@ao-mcp/local

The on-machine MCP bridge for Automated Operations. It runs as a local stdio MCP server and proxies to the hosted AO MCP endpoint, handling browser sign-in and session/auth for you.

The bridge is a native Go binary. npm is one distribution option, not a runtime dependency. To install it without Node or npm:

# macOS / Linux
curl -fsSL https://mcp.automatedoperations.com/install.sh | sh

# Windows PowerShell
irm https://mcp.automatedoperations.com/install.ps1 | iex

Both installers resolve the signed platform package from the public registry, verify its SHA-512 integrity, and install ao-mcp-local into a user-owned bin directory. Set AO_MCP_INSTALL_DIR during installation to choose a different location. Native installations then check for, verify, and activate AO releases automatically; the next natural MCP process start uses the new binary. There is no consumer update setting or maintenance command.

Entitled organizations may pin managed native deployments through their AO organization policy. The agent accepts only the effective authenticated policy returned by AO Cloud; local users and machine administrators cannot create a pin. AO does not expose version selection to consumer installs.

Offline behavior

The local agent does not cache infrastructure state. When AO Cloud or the network is unavailable, operational tool calls return a retryable ao_unavailable result that explicitly states no cached operational data was returned. Versioned schemas, help, and runbook resources may be cached in future releases; live reads and writes never silently fall back to stale answers.

# one-time sign-in (opens your browser)
npx @ao-mcp/local login

# most users never run it directly — `npx @ao-mcp/setup` wires it into your
# MCP client (Claude Desktop, Cursor, VS Code, …), which spawns it for you

Commands

ao-mcp-local             run the stdio MCP bridge (default; MCP clients spawn this)
ao-mcp-local login       sign in via your browser and store a session token
ao-mcp-local logout      clear the stored token
ao-mcp-local version     print version

Your session token is stored in the OS keychain (macOS Keychain, Windows Credential Manager, Linux Secret Service) when available, else a permission-restricted file. Set AO_TOKEN to supply a token directly (headless / CI, without refresh or account switching). Hermetic test runners can set AO_TOKEN_FILE to an absolute token.json path; its sibling profiles.json retains the normal refreshable multi-account behavior.

How it's packaged

The binary ships as per-platform optional dependencies (@ao-mcp/local-<platform>-<arch>). npm installs only the one matching your machine; this launcher (bin/cli.js) resolves it and execs it, passing your MCP client's stdio straight through. No postinstall download, no external host — npm carries the bytes. macOS binaries are Developer ID signed and notarized; Windows binaries are Authenticode signed.

| Platform | Package | |---|---| | macOS arm64 / x64 | @ao-mcp/local-darwin-arm64 · @ao-mcp/local-darwin-x64 | | Linux arm64 / x64 | @ao-mcp/local-linux-arm64 · @ao-mcp/local-linux-x64 | | Windows arm64 / x64 | @ao-mcp/local-win32-arm64 · @ao-mcp/local-win32-x64 |

Support

Questions, issues, feedback — we'd love to hear from you: [email protected] · https://automatedoperations.com