Run isolated code and manage apps, databases and deployments on Lizard (lizard.build).
An MCP server that lets ChatGPT, Claude and other MCP clients deploy and manage apps on Lizard (lizard.build).
Connect it once, then ask your assistant to ship a service, read logs, set secrets, scale replicas or attach a domain — in plain words.
The server speaks Streamable HTTP at POST /mcp, and stdio for clients that
spawn a local process instead (below). A hosted instance
runs at:
https://employ-woman-g1q2.us-east-1.onlizard.com/mcp
Every request carries a bearer token. A client that speaks OAuth gets one
itself — the server advertises where, so there is nothing to paste. Clients
that only send headers use a liz_ API key instead:
lizard keys create my-mcp-key
The dashboard creates the same thing under Sandboxes → Get started → New API key. Either way the key is shown once.
claude mcp add --transport http lizard https://employ-woman-g1q2.us-east-1.onlizard.com/mcp
Claude Code runs the OAuth flow on first use. To skip it and use a key:
claude mcp add --transport http lizard https://employ-woman-g1q2.us-east-1.onlizard.com/mcp \
--header "Authorization: Bearer liz_your_key"
{
"mcpServers": {
"lizard": {
"url": "https://employ-woman-g1q2.us-east-1.onlizard.com/mcp",
"headers": { "Authorization": "Bearer liz_your_key" }
}
}
}
ChatGPT connects to a URL and runs OAuth itself — no key to paste. It needs developer mode and a registered connection; see Publishing to Codex / ChatGPT below.
Run it as described in the next section, then use http://localhost:3000/mcp
in place of the hosted URL.
curl -sS -X POST https://employ-woman-g1q2.us-east-1.onlizard.com/mcp \
-H "Authorization: Bearer liz_your_key" \
-H "Content-Type: application/json" \
-H "Accept: application/json, text/event-stream" \
-d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}'
Without a token the same call returns 401 and a WWW-Authenticate header
pointing at the OAuth metadata. That is the server working, not failing.
npm install
npm run build
npm start
For development with reload:
npm run dev
npm start serves HTTP. To have a client spawn the server instead, point it at
dist/stdio.js:
{
"mcpServers": {
"lizard": {
"command": "node",
"args": ["/path/to/lizard-mcp/dist/stdio.js"],
"env": { "LIZARD_TOKEN": "liz_your_key" }
}
}
}
A spawned process has no browser to run OAuth in, so the token comes from the environment and binds the process to one user. Without it the server still starts and lists its tools — calling one then returns a message asking for a key.
| Variable | Default | What it does |
|---|---|---|
PORT | 3000 | Port to listen on (HTTP only) |
PUBLIC_URL | http://localhost:$PORT | The URL clients reach this server on. Sets the OAuth resource identifier, so it must match the real address in production. |
PLATFORM_URL | https://lizard.build | The Lizard API this server talks to |
LIZARD_TOKEN | — | API key for stdio mode, where there is no OAuth handshake. LIZARD_API_KEY works too. |
| Area | Tools |
|---|---|
| Account | whoami, workspace_list, project_list, project_create, project_pause, project_resume, workspace_pause, workspace_resume, region_list, billing_status, billing_summary |
| Services | service_list, service_show, service_create, service_set, service_rename, service_delete, service_pause, service_resume, service_sleep_status, service_sleep_set, service_scale, service_get_port, service_set_port, addon_create |
| Deploys | deploy_redeploy, deploy_restart, deploy_events |
| Logs and metrics | logs_tail, metrics_get |
| Secrets | secrets_list, secrets_set, secrets_delete, secrets_refs |
| Domains | domain_attach, domain_verify, domain_delete |
| Volumes | volume_list, volume_resize |
| Git | git_connect, git_checkout, git_status |
| Shell | ssh_exec |
| Sandboxes | sandbox_list, sandbox_show, sandbox_create, sandbox_exec, sandbox_read_file, sandbox_write_file, sandbox_delete |
| Config as code | config_apply |
Tool names use snake_case (not the MCP spec's permitted dots) to match OpenAI's function-name pattern ^[a-zA-Z0-9_-]{1,64}$, which some ChatGPT/Codex surfaces enforce directly.
Destructive tools — service_delete, secrets_delete, domain_delete, ssh_exec — require an explicit confirmation argument, so a client cannot delete anything or run arbitrary commands by accident.
billing_status is read-only: it shows the plan (Pro at $19/month with $19 in credits each month, the trial, prepaid credits until November 1, 2026, or enterprise) and the Billing link. Starting, paying for and cancelling Pro happen in the browser. When the account has to pay before it can create something, the tool error gives the platform's sentence with the page to open on its last line, and structuredContent.error carries the code (PAYMENT_REQUIRED), paymentStatus and the links.
Lizard (lizard.build) provides Lizard Sandboxes for short-lived code execution. These resources are separate from app services. Start with project_list, then call sandbox_create with the chosen project and confirm: true. Keep the returned sandboxId for later calls.
{"name":"sandbox_create","arguments":{"project":"YOUR_PROJECT_ID","lifetimeMs":300000,"confirm":true}}
Use sandbox_write_file to write a script, sandbox_exec to run it, and sandbox_read_file to read its results. Finish with sandbox_delete. Create, execute, write, and delete need the user's approval before the client sets confirm: true. The MCP server does not open a confirmation dialog.
Sandboxes use the interpreter template, size small, with /workspace as the default path. They expire after five minutes by default; lifetimeMs accepts 60,000–3,600,000 milliseconds. Expiry or deletion loses all files. Creation uses billed cloud resources. Host files, environment variables, and access tokens stay out of the sandbox.
Commands run as root within the sandbox, default to a 60-second timeout, and accept up to 120 seconds. Cancellation, timeout, or an uncertain command request destroys the whole sandbox to stop remote work. The confirm field covers this loss of files. Use a sandbox created for the task; keep needed files elsewhere first. A normal nonzero exit code preserves the sandbox. Access or input rejection does not delete it. The server never retries commands automatically.
Text reads and writes accept up to 64 KiB of UTF-8. Each output stream is capped at 64 KiB and includes a truncation flag. All paths refer to the sandbox. sandbox_show and sandbox_list help check an uncertain result before retrying. sandbox_delete treats a sandbox that is already gone as a successful no-op.
The HTTP server handles each call with its caller's Bearer token, including OAuth tokens and API keys. It keeps no shared sandbox handles or global SDK credentials. A disconnected client must reconnect to delete its sandbox; its finite lifetime remains the cleanup backstop.
The server speaks OAuth 2.1 as an MCP protected resource (RFC 9728). It holds no secrets of its own: every request carries a bearer token, and Lizard decides whether that token is valid. Both OAuth-issued tokens and liz_ API keys work.
Each request builds a fresh server bound to the caller's token, so one process serves many users without sharing state.
Over stdio there is no OAuth and no per-request token — the key comes from the environment and the process serves one user, as described above.
npm test # unit and MCP transport tests
npm run typecheck
npm run build
To test real sandbox resources, set LIZARD_API_KEY, LIZARD_PROJECT_ID, and LIZARD_LIVE_TESTS=1, then run npm exec -- vitest run test/live/sandboxes.test.ts. The test uses stdio MCP to create a sandbox, run shell and file tools, check timeout cleanup, and delete it. It uses billed resources; it does not deploy the MCP server.
test/manual/mcp-inspector.md covers end-to-end checks against a stub platform and a live one.
This server itself runs as a Lizard app: lizard-mcp in mikelun's workspace,
deployed straight from this repo (git-source, auto-redeploys on push to main).
https://employ-woman-g1q2.us-east-1.onlizard.com/mcp
PUBLIC_URL is set on that service to match, so allowedHosts/OAuth resource
metadata line up with the real domain — see src/index.ts.
.codex-plugin/plugin.json is in place. This is a hosted remote MCP server (not
a bundled stdio one), so it's wired via .app.json + a registered connection,
not .mcp.json. That last step needs a human in a real ChatGPT session — it
isn't scriptable:
plugin_asdk_app_... ID from the browser URL..app.json at the repo root:
{ "app": { "id": "plugin_asdk_app_..." } }
"apps": "./.app.json" to .codex-plugin/plugin.json.@plugin-creator, or hand-write
~/.agents/plugins/marketplace.json), then submit through the
plugin submission portal
for public review.MIT
This listing does not have a supported local package template. Use the maintainer’s documentation for its hosted endpoint, authentication, and client-specific setup. No install command has been inferred.