LemonLDAP::NG MCP Server

NPM · LLNG-MCP · SCANNED AUG 3

Manage LemonLDAP::NG SSO instances: configuration, sessions, OIDC, SAML, 2FA.

Available components

+18 this week 58 58 Trust /100

Trust breakdown (6 categories)

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score →

Supply Chain Security86

No malware found by supply-chain analysis.Pass
Only part of the dependency tree could be resolved (94 of 98), so this covers what we could see, not the whole tree.Partial
No install/post-install scripts declared.Pass
Only part of the dependency tree could be resolved (94 of 98), so this covers what we could see, not the whole tree. View diagnostics → Partial

Provenance & Transparency6

Repository check failed: no source repository is declared. See how to fix → View diagnostics → Fail
Provenance check failed: no build-provenance attestation is published. See how to fix → View diagnostics → Fail
License check failed: no license is declared. See how to fix → Fail
Actively maintained (last published 125 days ago).Pass
Security-disclosure policy not yet verified: we couldn't inspect the source repository.Unverified

Schema Quality & AI Usability66

AI-judged instruction clarity (good).Pass
Tool/resource definitions use about 2821 tokens (~65/item across 43 items; 43 tools + 0 resources), lean.Pass
Usage-examples check failed: none of the tools include examples. See how to fix → Fail

Stability & Change Management23

Stability observed for 7 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial

Tool Coverage96

100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
88% of tool parameters carry a description.Partial

Capabilities100

Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass

Install

Add this component to your MCP client. Where a client-specific snippet is available, pick your client below and copy it straight into your config; otherwise use the connection detail shown.

npm · llng-mcp

Claude Codex opencode OpenClaw Hermes Other

# add to Claude Code

claude mcp add linagora-llng-mcp -- npx -y llng-mcp

# add to Codex CLI

codex mcp add linagora-llng-mcp -- npx -y llng-mcp

// opencode.json

{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "linagora-llng-mcp": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "llng-mcp"
      ],
      "enabled": true
    }
  }
}

# add to OpenClaw

openclaw mcp add linagora-llng-mcp --command npx --arg -y --arg llng-mcp

# ~/.hermes/config.yaml

mcp_servers:
  linagora-llng-mcp:
    command: "npx"
    args: ["-y", "llng-mcp"]

// mcp.json

{
  "mcpServers": {
    "linagora-llng-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "llng-mcp"
      ]
    }
  }
}

Changelog

Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.

2 Aug 26 +43
- Provenance: unverified → fail ▼ security
- Install scripts: unverified → pass ▲ security
- Known CVEs: unverified → partial ▲ security
- Malware scan: unverified → pass ▲ security
- License: unverified → fail ▼ functional
- Dependency health: unverified → partial ▲ functional
- Stability: unverified → 0.20 ▲ functional
- Maintenance: unverified → pass ▲ functional
- MCP protocol: unverified → pass ▲ functional
- Schema quality: unverified → good ▲ functional
1 Aug 26 −13
- We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
31 Jul 26 −12
- Provenance: unverified → fail ▼ security
- Malware scan: pass → unverified ▼ security
- Install scripts: unverified → pass ▲ security
- License: unverified → fail ▼ functional
- Maintenance: unverified → pass ▲ functional
27 Jul 26 40

First indexed and scored.

Show 2 earlier entries Hide earlier entries

Diagnostics

Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.

Captured 3 Aug 2026 · Analysed npm/[email protected]

Provenance none

Ecosystem: npm · Outcome: none

Dependencies 94 packages

94 packages in the resolved dependency tree · 94 deprecated · 29 stale.

The dependency tree was only partially resolved, so these counts may be incomplete.

MCP tools — 43 exposed · ~2,821 tokens

The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability.

Tool Tokens

llng_2fa_delete ~50

Delete specific 2FA device(s)

Input Output Examples

Name	Type	Req	Description
ids	array	yes	—
instance	string	—	LLNG instance name (uses default if omitted)
user	string	yes	—

No output schema declared.

No examples provided.

llng_2fa_delType ~54

Delete all 2FA devices of a given type

Input Output Examples

Name	Type	Req	Description
instance	string	—	LLNG instance name (uses default if omitted)
type	string	yes	—
user	string	yes	—

No output schema declared.

No examples provided.

llng_2fa_list ~42

List user's 2FA devices

Input Output Examples

Name	Type	Req	Description
instance	string	—	LLNG instance name (uses default if omitted)
user	string	yes	—

No output schema declared.

No examples provided.

llng_config_addKey ~75

Add subkey to a composite LLNG config parameter

Input Output Examples

Name	Type	Req	Description
instance	string	—	LLNG instance name (uses default if omitted)
key	string	yes	The composite config key
subkey	string	yes	The subkey to add
value	string	yes	The value for the subkey

No output schema declared.

No examples provided.

llng_config_delKey ~62

Delete subkey from a composite LLNG config parameter

Input Output Examples

Name	Type	Req	Description
instance	string	—	LLNG instance name (uses default if omitted)
key	string	yes	The composite config key
subkey	string	yes	The subkey to delete

No output schema declared.

No examples provided.

llng_config_export ~34

Export full LLNG config as JSON

Input Output Examples

Name	Type	Req	Description
instance	string	—	LLNG instance name (uses default if omitted)

No output schema declared.

No examples provided.

llng_config_get ~49

Get LLNG config value(s) by key

Input Output Examples

Name	Type	Req	Description
instance	string	—	LLNG instance name (uses default if omitted)
keys	array	yes	Array of config keys to retrieve

No output schema declared.

No examples provided.

llng_config_import ~47

Import LLNG config from JSON

Input Output Examples

Name	Type	Req	Description
instance	string	—	LLNG instance name (uses default if omitted)
json	string	yes	JSON string of the config to import

No output schema declared.

No examples provided.

llng_config_info ~39

Get current LLNG config metadata (number, author, date)

Input Output Examples

Name	Type	Req	Description
instance	string	—	LLNG instance name (uses default if omitted)

No output schema declared.

No examples provided.

llng_config_merge ~47

Merge JSON snippet into LLNG config

Input Output Examples

Name	Type	Req	Description
instance	string	—	LLNG instance name (uses default if omitted)
json	string	yes	JSON string to merge into config

No output schema declared.

No examples provided.

llng_config_rollback ~36

Rollback LLNG config to previous version

Input Output Examples

Name	Type	Req	Description
instance	string	—	LLNG instance name (uses default if omitted)

No output schema declared.

No examples provided.

llng_config_set ~60

Set LLNG config value(s)

Input Output Examples

Name	Type	Req	Description
instance	string	—	LLNG instance name (uses default if omitted)
keys	object	yes	Key-value pairs to set in config
log	string	—	Optional log message for this change

No output schema declared.

No examples provided.

llng_config_test_email ~51

Send a test email to verify SMTP settings

Input Output Examples

Name	Type	Req	Description
destination	string	yes	Email address to send the test email to
instance	string	—	LLNG instance name (uses default if omitted)

No output schema declared.

No examples provided.

llng_config_update_cache ~34

Force LLNG config cache update

Input Output Examples

Name	Type	Req	Description
instance	string	—	LLNG instance name (uses default if omitted)

No output schema declared.

No examples provided.

llng_consent_delete ~48

Delete user's OIDC consent(s)

Input Output Examples

Name	Type	Req	Description
ids	array	yes	—
instance	string	—	LLNG instance name (uses default if omitted)
user	string	yes	—

No output schema declared.

No examples provided.

llng_consent_list ~41

List user's OIDC consents

Input Output Examples

Name	Type	Req	Description
instance	string	—	LLNG instance name (uses default if omitted)
user	string	yes	—

No output schema declared.

No examples provided.

llng_delete_session ~68

Delete user sessions by UID pattern

Input Output Examples

Name	Type	Req	Description
debug	boolean	—	Enable debug output
force	boolean	—	Force deletion without confirmation
instance	string	—	LLNG instance name (uses default if omitted)
uid	string	yes	UID pattern to match for session deletion

No output schema declared.

No examples provided.

llng_download_saml_metadata ~88

Download SAML metadata from a remote IdP

Input Output Examples

Name	Type	Req	Description
instance	string	—	LLNG instance name (uses default if omitted)
noCheck	boolean	—	Disable SSL certificate verification
outputFile	string	—	Output file path for downloaded metadata
url	string	yes	URL of the remote SAML metadata
verbose	boolean	—	Enable verbose output

No output schema declared.

No examples provided.

llng_import_metadata ~140

Import a SAML federation into LLNG config

Input Output Examples

Name	Type	Req	Description
idpPrefix	string	—	Prefix for IdP entity IDs
ignoreIdp	array	—	IdP entity IDs to ignore
ignoreSp	array	—	SP entity IDs to ignore
instance	string	—	LLNG instance name (uses default if omitted)
noCheck	boolean	—	Disable SSL certificate verification
remove	boolean	—	Remove entities not in metadata
spPrefix	string	—	Prefix for SP entity IDs
url	string	yes	URL of the SAML federation metadata
verbose	boolean	—	Enable verbose output

No output schema declared.

No examples provided.

llng_instances ~19

List available LLNG instances and their transport mode

Input Output Examples

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

llng_oidc_authorize ~42

Get authorization URL with PKCE

Input Output Examples

Name	Type	Req	Description
instance	string	—	LLNG instance name (uses default if omitted)
scope	string	—	—

No output schema declared.

No examples provided.

llng_oidc_check_auth ~61

Check if a URL requires authentication (only public URLs allowed, private/internal IPs blocked)

Input Output Examples

Name	Type	Req	Description
access_token	string	yes	—
instance	string	—	LLNG instance name (uses default if omitted)
url	string	yes	—

No output schema declared.

No examples provided.

llng_oidc_introspect ~43

Introspect an access token

Input Output Examples

Name	Type	Req	Description
instance	string	—	LLNG instance name (uses default if omitted)
token	string	yes	—

No output schema declared.

No examples provided.

llng_oidc_issuer_enable ~66

Enable OIDC issuer on the LLNG instance (activates issuerDBOpenIDConnectActivation and generates signing keys)

Input Output Examples

Name	Type	Req	Description
force	boolean	—	Force re-enable even if already activated
instance	string	—	LLNG instance name (uses default if omitted)

No output schema declared.

No examples provided.

llng_oidc_metadata ~33

Fetch OIDC discovery metadata

Input Output Examples

Name	Type	Req	Description
instance	string	—	LLNG instance name (uses default if omitted)

No output schema declared.

No examples provided.

llng_oidc_refresh ~40

Refresh an access token

Input Output Examples

Name	Type	Req	Description
instance	string	—	LLNG instance name (uses default if omitted)
refresh_token	string	yes	—

No output schema declared.

No examples provided.

llng_oidc_rp_add ~158

Add a new OIDC Relying Party

Input Output Examples

Name	Type	Req	Description
clientId	string	yes	OAuth2 client ID
clientSecret	string	—	OAuth2 client secret
confKey	string	yes	Internal identifier for the RP
displayName	string	—	Display name for the RP
exportedVars	object	—	Claim-to-attribute mappings (default: {"name":"cn","preferred_username":"uid","email":"mail"})
extraClaims	object	—	Extra claims mappings
instance	string	—	LLNG instance name (uses default if omitted)
options	object	—	Additional raw OIDC RP options
redirectUris	string	yes	Redirect URIs (space or newline separated)

No output schema declared.

No examples provided.

llng_oidc_rp_delete ~55

Delete an OIDC Relying Party by confKey

Input Output Examples

Name	Type	Req	Description
confKey	string	yes	The RP configuration key to delete
instance	string	—	LLNG instance name (uses default if omitted)

No output schema declared.

No examples provided.

llng_oidc_rp_get ~59

Get full details of an OIDC Relying Party by confKey

Input Output Examples

Name	Type	Req	Description
confKey	string	yes	The RP configuration key (internal identifier)
instance	string	—	LLNG instance name (uses default if omitted)

No output schema declared.

No examples provided.

llng_oidc_rp_list ~45

List configured OIDC Relying Parties with their clientID and displayName

Input Output Examples

Name	Type	Req	Description
instance	string	—	LLNG instance name (uses default if omitted)

No output schema declared.

No examples provided.

llng_oidc_tokens ~49

Exchange authorization code for tokens

Input Output Examples

Name	Type	Req	Description
code	string	yes	—
code_verifier	string	yes	—
instance	string	—	LLNG instance name (uses default if omitted)

No output schema declared.

No examples provided.

llng_oidc_userinfo ~44

Get user info from OIDC provider

Input Output Examples

Name	Type	Req	Description
access_token	string	yes	—
instance	string	—	LLNG instance name (uses default if omitted)

No output schema declared.

No examples provided.

llng_oidc_whoami ~55

Decode ID token to show identity (WARNING: signature is NOT verified, for debugging only)

Input Output Examples

Name	Type	Req	Description
id_token	string	yes	—
instance	string	—	LLNG instance name (uses default if omitted)

No output schema declared.

No examples provided.

llng_purge_central_cache ~69

Purge expired sessions from central cache

Input Output Examples

Name	Type	Req	Description
debug	boolean	—	Enable debug output
force	boolean	—	Force purge without confirmation
instance	string	—	LLNG instance name (uses default if omitted)
json	boolean	—	Output in JSON format

No output schema declared.

No examples provided.

llng_purge_local_cache ~44

Purge local handler cache

Input Output Examples

Name	Type	Req	Description
debug	boolean	—	Enable debug output
instance	string	—	LLNG instance name (uses default if omitted)

No output schema declared.

No examples provided.

llng_rotate_oidc_keys ~44

Rotate OIDC signing keys

Input Output Examples

Name	Type	Req	Description
debug	boolean	—	Enable debug output
instance	string	—	LLNG instance name (uses default if omitted)

No output schema declared.

No examples provided.

llng_session_backup ~83

Backup all LLNG sessions

Input Output Examples

Name	Type	Req	Description
backend	string	—	Optional backend type to backup (persistent, oidc, saml, cas)
instance	string	—	LLNG instance name (uses default if omitted)
persistent	boolean	—	Shortcut for --backend persistent
refreshTokens	boolean	—	Filter for refresh token (offline) sessions only

No output schema declared.

No examples provided.

llng_session_delete ~167

Delete LLNG session(s)

Input Output Examples

Name	Type	Req	Description
backend	string	—	Optional backend type (persistent, oidc, saml, cas)
hash	boolean	—	Indicates session IDs are original cookie values
ids	array	—	Array of session IDs to delete (not needed when using where)
instance	string	—	LLNG instance name (uses default if omitted)
kind	string	—	Filter by session kind: SSO, SAML, CAS, OIDC, Persistent. This is a shortcut that adds _session_kind to the where filter
persistent	boolean	—	Shortcut for --backend persistent
refreshTokens	boolean	—	Filter for refresh token (offline) sessions only
where	object	—	Delete sessions matching filter instead of by ID

No output schema declared.

No examples provided.

llng_session_delKey ~111

Delete key(s) from an LLNG session

Input Output Examples

Name	Type	Req	Description
backend	string	—	Optional backend type
hash	boolean	—	Session ID is original cookie value
id	string	yes	The session ID to modify
instance	string	—	LLNG instance name (uses default if omitted)
keys	array	yes	Array of keys to delete from the session
persistent	boolean	—	Shortcut for --backend persistent
refreshTokens	boolean	—	Target refresh token sessions

No output schema declared.

No examples provided.

llng_session_get ~124

Get LLNG session by ID

Input Output Examples

Name	Type	Req	Description
backend	string	—	Optional backend type (persistent, oidc, saml, cas)
hash	boolean	—	Indicates the given session ID is the original cookie value (for hashed session storage)
id	string	yes	The session ID to retrieve
instance	string	—	LLNG instance name (uses default if omitted)
persistent	boolean	—	Shortcut for --backend persistent; also hashes UID for persistent session ID
refreshTokens	boolean	—	Filter for refresh token (offline) sessions only

No output schema declared.

No examples provided.

llng_session_search ~181

Search LLNG sessions

Input Output Examples

Name	Type	Req	Description
backend	string	—	Backend type (persistent, oidc, saml, cas)
count	boolean	—	Return only the count of matching sessions
hash	boolean	—	Indicates session IDs are original cookie values
idOnly	boolean	—	Only return session IDs
instance	string	—	LLNG instance name (uses default if omitted)
kind	string	—	Filter by session kind: SSO, SAML, CAS, OIDC, Persistent. This is a shortcut that adds _session_kind to the where filter
persistent	boolean	—	Shortcut for --backend persistent
refreshTokens	boolean	—	Filter for refresh token (offline) sessions only
select	array	—	Fields to return in results
where	object	—	Field=value pairs for filtering

No output schema declared.

No examples provided.

llng_session_setKey ~111

Set key(s) in an LLNG session

Input Output Examples

Name	Type	Req	Description
backend	string	—	Optional backend type
hash	boolean	—	Session ID is original cookie value
id	string	yes	The session ID to modify
instance	string	—	LLNG instance name (uses default if omitted)
keys	object	yes	Key-value pairs to set in the session
persistent	boolean	—	Shortcut for --backend persistent
refreshTokens	boolean	—	Target refresh token sessions

No output schema declared.

No examples provided.

llng_user_attributes ~53

Look up user attributes

Input Output Examples

Name	Type	Req	Description
field	string	—	Specific field to return
instance	string	—	LLNG instance name (uses default if omitted)
username	string	yes	Username to look up

No output schema declared.

No examples provided.

On this page

Handy links

Scoring key

80+ high trust
60–79 medium
below 60 low

How we score

Score history · last 30 days

27 Jul 3 Aug