MCP Server

Spectralite can run a small server on your own machine that an AI client connects to and uses to write effects. You describe the look you want to the client, the client sends Spectralite a description of the graph, and Spectralite compiles it into a real node graph that appears in your project like any other effect. The server speaks the Model Context Protocol (MCP), so any client that supports MCP can drive it.

The server is off until you switch it on, and it accepts connections only from your own computer.

Turn it on

Open Edit > MCP Server and tick Enable MCP server (AI effect authoring). The dialog then shows what a client needs: a Server URL (http://127.0.0.1:4560) and an Auth token, each with a Copy button.

Paste both into your client's MCP configuration. The token goes in the Authorization header as a bearer token; a request without it is refused, so nothing can reach your project by knowing the URL alone.

Spectralite always asks for port 4560. If another program already holds it, enabling fails with Port 4560 is already in use. Close whatever is using it and try again. Close the other program, then tick the box again.

It comes back on its own

Both the token and the fact that you enabled it are saved to mcp-server.json in Spectralite's application data directory, so the server starts itself the next time you launch Spectralite and your client keeps working with the token you already gave it. Untick the box to stop that; the server goes down at once and stays down. See File formats for the file and how it is protected.

Two messages tell you when that promise could not be kept. This token could not be written to disk, so a different one will be in use the next time Spectralite starts means the settings file was not writable, so your client's configuration will stop matching after a restart. If the server could not come back at launch, the checkbox is unticked and the reason is printed in red just below it.

See who is connected

While a client is attached, a plug chip appears at the right of the top bar, next to the workspace tabs, naming the client. Click it for the same list the dialog shows: each client's name and version, how long it has been connected, and a Disconnect button. The chip is absent whenever nothing is attached.

Names come from the client's own handshake, so treat them as labels rather than proof of identity. A client that has attached but not yet said who it is shows as Unidentified client.

Disconnect revokes that session immediately: its next call is refused with a message saying you disconnected it. It does not revoke the token, so the same client can open a fresh session with it. To lock a client out for good, regenerate the token or untick the checkbox. A session that goes quiet for two minutes drops out of the list on its own.

Regenerate the token

Regenerate asks first, with Replace and Cancel, because replacing the token is not free: the old one stops working the instant you confirm, and every client configured with it is refused until you paste the new one into its configuration. Use it if the token has been shared somewhere it should not have been.

What a connected client can reach

A connected client can read, create, change, and delete every effect in the open project, which is what the warning beside the client list is telling you. It cannot touch your fixture patch, your mappings, your outputs, or the timeline, and a delete is refused while any layer or bump still uses the effect.

It also reads the whole node catalog, and it can render an effect against fixed test rigs of its own and measure what comes out, so it can check its work before handing the effect to you. It carries three ready-made starting points a client can offer you by name: a Bump envelope, a Loop field that scrolls along one fixture axis, and a Movement pan and tilt pair. Effects reach Spectralite in the compact effect format, a text form of a node graph that exists only on this interface.

Two things guard the server. It binds 127.0.0.1 only, so it is never reachable from your network, and it refuses any request that does not address it as a loopback host, the standard guard against a web page using your browser as a way in. The bearer token is the actual authentication, and it is compared in constant time.