CLI
l4 mcp serve
Serve the hosted LevelFour MCP server over stdin and stdout, for clients that only start local processes.
l4 mcp serve speaks MCP over stdin and stdout and relays every request to the hosted server at https://mcp.levelfour.ai/mcp, with the credential already in your keychain.
l4 mcp serve [flags]You rarely run this yourself. l4 mcp install points Claude Desktop at it, because claude_desktop_config.json starts stdio servers and cannot send an Authorization header to a remote one. Run by hand it waits for a client that will never speak.
Flags
| Flag | Description |
|---|---|
--endpoint | MCP endpoint to relay. Defaults to the hosted server |
Global flags (--token, --api) apply. See CLI overview.
What it serves
The same tools the hosted server offers your key, under the same names and schemas, plus its prompts and resources. An agent that learned to route against the hosted server gets the same answers here. The binary carries no copy of the tools, so a tool the hosted server adds appears here without upgrading l4.
l4 auth login mints a read key, which gets the read tools. A read-write key also gets the tools that write. To accept or reject from the terminal instead, use l4 rec accept and l4 rec reject.
It needs network access to the hosted server and MCP access enabled for your organization.
Why your key stays put
l4 mcp install writes no key into the client's configuration file. The server sends the credential l4 already resolves to the hosted server and nowhere else: it refuses a redirect to another host, or to plain HTTP, rather than carry the key along. This is the one client path that keeps the key out of every config file.
Output
The protocol occupies stdout, so every notice goes to stderr, which your client captures into its own log. Claude Desktop writes mcp-server-levelfour.log. The server prints two lines at startup:
levelfour mcp 0.2.0 serving 36 tools, 5 prompts, 4 resources over stdio
relaying https://mcp.levelfour.ai/mcp with the stored credentialErrors
The server checks the hosted server before it starts serving, and gives up after 15 seconds without an answer. If that check fails, it exits with the reason on stderr, so the client logs a cause instead of showing a server with no tools.
| Exit | Symptom | Cause |
|---|---|---|
4 | Authentication required | No token resolvable; run l4 auth login or set LEVELFOUR_TOKEN |
4 | Refused this credential, and so did the LevelFour API | The key was revoked or has expired; run l4 auth login |
1 | Refused this credential, although the LevelFour API accepts it | MCP access is not enabled for your organization; contact LevelFour |
1 | Connecting to the LevelFour MCP server | No network path to the endpoint |
Once it is serving, a tool call that cannot reach a tool returns an error result naming it, so the agent can tell you why the answer is missing. If someone revokes the key while the client is open, the next call fails with that cause, and l4 mcp status says whether the key or your organization's MCP access is the reason.
A client disconnecting is a normal ending and exits 0. Returning an error there would make every ordinary exit non-zero, which clients log as a crashed server. Every other code follows the standard CLI exit conventions.
Related
l4 mcp install: points Claude Desktop at this commandl4 mcp status: check what the hosted server offers the credential this would use- Tools: every tool the hosted server registers