lattice-mcp

# Lattice MCP Server Automates Lattice HR objectives (create, update, delete, list) via browser session replay. No API key required — authenticates through SSO and persists the session for headless Playwright reuse. ## Prerequisites - Python 3.10+ - Chrome/Chromium (for SSO login) - A display environment (local machine or X-forwarded) for initial login ## Installation ```bash pip install lattice-mcp playwright install chromium ``` ## Authentication The server uses a saved Playwright browser session (`~/.config/lattice/browser-state.json`). You must log in once via SSO to create it. ### Option A: Local machine with a display ```bash lattice ui login [--hostname <your-company>.latticehq.com] ``` If `--hostname` is omitted, it falls back to the `LATTICE_WEB_HOSTNAME` environment variable (see [Configuration](#configuration)). A Chromium window opens — complete your SSO login. The window closes automatically once authenticated and the session is saved. The session is reusable until it expires on Lattice's side (typically days to weeks). ### Option B: Headless server (attach to running Chrome) ```bash # On a machine with a display, start Chrome with remote debugging: google-chrome --remote-debugging-port=9223 --user-data-dir=/tmp/chrome-lattice --no-first-run & # Complete SSO in that browser, then capture the session: lattice ui login --cdp-url http://127.0.0.1:9223 ``` ### Option C: Silent headless re-login (after first login) ```bash lattice ui login --headless ``` Reuses the stored browser state: even if the Lattice session has expired, the saved IdP session cookies (e.g. Microsoft Entra) usually allow the SSO to complete silently — no window, no password, no MFA. Works until the IdP's own session expires (often weeks), then fall back to Option A/B. Whether the silent hop is permitted depends on your IdP tenant's conditional-access policies. ### Session expiry If tools return "Session expired", re-run `lattice ui login` — or let the agent call the …