Lander Configuration

This page is the reference for how the Lander agent is configured and what it stores on disk. The one bootstrap setting is the control-plane URL, usually injected by MDM; device ownership is not configured here — it comes from whoever authenticates when Lander prompts them (see Credentials). Everything else — which MCPs are installed and proxied, their tool policy, and their logging/redaction settings — is managed from the AlienGiraffe Connector and persisted here by Lander; you don’t hand-edit this file. For the handful of commands you do run, see the Lander CLI.

Environment variables

Environment variables take precedence over values persisted in ~/.lander.json, which take precedence over defaults. In a fleet, MDM injects these (see the Intune, Jamf, and Kandji guides).

Variable	Purpose	Default
LANDER_ENV_MANAGER_URL	Control-plane base URL for registration, inventory, and events	http://localhost:8080 (dev placeholder)
LANDER_OWNER_EMAIL	Deprecated — no longer determines ownership; see below	(empty)
LANDER_PORT	HTTP daemon port (HTTP-stream mirroring)	8082

LANDER_ENV_MANAGER_URL and LANDER_OWNER_EMAIL are persisted into ~/.lander.json on first run; LANDER_PORT is a flag/env value only.

LANDER_OWNER_EMAIL is deprecated

LANDER_OWNER_EMAIL, the --owner-email flag, and the OwnerEmail managed preference no longer determine who owns a device. The control plane derives ownership from the authenticated user’s identity instead, so an endpoint can no longer claim a device on someone else’s behalf by asserting their address. The setting is still accepted for one release — the value remains part of the canonical signed payload — and logs a warning when set. It will be removed.

~/.lander.json

The unified config and state file. Written atomically and validated on load.

{
  "mcpServers": {
    "github": {
      "command": "npx",
      "args": ["-y", "@modelcontextprotocol/server-github"],
      "env": { "GITHUB_TOKEN": "..." },
      "type": "stdio",
      "installedIn": ["claude-desktop", "claude-code"],
      "availableTools": [
        { "name": "list_issues", "description": "...", "enabled": true },
        { "name": "delete_repo", "description": "...", "enabled": false }
      ],
      "proxied": true,
      "originalConfig": { "command": "npx", "args": ["..."] },
      "logging": {
        "enabled": true,
        "level": "info",
        "access": true,
        "query": true,
        "maxBytes": 10485760,
        "maxFiles": 5
      }
    }
  },
  "proxiedMCPs": ["github"],
  "logging": { "enabled": true, "level": "info", "access": true, "query": true, "maxBytes": 10485760, "maxFiles": 5 },
  "envManagerUrl": "https://control-plane.example.com/v1",
  "ownerEmail": "dev@example.com"
}

Top-level fields

Field	Description
mcpServers	Map of MCP name → its configuration and state (see below)
proxiedMCPs	Names of MCPs currently mirrored
logging	Global default logging config (per-MCP overrides win)
envManagerUrl	Persisted control-plane URL
ownerEmail	Persisted owner email — deprecated, retained for the signed payload; ownership comes from the authenticated user

Per-MCP fields (mcpServers.<name>)

Field	Description
command / args / env	How the real MCP server is launched (kept locally; never reported to the control plane)
type	Transport: stdio or http
installedIn	Which agents have this MCP configured
availableTools	Tools, each with an enabled flag for tool-level control
proxied	Whether mirroring is currently on
originalConfig	Backup of the pre-install configuration, used to restore the agent losslessly when the Connector revokes the MCP
logging	Per-MCP logging override

Logging block

Key	Default	Effect
enabled	true	Master switch for this scope
level	info	debug / info / warn / error
access	true	Write metadata logs (access.log)
query	true	Write full-payload logs (query.log); set false to redact
maxBytes	10485760	Rotation size per file (10 MiB)
maxFiles	5	Rotated files retained per MCP

On-disk state

Path	Mode	Purpose
~/.lander.json	0644	Unified config and state (above)
~/.lander/certs/device.key	0600	ECDSA P-256 private key
~/.lander/certs/device.crt	0644	Self-signed device certificate
~/.lander/credentials.json	0600	Signed-in user’s Connector tokens (see Credentials)
~/.lander/device.json	0600	Registration state: serial, brand, model, deviceId, fingerprint, owner, last register/inventory timestamps
~/.lander/logs/service.{out,err}	—	Daemon stdout/stderr
~/.lander/logs/<mcp-name>/access.log	—	Per-MCP metadata audit (rotated)
~/.lander/logs/<mcp-name>/query.log	—	Per-MCP full-payload audit (rotated)
~/Library/LaunchAgents/com.aliengiraffe.lander.plist	—	launchd service definition

Credentials

~/.lander/credentials.json holds the tokens for the user who authenticated — which Lander prompts for on its own (see Authentication). It is what lets the control plane attribute the device — and the events it reports — to a real person.

• Written at mode 0600, and refused if its permissions have loosened rather than silently trusted. If you see Lander reject the file, fix the mode or sign in again; it will not fall back to running unauthenticated.
• Keyed by control-plane URL, so pointing Lander at a different Connector does not reuse the wrong credential.
• Refreshed automatically five minutes ahead of expiry. A revoked or rejected refresh token clears the file, and Lander prompts the user to authenticate again.
• Kept separate from ~/.lander/device.json (device identity, not secrets) and from ~/.lander.json (managed config).

Deleting the file signs the host out locally but leaves the token valid until it expires; lander auth logout revokes it control-plane-side.

Agent config files read

Lander discovers MCPs by reading each agent’s own configuration. See Supported Agents for the full list and paths.