Direct Node.js — Streamable HTTP

The direct Node.js service defaults to loopback and exposes Streamable HTTP at POST /mcp plus a small health endpoint at GET /health.

Direct Node.js — Streamable HTTP on loopback

git clone https://github.com/enthouan/simplelogin-mcp.git
cd simplelogin-mcp
corepack enable
pnpm install --filter simplelogin-mcp --frozen-lockfile
cp .env.example .env
# Keep TRANSPORT=http, HOST=127.0.0.1, and PORT=3000; set SL_API_KEY in .env
${EDITOR:-vi} .env
grep -Eq '^SL_API_KEY=.+$' .env || { echo 'Set SL_API_KEY in .env before starting.' >&2; exit 1; }
pnpm build
# Load the file without putting the key in shell history or the parent shell
(
  set -a
  . ./.env
  set +a
  pnpm start
)

Connect to POST http://127.0.0.1:3000/mcp. A direct loopback run does not require MCP_AUTH_TOKEN. The server refuses a wider bind without it unless the explicit unsafe override is enabled; supported wider deployments use the token and TLS.

Connect a client

1. Start on loopback. Keep HOST=127.0.0.1 for same-machine access.
2. Verify health. Request http://127.0.0.1:3000/health.
3. Register the endpoint. Point a Streamable HTTP client at http://127.0.0.1:3000/mcp.
4. Add authorization when configured. Send Authorization: Bearer <token> whenever MCP_AUTH_TOKEN is set.

Wider HTTP needs authentication and TLS

The server refuses an unauthenticated non-loopback bind unless the unsafe override is explicitly enabled. For LAN or public access, set MCP_AUTH_TOKEN and terminate TLS at a reverse proxy; the server itself speaks plain HTTP.

Browser-origin checks

Browser requests to POST /mcp must come from loopback or an exact origin listed in MCP_ALLOWED_ORIGINS. This allowlist protects the MCP route from hostile browser origins. It does not add CORS response headers, handle preflight requests, or replace authentication.

Verify through MCP

The health endpoint does not exercise MCP discovery or the SimpleLogin API. After registering the endpoint in a client, verify the complete read-only path.

Verify it works

After the client discovers the server, use this low-data, read-only check:

Read-only verification prompt

Can you show me my SimpleLogin account usage?

Expected result

The expected tool is account_get_stats. Confirm that it is marked read-only before approving it. It takes no arguments and returns aggregate account counts without changing SimpleLogin. Those counts still pass through the client and its configured model.

Use Operations for process inspection, credential rotation, upgrades, rollback, and shutdown.