---

title: TianGong LCA MCP README EN docType: guide scope: repo status: active authoritative: false owner: mcp language: en whenToUse:

• when you need English user-facing MCP package setup, Docker usage, local startup, or inspector examples whenToUpdate:
• when English startup commands, Docker usage, package invocation, or user-facing MCP examples change checkPaths:
• README.md
• README_CN.md
• package.json
• Dockerfile
• mcp_config.json
• src/index.ts
• src/index_server.ts
• src/index_server_local.ts
• src/http_app.ts
• src/http_app_local.ts lastReviewedAt: 2026-10-25 lastReviewedCommit: 3ddf1367e7d48fc12cf43e953ef539070c7671fd lastReviewedNote: ‘MCP #97: reviewed explicit backend guards and offline/STDIO regression, plus the bounded Zod/body-parser/Vite/Undici security repair. HTTP OAuth, public schemas, SDK, Express, source package version, Docker pin and publication boundaries are preserved.’ related:
• AGENTS.md
• .docpact/config.yaml
• DEV_EN.md
• README_CN.md

---

TianGong-LCA-MCP

中文 | English

TianGong LCA Model Context Protocol (MCP) Server supports STDIO and Streamable Http protocols.

Environment

Copy .env.example and populate its Supabase issuer, publishable key, exact admitted public OAuth client IDs, and allowed browser origins. OAuth authentication requires no Redis, confidential client secret, or server-side session encryption key.

GLAD dataset search tools additionally require a GLAD API key:

GLAD_API_KEY=your-glad-api-key
GLAD_API_BASE_URL=https://www.globallcadataaccess.org/api/v1

Remote OAuth

Remote Streamable HTTP is an OAuth 2.1 protected resource. A compatible MCP host discovers /.well-known/oauth-protected-resource/mcp, follows its Supabase Auth authorization server, opens the user’s browser, and completes Authorization Code with S256 PKCE. The user signs in and consents in Next; usernames and passwords are never entered into the AI or MCP host.

Supabase issues the access and rotating refresh tokens directly to the public MCP client. The client stores its refresh token locally and sends the short-lived Supabase ES256 access JWT on every MCP request. The server verifies signature, issuer, audience, expiry, role/session, and exact client_id; Edge/PostgREST then re-verify the same user/client context and enforce RLS capabilities.

Dynamic Client Registration remains disabled. Operators register exact public clients and loopback callbacks in Supabase, then list those UUID client IDs in MCP_OAUTH_ALLOWED_CLIENT_IDS_JSON. Unknown, malformed, expired, Cognito, and password/API-key bearers fail the canonical OAuth challenge without fallback I/O.