# LemonLDAP::NG MCP Server (npm · llng-mcp)

Manage LemonLDAP::NG SSO instances: configuration, sessions, OIDC, SAML, 2FA.

- Trust score: 58/100 (low)
- Change this week: +18
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-08-04

## Components

- npm · `llng-mcp`: 58/100 (this document), [markdown](https://verifymcp.io/servers/linagora-llng-mcp/llng-mcp.md), [page](https://verifymcp.io/servers/linagora-llng-mcp/llng-mcp)

## Channel facts

- Registry: `npm`
- Package: `llng-mcp`
- Version: `0.1.1`
- Transport: `stdio`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-08-04.

- **Supply Chain Security**: 83/100
  - No malware found by supply-chain analysis.
  - CVE check failed: a known medium-severity CVE affects hono 4.12.33, reached via @modelcontextprotocol/sdk > hono. A fixed version is available.
  - No install/post-install scripts declared.
  - Only part of the dependency tree could be resolved (94 of 98), so this covers what we could see, not the whole tree.
- **Provenance & Transparency**: 6/100
  - Repository check failed: no source repository is declared.
  - Provenance check failed: no build-provenance attestation is published.
  - License check failed: no license is declared.
  - Actively maintained (last published 126 days ago).
  - Security-disclosure policy not yet verified: we couldn't inspect the source repository.
- **Schema Quality & AI Usability**: 66/100
  - AI-judged instruction clarity (good).
  - Tool/resource definitions use about 2821 tokens (~65/item across 43 items; 43 tools + 0 resources), lean.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 27/100
  - Stability observed for 8 of 30 days with no destabilising changes; credit accrues until the full window elapses.
- **Tool Coverage**: 96/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 88% of tool parameters carry a description.
- **Capabilities**: 100/100
  - Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.

## Install

### Claude

```bash
claude mcp add linagora-llng-mcp -- npx -y llng-mcp
```

### Codex

```bash
codex mcp add linagora-llng-mcp -- npx -y llng-mcp
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "linagora-llng-mcp": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "llng-mcp"
      ],
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add linagora-llng-mcp --command npx --arg -y --arg llng-mcp
```

### Hermes

```yaml
mcp_servers:
  linagora-llng-mcp:
    command: "npx"
    args: ["-y", "llng-mcp"]
```

### Other

```json
{
  "mcpServers": {
    "linagora-llng-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "llng-mcp"
      ]
    }
  }
}
```

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-08-04 (score 58, 0)

- [security regression] CVE-2026-69207 affects this package: medium
- [security regression] Known CVEs: partial → fail

### 2026-08-02 (score 58, +43)

- [security regression] Provenance: unverified → fail
- [security improvement] Install scripts: unverified → pass
- [security improvement] Known CVEs: unverified → partial
- [security improvement] Malware scan: unverified → pass
- [functional regression] License: unverified → fail
- [functional improvement] Dependency health: unverified → partial
- [functional improvement] Stability: unverified → 0.20
- [functional improvement] Maintenance: unverified → pass
- [functional improvement] MCP protocol: unverified → pass
- [functional improvement] Schema quality: unverified → good

### 2026-08-01 (score 15, −13)

- [functional] We updated how we score, so this day's move reflects our rubric, not a change to the server

### 2026-07-31 (score 28, −12)

- [security regression] Provenance: unverified → fail
- [security regression] Malware scan: pass → unverified
- [security improvement] Install scripts: unverified → pass
- [functional regression] License: unverified → fail
- [functional improvement] Maintenance: unverified → pass

### 2026-07-27 (score 40)

First indexed and scored.

## MCP tools (43)

### `llng_config_info` (~39 tokens)

Get current LLNG config metadata (number, author, date)

Input parameters:

- `instance` (string): LLNG instance name (uses default if omitted)

### `llng_config_get` (~49 tokens)

Get LLNG config value(s) by key

Input parameters:

- `instance` (string): LLNG instance name (uses default if omitted)
- `keys` (array, required): Array of config keys to retrieve

### `llng_config_set` (~60 tokens)

Set LLNG config value(s)

Input parameters:

- `instance` (string): LLNG instance name (uses default if omitted)
- `keys` (object, required): Key-value pairs to set in config
- `log` (string): Optional log message for this change

### `llng_config_addKey` (~75 tokens)

Add subkey to a composite LLNG config parameter

Input parameters:

- `instance` (string): LLNG instance name (uses default if omitted)
- `key` (string, required): The composite config key
- `subkey` (string, required): The subkey to add
- `value` (string, required): The value for the subkey

### `llng_config_delKey` (~62 tokens)

Delete subkey from a composite LLNG config parameter

Input parameters:

- `instance` (string): LLNG instance name (uses default if omitted)
- `key` (string, required): The composite config key
- `subkey` (string, required): The subkey to delete

### `llng_config_export` (~34 tokens)

Export full LLNG config as JSON

Input parameters:

- `instance` (string): LLNG instance name (uses default if omitted)

### `llng_config_import` (~47 tokens)

Import LLNG config from JSON

Input parameters:

- `instance` (string): LLNG instance name (uses default if omitted)
- `json` (string, required): JSON string of the config to import

### `llng_config_merge` (~47 tokens)

Merge JSON snippet into LLNG config

Input parameters:

- `instance` (string): LLNG instance name (uses default if omitted)
- `json` (string, required): JSON string to merge into config

### `llng_config_rollback` (~36 tokens)

Rollback LLNG config to previous version

Input parameters:

- `instance` (string): LLNG instance name (uses default if omitted)

### `llng_config_update_cache` (~34 tokens)

Force LLNG config cache update

Input parameters:

- `instance` (string): LLNG instance name (uses default if omitted)

### `llng_config_test_email` (~51 tokens)

Send a test email to verify SMTP settings

Input parameters:

- `destination` (string, required): Email address to send the test email to
- `instance` (string): LLNG instance name (uses default if omitted)

### `llng_session_get` (~124 tokens)

Get LLNG session by ID

Input parameters:

- `backend` (string): Optional backend type (persistent, oidc, saml, cas)
- `hash` (boolean): Indicates the given session ID is the original cookie value (for hashed session storage)
- `id` (string, required): The session ID to retrieve
- `instance` (string): LLNG instance name (uses default if omitted)
- `persistent` (boolean): Shortcut for --backend persistent; also hashes UID for persistent session ID
- `refreshTokens` (boolean): Filter for refresh token (offline) sessions only

### `llng_session_search` (~181 tokens)

Search LLNG sessions

Input parameters:

- `backend` (string): Backend type (persistent, oidc, saml, cas)
- `count` (boolean): Return only the count of matching sessions
- `hash` (boolean): Indicates session IDs are original cookie values
- `idOnly` (boolean): Only return session IDs
- `instance` (string): LLNG instance name (uses default if omitted)
- `kind` (string): Filter by session kind: SSO, SAML, CAS, OIDC, Persistent. This is a shortcut that adds _session_kind to the where filter
- `persistent` (boolean): Shortcut for --backend persistent
- `refreshTokens` (boolean): Filter for refresh token (offline) sessions only
- `select` (array): Fields to return in results
- `where` (object): Field=value pairs for filtering

### `llng_session_delete` (~167 tokens)

Delete LLNG session(s)

Input parameters:

- `backend` (string): Optional backend type (persistent, oidc, saml, cas)
- `hash` (boolean): Indicates session IDs are original cookie values
- `ids` (array): Array of session IDs to delete (not needed when using where)
- `instance` (string): LLNG instance name (uses default if omitted)
- `kind` (string): Filter by session kind: SSO, SAML, CAS, OIDC, Persistent. This is a shortcut that adds _session_kind to the where filter
- `persistent` (boolean): Shortcut for --backend persistent
- `refreshTokens` (boolean): Filter for refresh token (offline) sessions only
- `where` (object): Delete sessions matching filter instead of by ID

### `llng_session_setKey` (~111 tokens)

Set key(s) in an LLNG session

Input parameters:

- `backend` (string): Optional backend type
- `hash` (boolean): Session ID is original cookie value
- `id` (string, required): The session ID to modify
- `instance` (string): LLNG instance name (uses default if omitted)
- `keys` (object, required): Key-value pairs to set in the session
- `persistent` (boolean): Shortcut for --backend persistent
- `refreshTokens` (boolean): Target refresh token sessions

### `llng_session_delKey` (~111 tokens)

Delete key(s) from an LLNG session

Input parameters:

- `backend` (string): Optional backend type
- `hash` (boolean): Session ID is original cookie value
- `id` (string, required): The session ID to modify
- `instance` (string): LLNG instance name (uses default if omitted)
- `keys` (array, required): Array of keys to delete from the session
- `persistent` (boolean): Shortcut for --backend persistent
- `refreshTokens` (boolean): Target refresh token sessions

### `llng_session_backup` (~83 tokens)

Backup all LLNG sessions

Input parameters:

- `backend` (string): Optional backend type to backup (persistent, oidc, saml, cas)
- `instance` (string): LLNG instance name (uses default if omitted)
- `persistent` (boolean): Shortcut for --backend persistent
- `refreshTokens` (boolean): Filter for refresh token (offline) sessions only

### `llng_2fa_list` (~42 tokens)

List user's 2FA devices

Input parameters:

- `instance` (string): LLNG instance name (uses default if omitted)
- `user` (string, required)

### `llng_2fa_delete` (~50 tokens)

Delete specific 2FA device(s)

Input parameters:

- `ids` (array, required)
- `instance` (string): LLNG instance name (uses default if omitted)
- `user` (string, required)

### `llng_2fa_delType` (~54 tokens)

Delete all 2FA devices of a given type

Input parameters:

- `instance` (string): LLNG instance name (uses default if omitted)
- `type` (string, required)
- `user` (string, required)

### `llng_consent_list` (~41 tokens)

List user's OIDC consents

Input parameters:

- `instance` (string): LLNG instance name (uses default if omitted)
- `user` (string, required)

### `llng_consent_delete` (~48 tokens)

Delete user's OIDC consent(s)

Input parameters:

- `ids` (array, required)
- `instance` (string): LLNG instance name (uses default if omitted)
- `user` (string, required)

### `llng_oidc_metadata` (~33 tokens)

Fetch OIDC discovery metadata

Input parameters:

- `instance` (string): LLNG instance name (uses default if omitted)

### `llng_oidc_authorize` (~42 tokens)

Get authorization URL with PKCE

Input parameters:

- `instance` (string): LLNG instance name (uses default if omitted)
- `scope` (string)

### `llng_oidc_tokens` (~49 tokens)

Exchange authorization code for tokens

Input parameters:

- `code` (string, required)
- `code_verifier` (string, required)
- `instance` (string): LLNG instance name (uses default if omitted)

### `llng_oidc_userinfo` (~44 tokens)

Get user info from OIDC provider

Input parameters:

- `access_token` (string, required)
- `instance` (string): LLNG instance name (uses default if omitted)

### `llng_oidc_introspect` (~43 tokens)

Introspect an access token

Input parameters:

- `instance` (string): LLNG instance name (uses default if omitted)
- `token` (string, required)

### `llng_oidc_refresh` (~40 tokens)

Refresh an access token

Input parameters:

- `instance` (string): LLNG instance name (uses default if omitted)
- `refresh_token` (string, required)

### `llng_oidc_whoami` (~55 tokens)

Decode ID token to show identity (WARNING: signature is NOT verified, for debugging only)

Input parameters:

- `id_token` (string, required)
- `instance` (string): LLNG instance name (uses default if omitted)

### `llng_oidc_check_auth` (~61 tokens)

Check if a URL requires authentication (only public URLs allowed, private/internal IPs blocked)

Input parameters:

- `access_token` (string, required)
- `instance` (string): LLNG instance name (uses default if omitted)
- `url` (string, required)

### `llng_oidc_issuer_enable` (~66 tokens)

Enable OIDC issuer on the LLNG instance (activates issuerDBOpenIDConnectActivation and generates signing keys)

Input parameters:

- `force` (boolean): Force re-enable even if already activated
- `instance` (string): LLNG instance name (uses default if omitted)

### `llng_oidc_rp_list` (~45 tokens)

List configured OIDC Relying Parties with their clientID and displayName

Input parameters:

- `instance` (string): LLNG instance name (uses default if omitted)

### `llng_oidc_rp_get` (~59 tokens)

Get full details of an OIDC Relying Party by confKey

Input parameters:

- `confKey` (string, required): The RP configuration key (internal identifier)
- `instance` (string): LLNG instance name (uses default if omitted)

### `llng_oidc_rp_add` (~158 tokens)

Add a new OIDC Relying Party

Input parameters:

- `clientId` (string, required): OAuth2 client ID
- `clientSecret` (string): OAuth2 client secret
- `confKey` (string, required): Internal identifier for the RP
- `displayName` (string): Display name for the RP
- `exportedVars` (object): Claim-to-attribute mappings (default: {"name":"cn","preferred_username":"uid","email":"mail"})
- `extraClaims` (object): Extra claims mappings
- `instance` (string): LLNG instance name (uses default if omitted)
- `options` (object): Additional raw OIDC RP options
- `redirectUris` (string, required): Redirect URIs (space or newline separated)

### `llng_oidc_rp_delete` (~55 tokens)

Delete an OIDC Relying Party by confKey

Input parameters:

- `confKey` (string, required): The RP configuration key to delete
- `instance` (string): LLNG instance name (uses default if omitted)

### `llng_instances` (~19 tokens)

List available LLNG instances and their transport mode

### `llng_download_saml_metadata` (~88 tokens)

Download SAML metadata from a remote IdP

Input parameters:

- `instance` (string): LLNG instance name (uses default if omitted)
- `noCheck` (boolean): Disable SSL certificate verification
- `outputFile` (string): Output file path for downloaded metadata
- `url` (string, required): URL of the remote SAML metadata
- `verbose` (boolean): Enable verbose output

### `llng_import_metadata` (~140 tokens)

Import a SAML federation into LLNG config

Input parameters:

- `idpPrefix` (string): Prefix for IdP entity IDs
- `ignoreIdp` (array): IdP entity IDs to ignore
- `ignoreSp` (array): SP entity IDs to ignore
- `instance` (string): LLNG instance name (uses default if omitted)
- `noCheck` (boolean): Disable SSL certificate verification
- `remove` (boolean): Remove entities not in metadata
- `spPrefix` (string): Prefix for SP entity IDs
- `url` (string, required): URL of the SAML federation metadata
- `verbose` (boolean): Enable verbose output

### `llng_delete_session` (~68 tokens)

Delete user sessions by UID pattern

Input parameters:

- `debug` (boolean): Enable debug output
- `force` (boolean): Force deletion without confirmation
- `instance` (string): LLNG instance name (uses default if omitted)
- `uid` (string, required): UID pattern to match for session deletion

### `llng_user_attributes` (~53 tokens)

Look up user attributes

Input parameters:

- `field` (string): Specific field to return
- `instance` (string): LLNG instance name (uses default if omitted)
- `username` (string, required): Username to look up

### `llng_purge_central_cache` (~69 tokens)

Purge expired sessions from central cache

Input parameters:

- `debug` (boolean): Enable debug output
- `force` (boolean): Force purge without confirmation
- `instance` (string): LLNG instance name (uses default if omitted)
- `json` (boolean): Output in JSON format

### `llng_purge_local_cache` (~44 tokens)

Purge local handler cache

Input parameters:

- `debug` (boolean): Enable debug output
- `instance` (string): LLNG instance name (uses default if omitted)

### `llng_rotate_oidc_keys` (~44 tokens)

Rotate OIDC signing keys

Input parameters:

- `debug` (boolean): Enable debug output
- `instance` (string): LLNG instance name (uses default if omitted)

## Diagnostics

Captured diagnostic sections: Provenance, Vulnerabilities, Dependencies. The full working is on the page: https://verifymcp.io/servers/linagora-llng-mcp/llng-mcp#diagnostics

## Score history

- 2026-08-04: 58
- 2026-08-03: 58
- 2026-08-02: 58
- 2026-08-01: 15
- 2026-07-31: 28
- 2026-07-29: 40
- 2026-07-28: 40
- 2026-07-27: 40

## Links

- npm package: https://www.npmjs.com/package/llng-mcp
- Socket report: https://socket.dev/npm/package/llng-mcp
- Changelog RSS feed: https://verifymcp.io/servers/linagora-llng-mcp/llng-mcp/changelog.xml
- Changelog JSON feed: https://verifymcp.io/servers/linagora-llng-mcp/llng-mcp/changelog.json
- HTML version of this page: https://verifymcp.io/servers/linagora-llng-mcp/llng-mcp