Lab up in
four commands.

Clone and generate

git clone https://github.com/hilather/go-lab-tacacs-mcp.git
cd go-lab-tacacs-mcp
go run ./tools/labgen deployments/compose

Writes config/taclab.yaml, lab PKI, and secrets/api_admin_token. Nothing secret is committed. Force regenerate with -force.

Start the appliance

docker compose -f deployments/compose/compose.yaml up -d --build
curl -sf http://127.0.0.1:8080/health/ready && echo ready

Need TLS-only TACACS? Add -f deployments/compose/compose.tls-only.yaml. No privileged ports? Use compose.smoke.yaml.

Open the UI

Browse to http://127.0.0.1:8080 and paste the contents of deployments/compose/secrets/api_admin_token. The SPA exchanges it for an HttpOnly cookie. It never parks the raw token in localStorage.

REST and MCP

TOKEN=$(tr -d '\n' < deployments/compose/secrets/api_admin_token)

curl -sS http://127.0.0.1:8080/api/v1/status \
  -H "Authorization: Bearer ${TOKEN}"

curl -sS http://127.0.0.1:8080/mcp \
  -H "Authorization: Bearer ${TOKEN}" \
  -H "MCP-Protocol-Version: 2026-07-28" \
  -H "Mcp-Method: tools/list" \
  -H "Accept: application/json, text/event-stream" \
  -H "Content-Type: application/json" \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/list","params":{"_meta":{"io.modelcontextprotocol/protocolVersion":"2026-07-28","io.modelcontextprotocol/clientCapabilities":{}}}}'

Wire Claude, Cursor, or VS Code: MCP local & remote. There is no OAuth discovery document.