The certificate path is the right one — mutual TLS with keys you copied yourself, rather than an API key in a config file — and shipping as a single Rust binary means nothing else has to be installed next to your node. Read the roadmap before you plan around it, though: deriving parameters for RPC calls and curating which RPCs are worth exposing are both listed as future work, which tells you where the rough edges are today.
A Rust binary that speaks MCP on one side and Core Lightning's gRPC interface on the other. Core Lightning exposes its node control over gRPC with mutual TLS; this puts that behind an MCP connection so an assistant can drive the node.
- Access to a Core Lightning node's RPC surface through a standard MCP client, with no separate wrapper per call
- A single compiled binary — no runtime to install alongside it, and prebuilt releases per platform as well as a source build
- Node targeting on the command line, so one binary can point at whichever node you name — the address defaults to the local gRPC port
- Mutual-TLS authentication using the certificates Core Lightning generates for you, pointed at with a certificates directory argument
A running Core Lightning node with gRPC enabled — adding the gRPC port option to CLN generates the mTLS certificates automatically, and you copy the CA certificate, the client certificate and the client key into a directory of their own. That directory is passed with `--certs-dir`, and `--node-address` selects the node, defaulting to the local gRPC address. Either download the release binary for your platform and make it executable, or build from source, which needs Rust 1.80 or higher and the Protocol Buffers compiler at version 3.0.0 or higher. The client entry points at the binary with the certificates argument.