> ## Documentation Index
> Fetch the complete documentation index at: https://lightship.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# LightShip

> Give humans and coding agents policy-controlled access to OpenTelemetry traces.

LightShip sits in front of your existing OpenTelemetry trace data and applies each caller's access
rules before returning a trace. Humans and coding agents can investigate through MCP, REST, or the
web UI without receiving direct database credentials.

<CardGroup cols={2}>
  <Card title="Quickstart" icon="rocket" href="/quickstart">
    Run LightShip with Docker Compose and sign in as the bootstrap admin.
  </Card>

  <Card title="Architecture" icon="layers" href="/concepts/architecture">
    How LightShip stands between agents, the UI, and your ClickHouse.
  </Card>

  <Card title="Policies" icon="lightbulb" href="/concepts/policies">
    Role policies over span attributes, service names, and map keys.
  </Card>

  <Card title="API Reference" icon="code" href="/api-reference/introduction">
    Every REST endpoint, grouped by resource.
  </Card>
</CardGroup>

## What LightShip gives you

* **Access-controlled traces.** A trace is the authorization unit: a matching span makes the complete trace visible. Missing configuration, no applicable policy, or an unreachable source fails closed.
* **Conversational investigation.** LightShip MCP lets agents inspect the filter schema, find trace summaries, and pull individual traces.
* **Bulk offline analysis.** The local MCP companion pages authorized rows into workspace JSONL for `jq`, DuckDB, or scripts instead of loading them into model context.
* **Separate setup.** The administrator-only Setup MCP and Setup UI use the same validated operations without putting configuration tools in everyday analysis conversations.
* **Auditable by default.** Authentication, queries, and configuration changes are recorded with in-process retention.

## Product surfaces

<CardGroup cols={2}>
  <Card title="MCP" icon="chat" href="/use/mcp">
    Context-bounded trace investigation, local exports, and a separate administrator Setup connection.
  </Card>

  <Card title="Web UI" icon="globe" href="/use/web-ui">
    Visual trace browsing, key management, setup, and audit review.
  </Card>

  <Card title="Setup" icon="gear" href="/configure/discover-trace-source">
    Connect trace data, define roles, and manage users.
  </Card>
</CardGroup>

## Security boundary

LightShip protects only queries sent through LightShip. Anyone with direct ClickHouse credentials, or another UI that uses them, bypasses these policies. Do not give policy-restricted users direct ClickHouse access. See [Deployment and security](/operate/deployment) for production guidance.