Red Hat Lightspeed MCP

(formerly known as Insights MCP)

Red Hat Lightspeed Model Context Protocol (MCP) server is a lightweight, self-hosted solution that connects LLM-based agents - such as Claude Desktop and other MCP-compatible tools - to Red Hat Lightspeed services.

Features

• Supports read-only operations: The server runs in read-only mode by default. Use --all-tools to enable write tools (e.g. create blueprints, run composes). RBAC permissions can also restrict access.
• Provides natural language prompts: provides an ability to use natural language for querying Red Hat Lightspeed services

Supported Lightspeed Services

• advisor
• hosted image builder
• inventory
• planning
• remediations
• vulnerability

Setup and usage

Authentication

Note: Authentication is only required for accessing Red Hat Lightspeed APIs. The MCP server itself does not require authentication.

There are two ways to authenticate:

1. Service Account (client_id + client_secret) — create a service account and provide the credentials via environment variables or HTTP headers.
2. JWT Bearer Token — provide a pre-existing JWT token via the Authorization: Bearer <token> HTTP header (SSE/HTTP transports only).

Service Account Setup

1. Go to https://console.redhat.com → Click Settings (⚙️ Gear Icon) → "Service Accounts"
2. Create a service account and remember Client ID and Client secret for later.
   See below in the integration instructions, there they are respectively referred to as LIGHTSPEED_CLIENT_ID and LIGHTSPEED_CLIENT_SECRET.

Required Permissions by Toolset

Different toolsets require specific roles for your service account:

• Advisor tools: RHEL Advisor viewer
• Inventory tools: Inventory Hosts viewer
• Vulnerability tools: Vulnerability viewer, Inventory Hosts viewer
• Remediation tools: Remediations user

Granting Permissions to Service Accounts

By default, service accounts have no access. An organization administrator must assign permissions. The MCP server will only be able to perform tasks that it has permission to perform. For example, if the user wants to allow read-only operations and deny write operations, this can be accomplished via the permissions system.

For detailed step-by-step instructions, see this video tutorial: Service Account Permissions Setup

1. Log in as Organization Administrator with User Access administrator role

2. Navigate to User Access Settings: Click Settings (⚙️ Gear Icon) → "User Access" → "Groups"

3. Assign permissions (choose one option):

   Option A - Create New Group:

   • Create new group (e.g., mcp-service-accounts)
   • Add required roles (e.g., RHEL Advisor viewer, Inventory Hosts viewer, etc.)
   • Add your service account to this group

   Option B - Use Existing Group:

   • Open existing group with necessary roles
   • Go to "Service accounts" tab
   • Add your service account to the group

Your service account will inherit all roles from the assigned group.

⚠️ Security Remarks ⚠️

If you start this MCP server locally (with podman or docker) make sure the conta

... View full README on GitHub