LemonLDAP::NG MCP Server
NPM · LLNG-MCP · SCANNED SEP 25
Manage LemonLDAP::NG SSO instances: configuration, sessions, OIDC, SAML, 2FA.
Available components
How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →
Supply Chain Security98
- No malware found by supply-chain analysis.Pass
- No known CVEs affecting this package version or its production dependencies.Pass
- No install/post-install scripts declared.Pass
- 31 of 95 dependencies flagged as unhealthy. View diagnostics → Partial
Provenance & Transparency6
- Repository check failed: no source repository is declared. See how to fix → View diagnostics → Fail
- Provenance check failed: no build-provenance attestation is published. See how to fix → View diagnostics → Fail
- License check failed: no license is declared. See how to fix → Fail
- Actively maintained (last published 178 days ago).Pass
- Security-disclosure policy not yet verified: we couldn't inspect the source repository.Unverified
Schema Quality & AI Usability70
- AI-judged instruction clarity (good).Pass
- Tool/resource definitions use about 2821 tokens (~65/item across 43 items; 43 tools + 0 resources), lean.Pass
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management87
- Stability observed for 26 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage96
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 88% of tool parameters carry a description.Partial
Tool Safety75
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- 0 of 12 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation; "llng_config_delKey" implies "delete" and declares no destructiveHint at all, which the MCP spec reads as destructive by default. See how to fix → Fail
- An AI judge read all 43 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
How do I install the LemonLDAP::NG MCP Server server?
LemonLDAP::NG MCP Server runs locally as an npm package, launched with npx -y llng-mcp. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
npm · llng-mcp
claude mcp add linagora-llng-mcp -- npx -y llng-mcp
{
"mcpServers": {
"linagora-llng-mcp": {
"command": "npx",
"args": [
"-y",
"llng-mcp"
]
}
}
} {
"servers": {
"linagora-llng-mcp": {
"command": "npx",
"args": [
"-y",
"llng-mcp"
]
}
}
} codex mcp add linagora-llng-mcp -- npx -y llng-mcp
{
"$schema": "https://opencode.ai/config.json",
"mcp": {
"linagora-llng-mcp": {
"type": "local",
"command": [
"npx",
"-y",
"llng-mcp"
],
"enabled": true
}
}
} openclaw mcp add linagora-llng-mcp --command npx --arg -y --arg llng-mcp
mcp_servers:
linagora-llng-mcp:
command: "npx"
args: ["-y", "llng-mcp"] {
"McpServers": {
"linagora-llng-mcp": {
"Transport": "stdio",
"Command": "npx",
"Arguments": [
"-y",
"llng-mcp"
]
}
}
} assistant mcp add linagora-llng-mcp -t stdio -c npx -a -y llng-mcp
{
"mcpServers": {
"linagora-llng-mcp": {
"command": "npx",
"args": [
"-y",
"llng-mcp"
]
}
}
} Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 25 Sept 26 +1
- We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
- 23 Sept 26 −2
- Stability: pass → 0.80 functional
- 22 Sept 26 0
- Stability: 0.97 → pass security
- 21 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 93 to 97. That category is still filling its 30-day observation window: 28 days of observed history at the previous scan, 29 at this one. The score rises as the window fills, whether or not the server changes.
- 18 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 83 to 87. That category is still filling its 30-day observation window: 25 days of observed history at the previous scan, 26 at this one. The score rises as the window fills, whether or not the server changes.
- 16 Sept 26 −2
- Stability: pass → 0.80 functional
- 15 Sept 26 0
- Stability: 0.97 → pass security
- 14 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 93 to 97. That category is still filling its 30-day observation window: 28 days of observed history at the previous scan, 29 at this one. The score rises as the window fills, whether or not the server changes.
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 25 Sept 2026 · Analysed npm/llng-mcp@0.1.1
Provenance No attestation
The registry publishes no build provenance for this version, so there is nothing to verify.
| Result | No attestation |
|---|---|
| Ecosystem | npm |
Background: How many MCP packages publish verified provenance →
Dependencies 95 packages
| Packages resolved | 95 |
|---|---|
| Stale | 31 |
| Tree resolution | Complete |
Background: SBOMs and build attestations, explained →
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
llng_2fa_delete ~50
Delete specific 2FA device(s)
| Name | Type | Req | Description |
|---|---|---|---|
| ids | array | yes | – |
| instance | string | – | LLNG instance name (uses default if omitted) |
| user | string | yes | – |
No output schema declared.
No examples provided.
llng_2fa_delType ~54
Delete all 2FA devices of a given type
| Name | Type | Req | Description |
|---|---|---|---|
| instance | string | – | LLNG instance name (uses default if omitted) |
| type | string | yes | – |
| user | string | yes | – |
No output schema declared.
No examples provided.
llng_2fa_list ~42
List user's 2FA devices
| Name | Type | Req | Description |
|---|---|---|---|
| instance | string | – | LLNG instance name (uses default if omitted) |
| user | string | yes | – |
No output schema declared.
No examples provided.
llng_config_addKey ~75
Add subkey to a composite LLNG config parameter
| Name | Type | Req | Description |
|---|---|---|---|
| instance | string | – | LLNG instance name (uses default if omitted) |
| key | string | yes | The composite config key |
| subkey | string | yes | The subkey to add |
| value | string | yes | The value for the subkey |
No output schema declared.
No examples provided.
llng_config_delKey ~62
Delete subkey from a composite LLNG config parameter
| Name | Type | Req | Description |
|---|---|---|---|
| instance | string | – | LLNG instance name (uses default if omitted) |
| key | string | yes | The composite config key |
| subkey | string | yes | The subkey to delete |
No output schema declared.
No examples provided.
llng_config_export ~34
Export full LLNG config as JSON
| Name | Type | Req | Description |
|---|---|---|---|
| instance | string | – | LLNG instance name (uses default if omitted) |
No output schema declared.
No examples provided.
llng_config_get ~49
Get LLNG config value(s) by key
| Name | Type | Req | Description |
|---|---|---|---|
| instance | string | – | LLNG instance name (uses default if omitted) |
| keys | array | yes | Array of config keys to retrieve |
No output schema declared.
No examples provided.
llng_config_import ~47
Import LLNG config from JSON
| Name | Type | Req | Description |
|---|---|---|---|
| instance | string | – | LLNG instance name (uses default if omitted) |
| json | string | yes | JSON string of the config to import |
No output schema declared.
No examples provided.
llng_config_info ~39
Get current LLNG config metadata (number, author, date)
| Name | Type | Req | Description |
|---|---|---|---|
| instance | string | – | LLNG instance name (uses default if omitted) |
No output schema declared.
No examples provided.
llng_config_merge ~47
Merge JSON snippet into LLNG config
| Name | Type | Req | Description |
|---|---|---|---|
| instance | string | – | LLNG instance name (uses default if omitted) |
| json | string | yes | JSON string to merge into config |
No output schema declared.
No examples provided.
llng_config_rollback ~36
Rollback LLNG config to previous version
| Name | Type | Req | Description |
|---|---|---|---|
| instance | string | – | LLNG instance name (uses default if omitted) |
No output schema declared.
No examples provided.
llng_config_set ~60
Set LLNG config value(s)
| Name | Type | Req | Description |
|---|---|---|---|
| instance | string | – | LLNG instance name (uses default if omitted) |
| keys | object | yes | Key-value pairs to set in config |
| log | string | – | Optional log message for this change |
No output schema declared.
No examples provided.
llng_config_test_email ~51
Send a test email to verify SMTP settings
| Name | Type | Req | Description |
|---|---|---|---|
| destination | string | yes | Email address to send the test email to |
| instance | string | – | LLNG instance name (uses default if omitted) |
No output schema declared.
No examples provided.
llng_config_update_cache ~34
Force LLNG config cache update
| Name | Type | Req | Description |
|---|---|---|---|
| instance | string | – | LLNG instance name (uses default if omitted) |
No output schema declared.
No examples provided.
llng_consent_delete ~48
Delete user's OIDC consent(s)
| Name | Type | Req | Description |
|---|---|---|---|
| ids | array | yes | – |
| instance | string | – | LLNG instance name (uses default if omitted) |
| user | string | yes | – |
No output schema declared.
No examples provided.
llng_consent_list ~41
List user's OIDC consents
| Name | Type | Req | Description |
|---|---|---|---|
| instance | string | – | LLNG instance name (uses default if omitted) |
| user | string | yes | – |
No output schema declared.
No examples provided.
llng_delete_session ~68
Delete user sessions by UID pattern
| Name | Type | Req | Description |
|---|---|---|---|
| debug | boolean | – | Enable debug output |
| force | boolean | – | Force deletion without confirmation |
| instance | string | – | LLNG instance name (uses default if omitted) |
| uid | string | yes | UID pattern to match for session deletion |
No output schema declared.
No examples provided.
llng_download_saml_metadata ~88
Download SAML metadata from a remote IdP
| Name | Type | Req | Description |
|---|---|---|---|
| instance | string | – | LLNG instance name (uses default if omitted) |
| noCheck | boolean | – | Disable SSL certificate verification |
| outputFile | string | – | Output file path for downloaded metadata |
| url | string | yes | URL of the remote SAML metadata |
| verbose | boolean | – | Enable verbose output |
No output schema declared.
No examples provided.
llng_import_metadata ~140
Import a SAML federation into LLNG config
| Name | Type | Req | Description |
|---|---|---|---|
| idpPrefix | string | – | Prefix for IdP entity IDs |
| ignoreIdp | array | – | IdP entity IDs to ignore |
| ignoreSp | array | – | SP entity IDs to ignore |
| instance | string | – | LLNG instance name (uses default if omitted) |
| noCheck | boolean | – | Disable SSL certificate verification |
| remove | boolean | – | Remove entities not in metadata |
| spPrefix | string | – | Prefix for SP entity IDs |
| url | string | yes | URL of the SAML federation metadata |
| verbose | boolean | – | Enable verbose output |
No output schema declared.
No examples provided.
llng_instances ~19
List available LLNG instances and their transport mode
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
llng_oidc_authorize ~42
Get authorization URL with PKCE
| Name | Type | Req | Description |
|---|---|---|---|
| instance | string | – | LLNG instance name (uses default if omitted) |
| scope | string | – | – |
No output schema declared.
No examples provided.
llng_oidc_check_auth ~61
Check if a URL requires authentication (only public URLs allowed, private/internal IPs blocked)
| Name | Type | Req | Description |
|---|---|---|---|
| access_token | string | yes | – |
| instance | string | – | LLNG instance name (uses default if omitted) |
| url | string | yes | – |
No output schema declared.
No examples provided.
llng_oidc_introspect ~43
Introspect an access token
| Name | Type | Req | Description |
|---|---|---|---|
| instance | string | – | LLNG instance name (uses default if omitted) |
| token | string | yes | – |
No output schema declared.
No examples provided.
llng_oidc_issuer_enable ~66
Enable OIDC issuer on the LLNG instance (activates issuerDBOpenIDConnectActivation and generates signing keys)
| Name | Type | Req | Description |
|---|---|---|---|
| force | boolean | – | Force re-enable even if already activated |
| instance | string | – | LLNG instance name (uses default if omitted) |
No output schema declared.
No examples provided.
llng_oidc_metadata ~33
Fetch OIDC discovery metadata
| Name | Type | Req | Description |
|---|---|---|---|
| instance | string | – | LLNG instance name (uses default if omitted) |
No output schema declared.
No examples provided.
llng_oidc_refresh ~40
Refresh an access token
| Name | Type | Req | Description |
|---|---|---|---|
| instance | string | – | LLNG instance name (uses default if omitted) |
| refresh_token | string | yes | – |
No output schema declared.
No examples provided.
llng_oidc_rp_add ~158
Add a new OIDC Relying Party
| Name | Type | Req | Description |
|---|---|---|---|
| clientId | string | yes | OAuth2 client ID |
| clientSecret | string | – | OAuth2 client secret |
| confKey | string | yes | Internal identifier for the RP |
| displayName | string | – | Display name for the RP |
| exportedVars | object | – | Claim-to-attribute mappings (default: {"name":"cn","preferred_username":"uid","email":"mail"}) |
| extraClaims | object | – | Extra claims mappings |
| instance | string | – | LLNG instance name (uses default if omitted) |
| options | object | – | Additional raw OIDC RP options |
| redirectUris | string | yes | Redirect URIs (space or newline separated) |
No output schema declared.
No examples provided.
llng_oidc_rp_delete ~55
Delete an OIDC Relying Party by confKey
| Name | Type | Req | Description |
|---|---|---|---|
| confKey | string | yes | The RP configuration key to delete |
| instance | string | – | LLNG instance name (uses default if omitted) |
No output schema declared.
No examples provided.
llng_oidc_rp_get ~59
Get full details of an OIDC Relying Party by confKey
| Name | Type | Req | Description |
|---|---|---|---|
| confKey | string | yes | The RP configuration key (internal identifier) |
| instance | string | – | LLNG instance name (uses default if omitted) |
No output schema declared.
No examples provided.
llng_oidc_rp_list ~45
List configured OIDC Relying Parties with their clientID and displayName
| Name | Type | Req | Description |
|---|---|---|---|
| instance | string | – | LLNG instance name (uses default if omitted) |
No output schema declared.
No examples provided.
llng_oidc_tokens ~49
Exchange authorization code for tokens
| Name | Type | Req | Description |
|---|---|---|---|
| code | string | yes | – |
| code_verifier | string | yes | – |
| instance | string | – | LLNG instance name (uses default if omitted) |
No output schema declared.
No examples provided.
llng_oidc_userinfo ~44
Get user info from OIDC provider
| Name | Type | Req | Description |
|---|---|---|---|
| access_token | string | yes | – |
| instance | string | – | LLNG instance name (uses default if omitted) |
No output schema declared.
No examples provided.
llng_oidc_whoami ~55
Decode ID token to show identity (WARNING: signature is NOT verified, for debugging only)
| Name | Type | Req | Description |
|---|---|---|---|
| id_token | string | yes | – |
| instance | string | – | LLNG instance name (uses default if omitted) |
No output schema declared.
No examples provided.
llng_purge_central_cache ~69
Purge expired sessions from central cache
| Name | Type | Req | Description |
|---|---|---|---|
| debug | boolean | – | Enable debug output |
| force | boolean | – | Force purge without confirmation |
| instance | string | – | LLNG instance name (uses default if omitted) |
| json | boolean | – | Output in JSON format |
No output schema declared.
No examples provided.
llng_purge_local_cache ~44
Purge local handler cache
| Name | Type | Req | Description |
|---|---|---|---|
| debug | boolean | – | Enable debug output |
| instance | string | – | LLNG instance name (uses default if omitted) |
No output schema declared.
No examples provided.
llng_rotate_oidc_keys ~44
Rotate OIDC signing keys
| Name | Type | Req | Description |
|---|---|---|---|
| debug | boolean | – | Enable debug output |
| instance | string | – | LLNG instance name (uses default if omitted) |
No output schema declared.
No examples provided.
llng_session_backup ~83
Backup all LLNG sessions
| Name | Type | Req | Description |
|---|---|---|---|
| backend | string | – | Optional backend type to backup (persistent, oidc, saml, cas) |
| instance | string | – | LLNG instance name (uses default if omitted) |
| persistent | boolean | – | Shortcut for --backend persistent |
| refreshTokens | boolean | – | Filter for refresh token (offline) sessions only |
No output schema declared.
No examples provided.
llng_session_delete ~167
Delete LLNG session(s)
| Name | Type | Req | Description |
|---|---|---|---|
| backend | string | – | Optional backend type (persistent, oidc, saml, cas) |
| hash | boolean | – | Indicates session IDs are original cookie values |
| ids | array | – | Array of session IDs to delete (not needed when using where) |
| instance | string | – | LLNG instance name (uses default if omitted) |
| kind | string | – | Filter by session kind: SSO, SAML, CAS, OIDC, Persistent. This is a shortcut that adds _session_kind to the where filter |
| persistent | boolean | – | Shortcut for --backend persistent |
| refreshTokens | boolean | – | Filter for refresh token (offline) sessions only |
| where | object | – | Delete sessions matching filter instead of by ID |
No output schema declared.
No examples provided.
llng_session_delKey ~111
Delete key(s) from an LLNG session
| Name | Type | Req | Description |
|---|---|---|---|
| backend | string | – | Optional backend type |
| hash | boolean | – | Session ID is original cookie value |
| id | string | yes | The session ID to modify |
| instance | string | – | LLNG instance name (uses default if omitted) |
| keys | array | yes | Array of keys to delete from the session |
| persistent | boolean | – | Shortcut for --backend persistent |
| refreshTokens | boolean | – | Target refresh token sessions |
No output schema declared.
No examples provided.
llng_session_get ~124
Get LLNG session by ID
| Name | Type | Req | Description |
|---|---|---|---|
| backend | string | – | Optional backend type (persistent, oidc, saml, cas) |
| hash | boolean | – | Indicates the given session ID is the original cookie value (for hashed session storage) |
| id | string | yes | The session ID to retrieve |
| instance | string | – | LLNG instance name (uses default if omitted) |
| persistent | boolean | – | Shortcut for --backend persistent; also hashes UID for persistent session ID |
| refreshTokens | boolean | – | Filter for refresh token (offline) sessions only |
No output schema declared.
No examples provided.
llng_session_search ~181
Search LLNG sessions
| Name | Type | Req | Description |
|---|---|---|---|
| backend | string | – | Backend type (persistent, oidc, saml, cas) |
| count | boolean | – | Return only the count of matching sessions |
| hash | boolean | – | Indicates session IDs are original cookie values |
| idOnly | boolean | – | Only return session IDs |
| instance | string | – | LLNG instance name (uses default if omitted) |
| kind | string | – | Filter by session kind: SSO, SAML, CAS, OIDC, Persistent. This is a shortcut that adds _session_kind to the where filter |
| persistent | boolean | – | Shortcut for --backend persistent |
| refreshTokens | boolean | – | Filter for refresh token (offline) sessions only |
| select | array | – | Fields to return in results |
| where | object | – | Field=value pairs for filtering |
No output schema declared.
No examples provided.
llng_session_setKey ~111
Set key(s) in an LLNG session
| Name | Type | Req | Description |
|---|---|---|---|
| backend | string | – | Optional backend type |
| hash | boolean | – | Session ID is original cookie value |
| id | string | yes | The session ID to modify |
| instance | string | – | LLNG instance name (uses default if omitted) |
| keys | object | yes | Key-value pairs to set in the session |
| persistent | boolean | – | Shortcut for --backend persistent |
| refreshTokens | boolean | – | Target refresh token sessions |
No output schema declared.
No examples provided.
llng_user_attributes ~53
Look up user attributes
| Name | Type | Req | Description |
|---|---|---|---|
| field | string | – | Specific field to return |
| instance | string | – | LLNG instance name (uses default if omitted) |
| username | string | yes | Username to look up |
No output schema declared.
No examples provided.
What is the LemonLDAP::NG MCP Server server?
LemonLDAP::NG MCP Server is listed in the public MCP registry as io.github.linagora/llng-mcp. Manage LemonLDAP::NG SSO instances: configuration, sessions, OIDC, SAML, 2FA. This page covers its npm package (llng-mcp).
Is the LemonLDAP::NG MCP Server server safe to use?
LemonLDAP::NG MCP Server scores 72 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 25 September 2026. It declares no install or post-install scripts. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the LemonLDAP::NG MCP Server server expose?
LemonLDAP::NG MCP Server exposes 43 tools: llng_config_info, llng_config_get, llng_config_set, llng_config_addKey, llng_config_delKey, and 38 more. Their descriptions and schemas cost roughly 2,821 tokens of context every time the server is loaded.
Is the LemonLDAP::NG MCP Server server still maintained?
LemonLDAP::NG MCP Server is still listed as active in the MCP registry. We last reached this channel on 25 September 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.