Red Hat Lightspeed MCP: server for RHEL fleets
Red Hat Lightspeed MCP
Official Red Hat Lightspeed MCP server: the agent reviews vulnerabilities, inventory and advice for RHEL, read-only by default
- 25 ★ on the repository
- Last commit
- Apache-2.0
Extended access
Why this level
- The service account opens company vulnerability and system inventory data to the agent
- With the --all-tools flag the agent creates image blueprints and runs composes
Install
- Works in
Manual install
claude mcp add red-hat-lightspeed-mcp -- podman run --env LIGHTSPEED_CLIENT_ID=$LIGHTSPEED_CLIENT_ID --env LIGHTSPEED_CLIENT_SECRET=$LIGHTSPEED_CLIENT_SECRET --interactive --rm ghcr.io/redhatinsights/red-hat-lightspeed-mcp:latestCommand from the README; set the two variables first.
Access and checks
How we reviewExtended accessThe tool runs code or makes network calls and only reads external data.
- The service account opens company vulnerability and system inventory data to the agent
- With the --all-tools flag the agent creates image blueprints and runs composes
This is third-party code. Review the repository files before installing.
What it does
Red Hat Lightspeed MCP, formerly Insights MCP, is a self-hosted server connecting AI agents to Red Hat Lightspeed services. It runs in a container through podman or docker and speaks stdio, HTTP or SSE. It covers nine toolsets: Advisor (RHEL configuration issues), Content sources (repositories), Hosted image builder, Inventory (the list of systems), OCP advisor (OpenShift cluster health), Planning (roadmap), Remediations, RHSM (activation keys) and Vulnerability. You can ask in plain language. By default the server is read-only. The --all-tools flag turns on write tools, such as creating blueprints and running composes. Permissions follow the Red Hat console role model: give the service account the roles it needs and the server can do only what is allowed.
Who it is for. RHEL fleet administrators and platform engineers on Red Hat who want to ask an agent about vulnerabilities and system state from Claude Code, Cursor or VS Code.
Good fit when
- After a CVE is published you need to find which inventory systems are vulnerable and what fixes are available
- Before a maintenance window you want the Advisor recommendations for a chosen group of systems
- OpenShift cluster health is checked through OCP advisor without opening the console
- An image is being prepared for new machines: the agent checks repositories and creates a blueprint in Hosted image builder
- A remediation plan has to be drafted through Remediations and shown before running
Not a fit when
- You need access without a Red Hat service account: the Lightspeed APIs require a Client ID and Client secret or a JWT token
- Your systems are not registered in Red Hat Lightspeed: the server sees only what is in your console account
- You want shared use of one instance without isolating credentials: the server passes keys on each call, so exposing it on a public host is unwise
Example request
Show systems with critical vulnerabilities in the inventory and suggest a remediation plan for each, running nothingMCP
- Transport
- stdio, http, sse
- Authentication
- API key
Environment variables
LIGHTSPEED_CLIENT_IDrequired, secret- Client ID of the Red Hat service account.
LIGHTSPEED_CLIENT_SECRETrequired, secret- Client secret of the Red Hat service account.
LIGHTSPEED_BASE_URL- Optional Lightspeed API address.
LIGHTSPEED_SSO_BASE_URL- Optional SSO address.
Limitations
It needs podman or docker. The ghcr.io/redhatinsights/red-hat-lightspeed-mcp:latest image runs with the LIGHTSPEED_CLIENT_ID and LIGHTSPEED_CLIENT_SECRET variables. A service account has no permissions by default: an organization administrator assigns roles such as Inventory Hosts viewer or Vulnerability viewer.
If the container is reachable over the network, credentials travel to the server, which then must be trusted. The README advises keeping the container closed to the internet and, when in doubt, deleting or resetting the keys. The Cline client supports only the SSE transport. API addresses can be set with LIGHTSPEED_BASE_URL and LIGHTSPEED_SSO_BASE_URL.
How to disable. Stop the container with podman stop and remove the entry from the client config, for example claude mcp remove red-hat-lightspeed-mcp. For urgent revocation delete or reset the Client ID on the Service Accounts page of the Red Hat console.
FAQ
How do I connect Red Hat Lightspeed MCP to Claude Code?
Set LIGHTSPEED_CLIENT_ID and LIGHTSPEED_CLIENT_SECRET and run claude mcp add red-hat-lightspeed-mcp -- podman run --env LIGHTSPEED_CLIENT_ID=$LIGHTSPEED_CLIENT_ID --env LIGHTSPEED_CLIENT_SECRET=$LIGHTSPEED_CLIENT_SECRET --interactive --rm ghcr.io/redhatinsights/red-hat-lightspeed-mcp:latest.
What does "formerly Insights MCP" mean?
The project was renamed: the former Insights services are now called Red Hat Lightspeed. The repository still lives in the RedHatInsights organization as insights-mcp.
Can the agent change system configuration?
Not by default, since the server is read-only. The --all-tools flag turns write tools on, and the role model still applies: what the service account's roles do not cover, the server will not do.
Which roles does vulnerability data need?
Vulnerability viewer and Inventory Hosts viewer. Advisor needs RHEL Advisor viewer and Inventory Hosts viewer, and Remediations needs the Remediations user role.
How do I run it over the network instead of locally?
With podman run ... http --host 0.0.0.0 on port 8000 or sse on port 9000. The authors ask you not to expose such a container to the internet.
Discussion
No questions or reviews yet.
Related
MCP serversAn MCP server for Linux diagnostics: an AI client reads services, logs and network on local and remote hosts, read-only
A Proxmox VE MCP server with 341 tools: virtual machines, containers, storage, cluster and backups, with a read-only mode.
MCP SSH Agent is an MCP server that reads hosts from ~/.ssh/config, runs commands and copies files through system ssh and scp.
MCP Slim Guard sits between an agent and your MCP servers: it validates calls against schemas and returns big results in parts.
A Node.js manager for MCP servers: it starts local servers, connects remote ones and gives a client one address, with a REST API for control
MCP server for Proxmox VE: manage VMs, LXC, snapshots and backups from an agent with permission control and command approval
Comparison with similar tools
Cards that share the main search query, and how they differ.
| Tool | Official | Authentication | Repository stars | Main difference |
|---|---|---|---|---|
| Red Hat Lightspeed MCP: server for RHEL fleets (this card) | yes | API key | 25 | |
| Podman MCP Server: Podman and Docker containers | no | not required | 86 | manages Podman containers and images on a machine, whereas Lightspeed MCP reads the Red Hat cloud console for systems and vulnerabilities |
| Kubernetes MCP Server | no | not required | 2,244 | works with clusters through the Kubernetes API, while this server covers Red Hat Lightspeed services and RHEL fleets |
README in short
The README lists supported services, two ways to authenticate (service account and JWT), roles per toolset and the emergency revocation steps. Instructions follow for Goose, Cursor, VS Code, Claude Code, Cline and other clients. The license is Apache 2.0.