Skip to main content
LightShip sits in front of your existing OpenTelemetry trace data and applies each caller’s access rules before returning a trace. Humans and coding agents can investigate through MCP, REST, or the web UI without receiving direct database credentials.

Quickstart

Run LightShip with Docker Compose and sign in as the bootstrap admin.

Architecture

How LightShip stands between agents, the UI, and your ClickHouse.

Policies

Role policies over span attributes, service names, and map keys.

API Reference

Every REST endpoint, grouped by resource.

​
What LightShip gives you

  • Access-controlled traces. A trace is the authorization unit: a matching span makes the complete trace visible. Missing configuration, no applicable policy, or an unreachable source fails closed.
  • Conversational investigation. LightShip MCP lets agents inspect the filter schema, find trace summaries, and pull individual traces.
  • Bulk offline analysis. The local MCP companion pages authorized rows into workspace JSONL for jq, DuckDB, or scripts instead of loading them into model context.
  • Separate setup. The administrator-only Setup MCP and Setup UI use the same validated operations without putting configuration tools in everyday analysis conversations.
  • Auditable by default. Authentication, queries, and configuration changes are recorded with in-process retention.

​
Product surfaces

MCP

Context-bounded trace investigation, local exports, and a separate administrator Setup connection.

Web UI

Visual trace browsing, key management, setup, and audit review.

Setup

Connect trace data, define roles, and manage users.

​
Security boundary

LightShip protects only queries sent through LightShip. Anyone with direct ClickHouse credentials, or another UI that uses them, bypasses these policies. Do not give policy-restricted users direct ClickHouse access. See Deployment and security for production guidance.