Labby MCP server

<!-- Absolute raw URL, not relative: unraid/ca/labby.xml points Community Applications at this file's raw URL, and CA renders the markdown outside any repo context where a relative path would 404. Markdown image syntax, not : the fleet repository contract's readme_lead() skips lines starting with '

Labby

Rust MCP gateway with Code Mode, authentication, setup, logs, CLI, HTTP API, and operator web UI.

Canonical remote: git@github.com:dinglebear-ai/labby.git.

The root README is the public entrypoint. The topic docs in docs/ own the detailed contracts; when this file and a topic doc disagree, fix the topic doc first and then refresh this summary.

Contents

• What Labby Does
• Quick Start
• Core Workflows
• Runtime Surfaces
• Configuration
• Current Catalogs
• Architecture
• Development
• Documentation

What Labby Does

Labby is centered on the current gateway/operator surface:

tools/resources/prompts, apply exposure filters, publish protected MCP routes, and optionally collapse the upstream catalog into Code Mode search and execute.

• MCP gateway - connect HTTP and stdio upstream MCP servers, inspect their

labby proxy /path/to/dist.js and expose its unmodified MCP surface over loopback or an owned Tailscale Serve HTTPS port with tailnet, bearer, OAuth, or explicit no-auth policy.

• Direct stdio proxy - launch one stdio MCP server with

manage route-scoped access, authorize upstream OAuth connections, and publish protected MCP endpoints.

• Authentication and protected routes - run bearer or OAuth authentication,

against the upstream catalog, with artifacts persisted under $LABBY_HOME.

• Code Mode snippets - author, store, and run reusable JavaScript snippets

run a health audit across env, reachability, auth, and versions.

• Setup and doctor - bootstrap ~/.labby, provision the host service, and

through the same action dispatch as every other service.

• Filesystem service - scoped, path-safety-checked file operations exposed

gateway host without introducing a separate fleet or deployment product.

• Server logs - search and tail the local labby serve log stream.
• Incus and bare-metal setup - provision and operate a dedicated Labby

proxy configuration, API route, OpenAPI, MCP help, CLI help, and feature-matrix artifacts under docs/generated.

• Generated discovery - publish code-owned service, action, environment,

Use the generated service, action, and CLI catalogs below for the complete current product surface instead of copying inventories into hand-written documentation. Standalone ACP chat, Marketplace/MCP Registry browser, Fleet, Deploy, and Stash products remain retired; bounded provider-backed discovery through the artifacts control-plane service does not restore those products.

Quick Start

Proxy One Stdio MCP Server

After installing Labby, configure proxy defaults once and launch a JavaScript stdio server without proxy flags:

labby setup proxy
labby doctor proxy
labby proxy /path/to/dist.js

The built-in zero-flag policy is Tailscale Serve plus tailnet authorization on a random high port. Child flags follow the first child token unchanged, and an explicit separator is available for unusual commands:

labby proxy /path/to/dist.js --workspace /srv/data --read-only
labby proxy -- npx -y @modelcontextprotocol/server-filesystem /srv/data

Shortened. The full README is on GitHub.