# LightMCP

> Lightweight stdio-based MCP server for AI models with Lua integration

- **Type:** MCP server
- **Install:** `agentstack add mcp-igor725-lightmcp`
- **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior
- **Seller:** [igor725](https://agentstack.voostack.com/s/igor725)
- **Installs:** 0
- **Category:** [Integrations](https://agentstack.voostack.com/c/integrations)
- **Latest version:** 0.1.0
- **License:** MIT
- **Upstream author:** [igor725](https://github.com/igor725)
- **Source:** https://github.com/igor725/LightMCP

## Install

```sh
agentstack add mcp-igor725-lightmcp
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

# LightMCP
LightMCP is a lightweight multiplatform MCP stdio-based server written in C++. This server supports very basic protocol functionality for tools/resources creation.

The example executable has no tools by default. There's a plugin system and 2 built-in plugins:
* `lua` - Arbitrary Lua script execution (enabled by default)
* `example` - Random number generation + simple resource (disabled by default)
* `buzzyfuzzy` - Fuzzy search through decompiled CHM file using [chm-converter](https://github.com/DTDucas/chm-converter) (disabled by default)
* `simplemem` - Simple temporary cross-chat memory tool (disabled by default, most likely will malfunction in LM Studio since it kills MCP server process if unused)

This project is only tested in [LM Studio](https://lmstudio.ai/) and [llama.cpp](https://github.com/ggml-org/llama.cpp) environments. Compatibility with other clients is not guaranteed. If you encounter any error, you're welcome to report it in issues.

> [!WARNING]
> It is up to user to provide sandboxed Lua interpreter without potentially harmful functionality.
> Using stock interpreter with untouched `os`, `io`, `ffi` libraries may lead to malicious code
> execution by an AI model! The potentially harmful functionality from major Lua implementations
> like LuaJIT and all stock Lua interpreters is hidden behind CMake option called `LMCP_UNSAFE`
> and it's disabled by default. Even tho it is disabled, user should never assume that it's 
> safe to let AI execute whatever code it wants to execute, especially with custom interpreters
> I didn't take into consideration. Every script AI writes should be approved by the user first.

## Usage
Add the application to your `mcp.json`. Here's the file example:
```json
{
  "mcpServers": {
    "LightMCP": {
      "command": "D:/LightMCP/build/LightMCP.exe",
      "args": [
        "--vm-timeout", "2",
        "--print-max", "5000",
        "--return-max", "5000"
      ]
    }
  }
}
```

Use `./LightMCP.exe --help` to get the list of available arguments and their description.

## License
This project is licensed under MIT license.
Used third party libraries and their corresponding licenses are placed inside the `third_party` directory.

## Source & license

This open-source MCP server is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [igor725](https://github.com/igor725)
- **Source:** [igor725/LightMCP](https://github.com/igor725/LightMCP)
- **License:** MIT

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** no
- **Filesystem access:** no
- **Shell / process execution:** no
- **Environment & secrets:** no
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: passed — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/mcp-igor725-lightmcp
- Seller: https://agentstack.voostack.com/s/igor725
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.