# Red Hat Lightspeed MCP

> Model Context Protocol server for Red Hat Lightspeed - advisor, image builder, inventory, and more

- **Type:** MCP server
- **Install:** `agentstack add mcp-redhatinsights-insights-mcp`
- **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior
- **Seller:** [RedHatInsights](https://agentstack.voostack.com/s/redhatinsights)
- **Installs:** 0
- **Category:** [Content & Media](https://agentstack.voostack.com/c/content-and-media)
- **Latest version:** 1.0.0
- **License:** Apache-2.0
- **Upstream author:** [RedHatInsights](https://github.com/RedHatInsights)
- **Source:** https://github.com/RedHatInsights/insights-mcp

## Install

```sh
agentstack add mcp-redhatinsights-insights-mcp
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

# Red Hat Lightspeed MCP
_(formerly known as Insights MCP)_

Red Hat Lightspeed Model Context Protocol ([MCP](https://modelcontextprotocol.io)) server is a lightweight, self-hosted solution that connects LLM-based agents - such as Claude Desktop and other MCP-compatible tools - to Red Hat Lightspeed services.

## Features
 * Supports read-only operations: The server runs in read-only mode by default. Use `--all-tools` to enable write tools (e.g. create blueprints, run composes). RBAC permissions can also restrict access.
 * Provides natural language prompts: provides an ability to use natural language for querying Red Hat Lightspeed services

## Supported Lightspeed Services
 * [advisor](https://docs.redhat.com/en/documentation/red_hat_insights/1-latest/html/assessing_rhel_configuration_issues_using_the_red_hat_insights_advisor_service/index)
 * [hosted image builder](https://osbuild.org/docs/hosted/architecture/)
 * [inventory](https://docs.redhat.com/en/documentation/red_hat_insights/1-latest/html/viewing_and_managing_system_inventory/index)
 * [planning](https://docs.redhat.com/en/documentation/red_hat_lightspeed/1-latest/html/dynamically_creating_a_digital_roadmap_to_manage_rhel_systems/index)
 * [remediations](https://docs.redhat.com/en/documentation/red_hat_insights/1-latest/html/red_hat_insights_remediations_guide/index)
 * [vulnerability](https://docs.redhat.com/en/documentation/red_hat_insights/1-latest/html/assessing_and_monitoring_security_vulnerabilities_on_rhel_systems/index)

## Setup and usage

### Authentication

**Note**: Authentication is only required for accessing Red Hat Lightspeed APIs. The MCP server itself does not require authentication.

There are two ways to authenticate:

1. **Service Account** (client_id + client_secret) — create a service account and provide the credentials via environment variables or HTTP headers.
2. **JWT Bearer Token** — provide a pre-existing JWT token via the `Authorization: Bearer ` HTTP header (SSE/HTTP transports only).

#### Service Account Setup

1. Go to https://console.redhat.com → Click Settings (⚙️ Gear Icon) →  "Service Accounts"
2. Create a service account and remember `Client ID` and `Client secret` for later.
   See below in the integration instructions, there they are respectively referred to as
   `LIGHTSPEED_CLIENT_ID` and `LIGHTSPEED_CLIENT_SECRET`.

#### Required Permissions by Toolset

Different toolsets require specific roles for your service account:

- **Advisor tools**: `RHEL Advisor viewer`
- **Inventory tools**: `Inventory Hosts viewer`
- **Vulnerability tools**: `Vulnerability viewer`, `Inventory Hosts viewer`
- **Remediation tools**: `Remediations user`

#### Granting Permissions to Service Accounts

By default, service accounts have no access. An organization administrator must assign permissions. The MCP server will only be able to perform tasks that it has permission to perform. For example, if the user wants to allow read-only operations and deny write operations, this can be accomplished via the permissions system.

For detailed step-by-step instructions, see this video tutorial: [Service Account Permissions Setup](https://www.youtube.com/watch?v=UvNcmJsbg1w)

1. **Log in as Organization Administrator** with User Access administrator role
2. **Navigate to User Access Settings**: Click Settings (⚙️ Gear Icon) → "User Access" → "Groups"
3. **Assign permissions** (choose one option):

   **Option A - Create New Group:**
   - Create new group (e.g., `mcp-service-accounts`)
   - Add required roles (e.g., RHEL Advisor viewer, Inventory Hosts viewer, etc.)
   - Add your service account to this group

   **Option B - Use Existing Group:**
   - Open existing group with necessary roles
   - Go to "Service accounts" tab
   - Add your service account to the group

Your service account will inherit all roles from the assigned group.

#### ⚠️ Security Remarks ⚠️

If you start this MCP server locally (with `podman` or `docker`) make sure the container is not exposed to the internet. In this scenario it's probably fine to use `LIGHTSPEED_CLIENT_ID` and `LIGHTSPEED_CLIENT_SECRET` although your MCP Client (e.g. VSCode, Cursor, etc.) can get your `LIGHTSPEED_CLIENT_ID` and `LIGHTSPEED_CLIENT_SECRET`.

For a deployment where you connect to this MCP server from a different machine, you should consider that `LIGHTSPEED_CLIENT_ID` and `LIGHTSPEED_CLIENT_SECRET` (or your JWT Bearer token) are transferred to the MCP server and you are trusting the remote MCP server not to leak them.

In both cases if you are in doubt, please disable/remove the `LIGHTSPEED_CLIENT_ID` and `LIGHTSPEED_CLIENT_SECRET` from your account after you are done using the MCP server.

#### Security & Incident Response (Emergency Revocation)

To ensure safe AI operations and compliance with security standards, operators must be able to rapidly sever the connected LLM's access to Red Hat Lightspeed in the event of abnormal AI behavior, unexpected data exposure, or suspected token compromise.

**Emergency "Kill Switch" Procedure:**

If you need to immediately revoke AI access to the toolsets, execute the following steps:
1. **Terminate the Server:** Stop the MCP container or local process immediately (e.g., run `podman ps` to find the container, then `podman stop `).
2. **Revoke Credentials:** Invalidate the Red Hat Client ID used by the MCP server to authenticate with Red Hat services. Go to the "[Service Accounts](https://console.redhat.com/iam/service-accounts)" page and `Delete` or `Reset` the credentials.

Additionally you can remove the MCP server entry (e.g., `lightspeed-mcp` in your client's `mcp.json`) from your local LLM client's configuration to prevent the client from attempting to restart or reconnect to the server.

If credential compromise or data exposure is suspected, assess breach notification obligations under applicable law (e.g., GDPR). For logging, debug mode, and compliance details, see [HACKING.md - Logging and Compliance](HACKING.md#logging-and-compliance).

## Technical Info
### Toolsets

See [toolsets.md](toolsets.md) for the toolsets available in the MCP server.

## Integrations

### Prerequisites

Make sure you have `podman` installed.
(Docker is fine too but the commands below have to be adapted accordingly)

You can install it with `sudo dnf install podman` on Fedora/RHEL/CentOS,
or on macOS use either [Podman Desktop](https://podman-desktop.io/) or `brew install podman`.

⚠️ **Note** if you use Podman on macOS, you sometimes need to set the path to `podman` explicitly.
E.g. replace `podman` with the full path. Should be something like

 * `/usr/local/bin/podman`
 * `/opt/homebrew/bin/podman`
 * …

You can find the path by running `which podman` in your terminal.

### VSCode

First check the [prerequisites](#prerequisites) section.

#### Option 1: One-click installation (easiest)

[](https://insiders.vscode.dev/redirect/mcp/install?name=red-hat-lightspeed-mcp&config=%7B%22type%22%3A%20%22stdio%22%2C%20%22command%22%3A%20%22podman%22%2C%20%22args%22%3A%20%5B%22run%22%2C%20%22--env%22%2C%20%22LIGHTSPEED_CLIENT_ID%22%2C%20%22--env%22%2C%20%22LIGHTSPEED_CLIENT_SECRET%22%2C%20%22--interactive%22%2C%20%22--rm%22%2C%20%22quay.io%2Fredhat-services-prod%2Finsights-management-tenant%2Finsights-mcp%2Fred-hat-lightspeed-mcp%3Alatest%22%5D%2C%20%22env%22%3A%20%7B%22LIGHTSPEED_CLIENT_ID%22%3A%20%22%24%7Binput%3Alightspeed_client_id%7D%22%2C%20%22LIGHTSPEED_CLIENT_SECRET%22%3A%20%22%24%7Binput%3Alightspeed_client_secret%7D%22%7D%7D&inputs=%5B%7B%22id%22%3A%20%22lightspeed_client_id%22%2C%20%22type%22%3A%20%22promptString%22%2C%20%22description%22%3A%20%22Enter%20the%20Red%20Hat%20Lightspeed%20Client%20ID%22%2C%20%22default%22%3A%20%22%22%2C%20%22password%22%3A%20true%7D%2C%20%7B%22id%22%3A%20%22lightspeed_client_secret%22%2C%20%22type%22%3A%20%22promptString%22%2C%20%22description%22%3A%20%22Enter%20the%20Red%20Hat%20Lightspeed%20Client%20Secret%22%2C%20%22default%22%3A%20%22%22%2C%20%22password%22%3A%20true%7D%5D)
(Note: this uses the `quay.io` container image)

#### Option 2: Manual STDIO installation

For the usage in your project, create a file called `.vscode/mcp.json` with
the following content.

```
{
    "inputs": [
        {
            "id": "lightspeed_client_id",
            "type": "promptString",
            "description": "Enter the Red Hat Lightspeed Client ID",
            "default": "",
            "password": true
        },
        {
            "id": "lightspeed_client_secret",
            "type": "promptString",
            "description": "Enter the Red Hat Lightspeed Client Secret",
            "default": "",
            "password": true
        }
    ],
    "servers": {
        "lightspeed-mcp": {
            "type": "stdio",
            "command": "podman",
            "args": [
                "run",
                "--env",
                "LIGHTSPEED_CLIENT_ID",
                "--env",
                "LIGHTSPEED_CLIENT_SECRET",
                "--interactive",
                "--rm",
                "ghcr.io/redhatinsights/red-hat-lightspeed-mcp:latest"
            ],
            "env": {
                "LIGHTSPEED_CLIENT_ID": "${input:lightspeed_client_id}",
                "LIGHTSPEED_CLIENT_SECRET": "${input:lightspeed_client_secret}"
            }
        }
    }
}
```

### Cursor

First check the [prerequisites](#prerequisites) section.

#### Option 1: One-click installation (easiest)

⚠️ Use **`Ctrl`/`Cmd`-click** to open in a **new tab**.
Otherwise the tab will close after installation and you won't see the documentation anymore.
[](https://cursor.com/en/install-mcp?name=red-hat-lightspeed-mcp&config=eyJ0eXBlIjoic3RkaW8iLCJjb21tYW5kIjoicG9kbWFuIHJ1biAtLWVudiBMSUdIVFNQRUVEX0NMSUVOVF9JRCAtLWVudiBMSUdIVFNQRUVEX0NMSUVOVF9TRUNSRVQgLS1pbnRlcmFjdGl2ZSAtLXJtIHF1YXkuaW8vcmVkaGF0LXNlcnZpY2VzLXByb2QvaW5zaWdodHMtbWFuYWdlbWVudC10ZW5hbnQvaW5zaWdodHMtbWNwL3JlZC1oYXQtbGlnaHRzcGVlZC1tY3A6bGF0ZXN0IiwiZW52Ijp7IkxJR0hUU1BFRURfQ0xJRU5UX0lEIjoiIiwiTElHSFRTUEVFRF9DTElFTlRfU0VDUkVUIjoiIn19)
(Note: this uses the `quay.io` container image)

#### Option 2: Manual STDIO installation

Cursor doesn't seem to support `inputs` you need to add your credentials in the config file.
To start the integration create a file `~/.cursor/mcp.json` with
```
{
  "mcpServers": {
    "lightspeed-mcp": {
        "type": "stdio",
        "command": "podman",
        "args": [
            "run",
            "--env",
            "LIGHTSPEED_CLIENT_ID",
            "--env",
            "LIGHTSPEED_CLIENT_SECRET",
            "--interactive",
            "--rm",
            "ghcr.io/redhatinsights/red-hat-lightspeed-mcp:latest"
        ],
        "env": {
            "LIGHTSPEED_CLIENT_ID": "",
            "LIGHTSPEED_CLIENT_SECRET": ""
        }
    }
  }
}
```

If you see the error `Some tools have naming issues and may be filtered out.`, see [Known Issues](#known-issues).

#### Option 3: Manual Streamable HTTP installation (advanced)

start the server:

```
podman run --net host --rm ghcr.io/redhatinsights/red-hat-lightspeed-mcp:latest http
```

then integrate using **service account credentials**:

```
{
    "mcpServers": {
        "lightspeed-mcp": {
            "type": "http",
            "url": "http://localhost:8000/mcp",
            "headers": {
                "lightspeed-client-id": "",
                "lightspeed-client-secret": ""
            }
        }
    }
}
```

or alternatively using a **JWT Bearer token**:

```
{
    "mcpServers": {
        "lightspeed-mcp": {
            "type": "http",
            "url": "http://localhost:8000/mcp",
            "headers": {
                "Authorization": "Bearer "
            }
        }
    }
}
```

### Gemini CLI

First check the [prerequisites](#prerequisites) section.

#### Option 1: Manual STDIO installation
To start the integration create a file `~/.gemini/settings.json` with the following command:

```
{
    ...
    "mcpServers": {
        "lightspeed-mcp": {
            "type": "stdio",
            "command": "podman",
            "args": [
                "run",
                "--env",
                "LIGHTSPEED_CLIENT_ID=",
                "--env",
                "LIGHTSPEED_CLIENT_SECRET=",
                "--interactive",
                "--rm",
                "ghcr.io/redhatinsights/red-hat-lightspeed-mcp:latest"
            ]
        }
    }
}
```

#### Option 2: Manual Streamable HTTP installation (advanced)

start the server:

```
podman run --net host --rm ghcr.io/redhatinsights/red-hat-lightspeed-mcp:latest http
```

> [!NOTE]
> For podman machine on a mac you will need to set the host explicitly and expose the port
>
> ```
>   podman run -p 8000:8000 --rm ghcr.io/redhatinsights/red-hat-lightspeed-mcp:latest http --host 0.0.0.0
> ```

then integrate using **service account credentials**:

```
{
    ...
    "mcpServers": {
        "lightspeed-mcp": {
            "httpUrl": "http://localhost:8000/mcp",
            "headers": {
                "lightspeed-client-id": "",
                "lightspeed-client-secret": ""
            }
        }
    }
}
```

or alternatively using a **JWT Bearer token**:

```
{
    ...
    "mcpServers": {
        "lightspeed-mcp": {
            "httpUrl": "http://localhost:8000/mcp",
            "headers": {
                "Authorization": "Bearer "
            }
        }
    }
}
```

### Claude Desktop

First check the [prerequisites](#prerequisites) section.

For Claude Desktop there is an extension file in the [release section](https://github.com/RedHatInsights/insights-mcp/releases) of the project.

Just download the `red-hat-lightspeed-mcp*.mcpb` file (or `red-hat-lightspeed-mcp*.dxt` for legacy format) and add this in Claude Desktop with

`Settings -> Extensions -> Advanced Extensions Settings -> Install Extension…`

### CLine with VSCode

First check the [prerequisites](#prerequisites) section.

First off, start the SSE server with `sse` argument:

```bash
export LIGHTSPEED_CLIENT_ID=
export LIGHTSPEED_CLIENT_SECRET=
podman run --env LIGHTSPEED_CLIENT_ID --env LIGHTSPEED_CLIENT_SECRET --net host --rm ghcr.io/redhatinsights/red-hat-lightspeed-mcp:latest sse
```

In the `CLine -> Manage MCP Servers` interface, add a new server name and URL:
`http://localhost:9000/sse`. It shall create the following config:

```json
{
  "mcpServers": {
    "lightspeed-mcp": {
      "disabled": false,
      "type": "sse",
      "url": "http://localhost:9000/sse"
    }
  }
}
```

Ensure the `type` is `sse` as CLine does not support `HTTP` transport yet.

### Generic STDIO

First check the [prerequisites](#prerequisites) section.

For generic integration into other tools via STDIO, you should set the environment variables
`LIGHTSPEED_CLIENT_ID` and `LIGHTSPEED_CLIENT_SECRET` and use this command for an
integration using podman:

```bash
export LIGHTSPEED_CLIENT_ID=
export LIGHTSPEED_CLIENT_SECRET=
podman run --env LIGHTSPEED_CLIENT_ID --env LIGHTSPEED_CLIENT_SECRET --interactive --rm ghcr.io/redhatinsights/red-hat-lightspeed-mcp:latest
```

It is the MCP API what is exposed through standard input, not a chat interface.
You need an MCP client with "agent capabilities" to connect to the `red-hat-lightspeed-mcp` server and really use it.

#### Claude Code

First check the [prerequisites](#prerequisites) section.

Claude Code requires a slight change to the podman command, as the host environment is not
available when it runs. The credentials must be copied into the configuration instead, which
can be done with the following command after setting `LIGHTSPEED_CLIENT_ID` and
`LIGHTSPEED_CLIENT_SECRET` environment variables:

```bash
export LIGHTSPEED_CLIENT_ID=
export LIGHTSPEED_CLIENT_SECRET=
claude mcp add red-hat-lightspeed-mcp -- podman run --env LIGHTSPEED_CLIENT_ID=$LIGHTSPEED_CLIENT_ID --env LIGHTSPEED_CLIENT_SECRET=$LIGHTSPEED_CLIENT_SECRET --interactive --rm ghcr.io/redhatinsights/red-hat-lightspeed-mcp:latest
```

or just set the variables in the command directly:

```

…

## Source & license

This open-source MCP server is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [RedHatInsights](https://github.com/RedHatInsights)
- **Source:** [RedHatInsights/insights-mcp](https://github.com/RedHatInsights/insights-mcp)
- **License:** Apache-2.0

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v1.0.0 — what this tool can access:

- **Network access:** no
- **Filesystem access:** no
- **Shell / process execution:** no
- **Environment & secrets:** no
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **1.0.0** — security scan: passed — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/mcp-redhatinsights-insights-mcp
- Seller: https://agentstack.voostack.com/s/redhatinsights
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.