User MCP login and proxy
Distinguish terminal CLI commands, the OAuth MCP bridge and local secret custody.
The CLI package has two different uses: ordinary terminal commands perform product operations through the Public API; neatlogs mcp proxy carries structured MCP messages between an AI host and /mcp/user. It does not translate each AI request into a terminal product command.
These commands describe the user-MCP preview, not the published 0.2.1 reference. Login, proxy and reveal have a qualified DEV candidate (0.2.2-team-test.1); the logout follow-up below has candidate remote-test evidence, but its deployed/published sign-out journey still needs qualification. Public publication and the approved regional registration must be qualified separately. Use the exact compatible installation instructions supplied by your deployment. Node.js 22 or 24 is required.
Copy the endpoint, issuer, application client ID and approved consent scopes from the deployment's setup flow. No personal user ID or project API key is needed. auth login for ordinary CLI profiles and mcp login for the registered MCP resource are distinct credential bindings; do not interchange their tokens.
mcp login defaults to the terminal CLI's read scopes. For write actions, explicitly request the registration-approved scopes shown by setup and review OAuth consent. The proxy does not add write scopes or account roles itself.
The command tables below are copied from the candidate command tree. Existing mcp connect/list/status commands manage outbound/custom product connections; they are not a substitute for signing an AI host into NeatLogs user MCP.
neatlogs mcp login
Authorize the registered regional MCP resource and store its credentials in the selected native vault.
Usage: neatlogs mcp login [options]
Arguments
None.
Options
| Option | Requirement | Description | Default |
|---|---|---|---|
--endpoint <url> | Required option | — | — |
--issuer <url> | Required option | — | — |
--client-id <id> | Required option | registered MCP client with loopback redirects enabled | — |
--scope <scope...> | Optional option | requested OAuth scopes | ["context:read","organization:read","billing:read","profile:read","observability:read","evaluation:read","configuration:read","sharing:read","access:read","offline_access"] |
--allow-file-custody | Optional option | allow protected-file credentials if keyring is unavailable | — |
neatlogs mcp proxy
Run the stdio MCP bridge launched by an AI client. This mode requires piped protocol input.
Usage: neatlogs mcp proxy [options]
Arguments
None.
Options
| Option | Requirement | Description | Default |
|---|---|---|---|
--endpoint <url> | Required option | registered regional /mcp/user resource | — |
--issuer <url> | Required option | — | — |
--client-id <id> | Required option | — | — |
--allow-file-custody | Optional option | explicitly use private files instead of the native keyring | — |
neatlogs mcp logout
This auth-lifecycle command is a candidate follow-up. Use it only with a qualified candidate that includes it; the earlier acceptance artifact and published CLI must not be assumed to provide it.
Revoke the OAuth credential bound to the same endpoint, issuer and application client ID used for sign-in, then remove its local credential. Ordinary auth logout manages normal CLI profiles and is not a substitute for this MCP binding.
Usage: neatlogs mcp logout [options]
Arguments
None.
Options
| Option | Requirement | Description | Default |
|---|---|---|---|
--endpoint <url> | Required option | registered regional /mcp/user resource | — |
--issuer <url> | Required option | — | — |
--client-id <id> | Required option | — | — |
--allow-file-custody | Optional option | explicitly permit the binding's protected-file credential store | — |
A successful result distinguishes server revocation accepted or not required from local credential removal. not_required means there was no stored credential requiring a revocation request; it does not prove that grants on other devices were revoked. Server/network failure reports an error and retains the local credential; it does not falsely report a completed sign-out. Server acceptance is not independent proof of every downstream session's state.
Logout does not remove the AI host's MCP configuration, custody/result history or accepted jobs. Remove or disable the host entry separately if you no longer want it to connect. A logout is not cancellation or rollback of an accepted operation.
neatlogs mcp reveal <invocation-id>
Explicitly access an eligible locally held secret result from a human terminal.
Usage: neatlogs mcp reveal [options] <invocation-id>
Arguments
| Argument | Requirement | Description | Default |
|---|---|---|---|
invocation-id | Required argument | — | — |
Options
| Option | Requirement | Description | Default |
|---|---|---|---|
--endpoint <url> | Required option | — | — |
--issuer <url> | Required option | — | — |
--client-id <id> | Required option | — | — |
--allow-file-custody | Optional option | use the explicitly selected private-file store | — |
Custody and recovery
Prefer the native operating-system credential vault. --allow-file-custody is an explicit fallback, not the default setup. The proxy never sends a revealed secret to the model. mcp reveal is a separate human terminal action; do not run it in an AI transcript or retain its output in acceptance evidence.
After an uncertain response, use the original invocation or declared durable recovery path. Reconnecting a proxy does not authorize repeating a mutation or starting a new job. See the user setup guide and catalog reference.