Docker Compose — Streamable HTTP

Use the operator Compose file to run the published container image. The application listens on 0.0.0.0:3000 inside the container so Docker can forward the port, while the host publishes only to 127.0.0.1 by default.

Docker Compose — Streamable HTTP quick start

git clone https://github.com/enthouan/simplelogin-mcp.git
cd simplelogin-mcp
cp .env.example .env
# Set SL_API_KEY and MCP_AUTH_TOKEN in .env
${EDITOR:-vi} .env
grep -Eq '^SL_API_KEY=.+$' .env || { echo 'Set SL_API_KEY in .env before starting.' >&2; exit 1; }
grep -Eq '^MCP_AUTH_TOKEN=.+$' .env || { echo 'Set MCP_AUTH_TOKEN in .env before starting.' >&2; exit 1; }
docker compose up -d
docker compose ps
curl http://localhost:3000/health

Compose listens on 0.0.0.0:3000 inside the container, publishes only to 127.0.0.1 by default, and the normal startup guard requires MCP_AUTH_TOKEN. Only the explicit unsafe override bypasses that guard.

Pin long-lived deployments

The quick start uses the moving latest image tag. Before operating a long-lived installation, set SIMPLELOGIN_MCP_IMAGE_TAG to an available exact X.Y.Z release. See Operations for upgrade and rollback guidance.

Configure the two credentials

1. Create .env. Copy .env.example; Compose reads it for variable interpolation.

2. Set SL_API_KEY. Create a dedicated key, then store it in .env. This authenticates the server to SimpleLogin and grants full account control.

3. Generate MCP_AUTH_TOKEN. Run openssl rand -hex 32 and store the result in .env.

4. Start and verify. Run docker compose up -d, inspect docker compose ps, then request http://localhost:3000/health.

The host bind and container bind are different

Compose publishes 127.0.0.1:3000:3000 on the host by default, but the application sees its internal HOST=0.0.0.0. Keep MCP_AUTH_TOKEN set even for this loopback-only host publication.

Change host exposure deliberately

Use SIMPLELOGIN_MCP_HOST_PORT for the published host port. Set SIMPLELOGIN_MCP_HOST_BIND_IP=0.0.0.0 or a LAN address only when wider access is intentional, MCP_AUTH_TOKEN remains set, and a reverse proxy supplies TLS.

The container listener stays on port 3000; changing the host port does not require changing the application PORT.

Verify through MCP

Health only proves that the process is running. Connect an MCP client to http://127.0.0.1:3000/mcp with the configured bearer token, then verify discovery and a read-only tool call.

Verify it works

After the client discovers the server, use this low-data, read-only check:

Read-only verification prompt

Can you show me my SimpleLogin account usage?

Expected result

The expected tool is account_get_stats. Confirm that it is marked read-only before approving it. It takes no arguments and returns aggregate account counts without changing SimpleLogin. Those counts still pass through the client and its configured model.

Use Operations for exact-version upgrades, rollback, credential rotation, inspection, and shutdown.