AAA
Full lab authentication set
ASCII LOGIN, PAP, CHAP, MS-CHAP v1/v2, ENABLE, ASCII CHPASS. Service and command authorization with default deny. RFC 8907 accounting flag table. Bounded event ring.
go-lab-tacacs-mcp · taclabd · 1.0 lab appliance
Drive TACACS+
from an agent.
One Go process speaks legacy TACACS+ and TLS 1.3 TACACS+, then exposes the same administrative operations through REST, MCP Streamable HTTP, and an embedded UI. Lab-grade. Protocol-correct. Memory overlay that forgets on restart.
:49Legacy TACACS+ · RFC 8907
:300Secure TACACS+ · RFC 9887 TLS 1.3
:8080UI · REST /api/v1 · POST /mcp
What ships in 1.0
Claims match the conformance gate. Device-family completeness is not claimed. This is not a production AAA cluster. ASCII/PAP are lab compatibility, not a recommended production method.
Transport
Dual listeners, no fallback
Legacy obfuscation and TLS 1.3 mTLS on distinct ports. No upgrade path. CRL + resume re-check. Ticket lifetime 0 or 168h. Co-located topology is a documented lab convenience.
Parity
One registry, two adapters
REST and MCP call the same operations. Same scopes, revisions, redaction, and errors. CI fails if a PARITY_REQUIRED binding is missing.
MCP 2026-07-28
Official Go SDK
Streamable HTTP on POST /mcp. Lab static bearer — no OAuth PRM. URI-only subscriptions/listen. Works locally and behind a hosted reverse proxy.
Signal path
Devices hit TACACS. Operators and agents hit HTTP. Everything converges on one overlay and one policy engine.
Two ways to attach an agent
Local
Same host as taclabd
http://127.0.0.1:8080/mcp plus a file-referenced bearer. Claude, Cursor, VS Code, or curl. Local setup →
Remote
Hosted lab, HTTPS in front
https://host/mcp. Terminate TLS, keep MCP headers, raise proxy timeouts for listen. Ports 49/300 stay on the lab VLAN. Remote setup →
Documentation
Every contract also lives in the repository README. These are the doors most people use.
| Page | Use it for |
|---|---|
| Quick start (this site) | Four commands to a live appliance |
| docs/QUICKSTART.md | Canonical clone → labgen → Compose write-up |
| Users & groups (this site) | YAML users, groups, clients, secret files |
| docs/BASELINE.md | First-setup of every configurable object |
| MCP local & remote (this site) | Client JSON, hosted TLS, wire contract |
| docs/MCP.md | Full MCP contract, curl, Caddy/nginx, agent card |
| AGENTS.md | Mandatory agent rules and §1.1 setup |
| Canonical design | Execution source of truth |
| Operator guide | Secrets, onboard devices, reload |
| API parity | REST/MCP contract |
| API catalog | Tools, resources, and exact scopes |