URL must serve the same content (the daemon refuses a different size):
this refreshes an expired or moved URL, it does not swap the content.

Input parameters:

- `new_url` (string, required): Direct http(s) URL; the daemon fetches it server-side (internal/loopback hosts refused unless the operator allows them)
- `path` (string, required): POSIX-style filespace path, rooted at / (e.g. /data/file.txt)

Output parameters:

- `result` (string)

### `list_external_files` (~62 tokens)

Paginated listing of files linked from a data store.

Pass the ``cursor`` from the output's "more available" note to fetch
the next page.

Input parameters:

- `cursor`
- `data_store_name` (string, required)
- `limit` (integer)

Output parameters:

- `result` (string)

### `unlink_external_file` (~111 tokens)

Remove an external-file link from the filespace.

Inverse of ``link_external_file`` / ``link_external_url``: drops the
link only; the S3 object or URL target is untouched. A link is removed
like any file, so on a regular file this is a delete: confirm the path
with list_external_files first, and use delete_path for regular files.

Input parameters:

- `path` (string, required): POSIX-style filespace path, rooted at / (e.g. /data/file.txt)

Output parameters:

- `result` (string)

### `register_data_store` (~143 tokens)

Register a data store on the linked filespace.

\``kind="s3"`` links S3 objects (link_external_file). Its credentials
are NOT passed to this tool: an operator stores them in
\~/.lucidlink/data-stores.json (mode 0600), keyed by store name, and
this reads the entry for ``name``, so S3 keys never enter the
conversation. ``kind="http_link"`` groups URL links (link_external_url)
on filespace format 3.8 and newer and needs nothing. Returns identity
only, never credentials.

Input parameters:

- `kind` (string, required)
- `name` (string, required)

Output parameters:

- `result` (string)

### `unregister_data_store` (~83 tokens)

Remove (unregister) a data store from the linked filespace.

Inverse of ``register_data_store``, either kind. Refused while any
external file is still linked from the store: list them with
list_external_files and remove them with unlink_external_file first.
The S3 objects and URL targets themselves are never touched.

Input parameters:

- `name` (string, required)

Output parameters:

- `result` (string)

## Diagnostics

Captured diagnostic sections: Provenance, Install scripts, Vulnerabilities, Dependencies. The full working is on the page: https://verifymcp.io/servers/com-lucidlink-mcp/lucidlink-mcp#diagnostics

## Score history

- 2026-11-05: 44
- 2026-11-04: 44
- 2026-11-03: 43
- 2026-11-02: 58
- 2026-11-01: 57
- 2026-10-31: 57
- 2026-10-30: 41
- 2026-10-29: 41
- 2026-10-28: 56
- 2026-10-27: 55
- 2026-10-26: 55
- 2026-10-25: 54
- 2026-10-24: 39
- 2026-10-23: 52
- 2026-10-22: 52
- 2026-10-21: 37
- 2026-10-20: 37

## Common questions

### What is the LucidLink MCP server?

LucidLink is an MCP server listed in the public MCP registry as com.lucidlink/mcp. Read, write, search, lock and audit files in LucidLink filespaces, plus workspace admin tools. This page covers its PyPI package (lucidlink-mcp).

### Is the LucidLink MCP server safe to use?

LucidLink scores 44 out of 100 on VerifyMCP. We recorded 4 known advisories against it as of 5 November 2026. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

### What tools does the LucidLink MCP server expose?

LucidLink exposes 47 tools: list_filespaces, link_filespace, current_filespace, unlink_filespace, list_accounts, and 42 more. Their descriptions and schemas cost roughly 6,312 tokens of context every time the server is loaded.

### Is the LucidLink MCP server still maintained?

LucidLink is still listed as active in the MCP registry. We last reached this channel on 5 November 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.

### What licence is the LucidLink MCP server under?

LucidLink declares the LicenseRef-Proprietary licence, which is not on the OSI-approved list. Read the terms before using it at work, and note this covers the source only, not the cost of any service it calls.

## Links

- PyPI project: https://pypi.org/project/lucidlink-mcp/
- Socket report: https://socket.dev/pypi/package/lucidlink-mcp
- Website: https://developer.lucidlink.com/docs/mcp/overview
- Changelog RSS feed: https://verifymcp.io/servers/com-lucidlink-mcp/lucidlink-mcp.xml
- Changelog JSON feed: https://verifymcp.io/servers/com-lucidlink-mcp/lucidlink-mcp.json
- HTML version of this page: https://verifymcp.io/servers/com-lucidlink-mcp/lucidlink-mcp