MCP Integration Lab v0.4.0 — laboratory
Integration laboratory · not a production identity system

One gateway.
Every lab protocol.

MCP Integration Lab stands up DNS, LDAP, TACACS+, RADIUS, mail, NFS, HTTP intercept, NTP, and SSO behind a single MCP endpoint. Configuration is YAML and lives in a profile. Runtime state is ephemeral and a restart wipes it.

Get a lab running View the source
MCP client · enterprise default :8080/mcp 
{
  "mcpServers": {
    "integration-lab": {
      "url": "http://<lab-host>:8080/mcp",
      "headers": {
        "Authorization": "Bearer <secrets/mcp-client-token>"
      }
    }
  }
}
OrchestratorGo 1.26
GatewayMCPJungle 0.4.6
Composev2.24.4+
RuntimeEphemeral
Topology

Agents talk to one URL. Testers talk to the wire.

Three compose projects meet on mcplab-shared (one /24). Gateway registration is tmpfs. Profiles are the source of truth. Published numbers below are today's default profile: 10053, 3389/3636, 1025, and 20490 are residual (policy is IANA dests 53, 389/636, 25, 2049, HTTPS 443 for LabSSO). TacLab is already native. LabSSO is dest-443. LabMITM is a forward proxy, not dest 443.

ClientsMCP agents
streamable HTTP
GatewayMCPJungle :8080
data plane
TestersReal protocols
DNS 10053 residual LDAP 3389 / 3636 residual TACACS+ 49 / 300 RADIUS 1812 / 1813 SMTP 1025 residual NFS 20490 residual HTTP proxy 18888 NTP 10123 HTTPS 443
compose · mcplab
  • LabDNS — 10053 residual / 18080
  • labinfo — 18090
  • labgraph — 18091
  • LabMail — 1025 residual / 1080
  • LabMITM — 18888 / 18088
  • LabNTP — 10123 / 18123
  • LabSSO — 443 / 18443
  • ratarmount-rs — 20490 residual
  • MCPJungle — 8080 (0.4.6)
compose · labldap
  • labldapd — 3389 / 3636 residual
  • control plane — 8443
  • native engine, lab CA
  • pinned v0.7.0
compose · labtacacs
  • taclabd — 49 / 300
  • RADIUS — 1812 / 1813
  • control — 18049
  • pinned v1.6.0
The stack

Eleven services. One profile. One client URL.

Each appliance is a real protocol on the wire. Agents talk to the gateway. Testers talk to the data planes.

LabDNS

v1.4.1

Authoritative lab DNS with overrides, wildcards, suffix forwarding, bounded chaos, and an embedded operator console. YAML desired state; REST, MCP, and UI on the management plane.

10053 residual · 18080go-lab-dns

LabLDAP

v0.7.0

Native Go directory (labldapd) plus a control plane. Real LDAP/LDAPS on the wire, REST, MCP, and a browser UI.

3389 / 3636 residual · 8443go-lab-ldap-mcp

TacLab

v1.6.0

TACACS+ (legacy + TLS 1.3) and RADIUS lab appliance. REST, MCP, and an embedded operator UI.

49 / 300 · 1812 / 1813go-lab-tacacs-mcp

LabMail

v1.0.0-rc.4

Receive-only SMTP sink with an inbox UI, maildev /email compat, native /v1, and MCP. Compose service name stays maildev.

1025 residual · 1080go-lab-maildev

LabMITM

v1.7.2

Laboratory HTTP(S) intercepting forward proxy with a flow-inspector UI, native /v1, and MCP. Data plane is unauthenticated; HTTPS intercept is :443 only.

18888 · 18088go-lab-mitmproxy

LabNTP

v1.0.0-rc.3

Laboratory NTPv3/v4 unicast with per-IP virtual clocks, an operator console, native /v1, and MCP. Host UDP default is 10123 (ADR 0014); privileged 123 is opt-in. SPA Origins are deny-all.

10123 · 18123go-lab-ntp

LabSSO

v1.0.0-rc.4

Laboratory OIDC/OAuth2 and SAML IdP with vendor clothes, an operator console, native /v1, and MCP. Host HTTPS is dest-443; management is 18443. Catalog issuer URLs omit :443.

443 · 18443go-lab-sso

ratarmount-rs

v0.1.34

Archive-backed userspace NFSv3 export with a write overlay. Empty-root .tar.zst; commits every 15m. NFSv4.1 is in the package; this lab stays on v3.

20490 residualratarmount-rs

labinfo

First-party service directory. Agents ask endpoints_list for web/REST URLs and connections_list for protocol client config before they spelunk.

18090mcp-integration-lab

labgraph

First-party LabScenario orchestrator. Applies profile YAML across appliances via native plan/apply/reset. Named fixture packs at labgraph://fixtures/{id} and fixture.apply. REST, MCP, and an operator console. Empty default scenario is a no-op.

18091mcp-integration-lab

MCPJungle

0.4.6

Single streamable-HTTP MCP gateway with tool groups and optional enterprise ACLs. Operator dashboard is GET / in development mode only.

8080mcpjungle/MCPJungle
Ninety seconds

Clone. Make up. Point a client.

Docker Engine 24+ with Compose v2.24.4+, GNU make, and Go 1.26+. First run vendors the service repos and builds images.

  1. make up — clone vendors, mint secrets, build images, start, register.
  2. make reload APP=<app> — recreate one service after a YAML tweak; not a full redeploy.
  3. make smoke — agent-style end-to-end scenario through the gateway.
  4. http://<lab-host>:8080/mcp — attach an MCP client. Enterprise mode needs the minted bearer.
Full quick start Configure a profile 
git clone https://github.com/hilather/mcp-integration-lab.git
cd mcp-integration-lab
make up
make smoke

# url:  http://<lab-host>:8080/mcp
# Authorization: Bearer $(cat secrets/mcp-client-token)