# Set up LyftData with an agent

Canonical HTML: https://docs.lyftdata.com/install/agent-setup/
Plain Markdown: https://docs.lyftdata.com/install/agent-setup.md

Use the HTML page or this Markdown document. Both are generated from the same Docs recipe source. WebMCP is optional; ordinary fetch and local human-approved actions remain the supported fallback.

## Copyable prompt

```text
Read https://docs.lyftdata.com/install/agent-setup/ first (plain Markdown: https://docs.lyftdata.com/install/agent-setup.md). My target is Linux x86_64; my bounded goal is to run one bounded local job after read-only discovery. Keep Product credentials, bootstrap URLs/tokens, passwords, activation material, and private keys out of this conversation. Work within the authorization already given. Pause for the EULA decision, authentication, a new write grant, or another action that needs fresh approval.
```

## Before you begin

This maintained recipe explicitly selects the published beta LyftData v3.0.0-beta.14 for Linux x86_64; choose this beta channel deliberately before following it. Its source and CLI/parser checks do not certify a complete installation or real-client journey. Other platforms and releases remain outside this guide. It is a local, loopback-only evaluation path; shared service, TLS, licensing, and production deployment belong to their owning guides.

You need a Linux x86_64 host, disk space for the archive and staging directory, Python 3, curl, tar with xz support, sha256sum, and a local terminal. Set TMPDIR to an existing writable directory when your environment requires a particular storage location; preparation creates its uniquely named child there. Preserve existing installations, profiles, and MCP registrations.

## 1. Select and verify the exact package

Use the matching beta Product archive lyftdata-x86_64-unknown-linux-gnu.tar.xz and Worker archive lyftdata-worker-x86_64-unknown-linux-gnu.tar.xz. Verify both SHA-256 values before extraction or execution. The Worker archive supplies lyftdata-worker-job; the extraction step places it beside Product, including for built-in Worker jobs. Starting the separate Worker daemon is optional. A download or checksum command is not proof of installation.

```bash
set -eu
RUN_ROOT="${TMPDIR:-/tmp}/lyftdata-agent-eval-$(date +%s)"; export RUN_ROOT
PROFILE="agent-onboarding-$(basename "$RUN_ROOT")"; export PROFILE
REGISTRATION="lyftdata-$PROFILE"; export REGISTRATION
python3 - <<'PY'
import os, secrets
root = os.environ["RUN_ROOT"]
os.mkdir(root, 0o700)
secrets_dir = os.path.join(root, "secrets")
os.mkdir(secrets_dir, 0o700)
for name in ("variables-master-key.hex", "credential-manager-master-key.hex"):
    path = os.path.join(secrets_dir, name)
    fd = os.open(path, os.O_WRONLY | os.O_CREAT | os.O_EXCL, 0o600)
    with os.fdopen(fd, "w") as output:
        output.write(secrets.token_hex(32) + "\n")
PY
curl -fL --proto '=https' --tlsv1.2 -o "$RUN_ROOT/lyftdata-x86_64-unknown-linux-gnu.tar.xz" https://beta-downloads.lyftdata.com/beta/v3.0.0-beta.14/lyftdata-x86_64-unknown-linux-gnu.tar.xz
curl -fL --proto '=https' --tlsv1.2 -o "$RUN_ROOT/lyftdata-worker-x86_64-unknown-linux-gnu.tar.xz" https://beta-downloads.lyftdata.com/beta/v3.0.0-beta.14/lyftdata-worker-x86_64-unknown-linux-gnu.tar.xz
printf '%s  %s\n' '3f25c81cc3ed8305efc888ff30fddc01e4bcc2e98357b73826d30ded2f73365a' "$RUN_ROOT/lyftdata-x86_64-unknown-linux-gnu.tar.xz" | sha256sum -c -
printf '%s  %s\n' 'd6f3aa2efbf0b83011caa8dae7b16a6a398c2dbdda9b7c2b844a85a6c93422f1' "$RUN_ROOT/lyftdata-worker-x86_64-unknown-linux-gnu.tar.xz" | sha256sum -c -
tar -xJf "$RUN_ROOT/lyftdata-x86_64-unknown-linux-gnu.tar.xz" -C "$RUN_ROOT" && tar -xJf "$RUN_ROOT/lyftdata-worker-x86_64-unknown-linux-gnu.tar.xz" -C "$RUN_ROOT" && install -m 0755 "$RUN_ROOT/lyftdata-worker-x86_64-unknown-linux-gnu/lyftdata-worker-job" "$RUN_ROOT/lyftdata-x86_64-unknown-linux-gnu/lyftdata-worker-job" && test -x "$RUN_ROOT/lyftdata-x86_64-unknown-linux-gnu/lyftdata" && test -x "$RUN_ROOT/lyftdata-x86_64-unknown-linux-gnu/lyftdata-worker-job"
"$RUN_ROOT/lyftdata-x86_64-unknown-linux-gnu/lyftdata" '--version'
```

## 2. Prepare protected local state and start Product

The preparation command creates a fresh run-owned root with mode 0700 and two exclusive mode-0600 key files: $RUN_ROOT/secrets/variables-master-key.hex and $RUN_ROOT/secrets/credential-manager-master-key.hex. Each contains one 32-byte hexadecimal value. It fails if the selected root already exists, so it cannot overwrite an installation. Keep both key values out of prompts, command lines, shell history, and logs.

For the first start, run the command below in an owned interactive terminal with a real TTY/PTY, such as a tmux pane. A noninteractive command runner or detached background process cannot complete the first EULA prompt. Enter the owner’s EULA decision locally; do not pipe a response or accept terms automatically. Keep this terminal and Product process alive through setup and the client reconnect.

Review the packaged LICENSE and make the EULA decision yourself before Product starts. This guide does not accept it for you. The command below is checked against the selected release’s CLI help; it has not completed a full bootstrap or real-client journey in this guide.

```bash
"$RUN_ROOT/lyftdata-x86_64-unknown-linux-gnu/lyftdata" 'run' 'server' '--staging-dir' "$RUN_ROOT/server" '--variables-master-key-file' "$RUN_ROOT/secrets/variables-master-key.hex" '--credential-manager-master-key-file' "$RUN_ROOT/secrets/credential-manager-master-key.hex" '--bind-address' '127.0.0.1:3000' '--disable-tls'
```

## 3. Bootstrap and sign in normally

Keep Product running in the first terminal. Open a second owned interactive terminal with a real TTY/PTY for the login command, and set RUN_ROOT and PROFILE to the same nonsecret values from preparation. A CLI command may require its own normal local EULA or authentication prompt. Honor an already-issued decision; keep passwords and bootstrap material out of terminal captures, model output, and logs.

For an interactive loopback run, omit an initial-admin password and open the one-time URL stored under $RUN_ROOT/server/bootstrap/initial-admin.url. The owned setup page completes POST /api/bootstrap/complete with the URL token and a password; keep both secret. Do not place the URL, token, or password in model output; retain only a redacted local status record.

There is no initial-admin password-file option in this route. A headless service uses its existing protected LYFTDATA_ADMIN_INIT_PASSWORD environment path when that has been deliberately supplied by its owner. Only noninteractive `auth login` supports `--password-file <PATH>`; keep that private file out of prompts and command history. After setup, log in with the dedicated local profile.

```bash
"$RUN_ROOT/lyftdata-x86_64-unknown-linux-gnu/lyftdata" '--profile' "$PROFILE" '--url' 'http://127.0.0.1:3000' 'auth' 'login' 'admin'
```

## 4. Register the read-only MCP connection

The client-neutral contract is the executable and ordered argument list below. It references the local profile and endpoint; it contains no credential bytes. The first supported adapter is Codex.

The preparation step gives this run a unique Product profile and registration name. Inspect $REGISTRATION first. If that owned entry already has exactly this command and arguments, leave it unchanged. If it differs, preserve it and select a different unused name or review an explicit update. Do not replace unrelated registrations or settings.

Registration on disk is not a live connection. Start a fresh Codex session or use the client’s documented reconnect path after adding it; retain this guide URL and the nonsecret checkpoint across the transition. Keep Product running in an owned terminal or tmux session so the client transition does not stop it. The launched MCP process must use this same Product profile and endpoint; preserve any required nonsecret local Product configuration environment rather than replacing it. Adding the owned entry changes the Codex configuration only for that entry and preserves unrelated registrations and settings.

```bash
# Client-neutral executable: $RUN_ROOT/lyftdata-x86_64-unknown-linux-gnu/lyftdata
# Ordered arguments: ["--profile","$PROFILE","--url","http://127.0.0.1:3000","mcp-server","--stdio","--tenant","default","--environment","default","--max-tool-tier","read_only"]
# This checks the run-owned name. Only the exact Codex missing-name result with exit code 1 adds; every other failure stops.

if get_output=$('codex' 'mcp' 'get' "$REGISTRATION" --json 2>&1); then
  printf "%s\n" "Existing owned registration found; compare it with the metadata below and retain it unless a reviewed update is needed."
else
  status=$?
  expected_missing="Error: No MCP server named '$REGISTRATION' found."
  if [ "$status" -ne 1 ] || [ "$get_output" != "$expected_missing" ]; then printf "%s\n" "codex mcp get failed with an unexpected result" >&2; exit "$status"; fi
  'codex' 'mcp' 'add' "$REGISTRATION" '--' "$RUN_ROOT/lyftdata-x86_64-unknown-linux-gnu/lyftdata" '--profile' "$PROFILE" '--url' 'http://127.0.0.1:3000' 'mcp-server' '--stdio' '--tenant' 'default' '--environment' 'default' '--max-tool-tier' 'read_only'
fi
```

## 5. Use live Product guidance before a job

Before registration, expect the loopback liveness endpoint http://127.0.0.1:3000/api/liveness to return HTTP 2xx and the setup URL to be available locally. After normal setup/login, use the same profile to confirm the intended endpoint and worker state in Product. A refused connection, missing setup URL, non-2xx liveness response, or offline worker means stop and diagnose that local Product state before MCP.

On the fresh connection, read the Product initialization instructions first. Then call mcp_server_metrics and tool_inventory to verify the intended Product version, endpoint, tenant/environment, authenticated identity and read_only cap. Use tool_get for live schemas and then follow the relevant workflow recommendation before proposing a bounded useful job. For the first job, write exactly {"run":"agent-onboarding","sequence":1,"message":"hello"} followed by a newline to $RUN_ROOT/input.jsonl, then use the live schema to create and execute a deterministic local job that writes $RUN_ROOT/output.jsonl. The expected result is exactly one identical output record.

Honor an already-issued EULA decision, authenticated session, or bounded write authorization; do not request it again. Pause only when the required decision or grant is absent, expired, or outside the current scope.

A saved registration, a silent stdio process, a parsed configuration, or an acknowledgement is not a successful connection or job. Success is a matching output readback at the owned output path. Missing tools, stale initialization instructions, a wrong target/tier, an offline worker, failed output readback, or an unavailable readiness endpoint are failures with a Product/runtime remedy; do not invent flags or broaden access.

## Recovery and proof boundary

On checksum mismatch, stop before extraction. On an occupied port or existing staging directory, choose a new run-owned location; do not remove another installation. On an expired bootstrap URL, refresh it through the normal local Product flow. On a registration collision, retain the original and choose a new name. On expired login, use normal re-login without resetting credentials.

This page and its generated Markdown have source and focused-test coverage only. They do not claim a completed package download, EULA decision, Product bootstrap, authenticated MCP connection, worker job, or output verification. Those require a clean real-client run and separate receipt.

## Related maintained routes

- Downloads: https://docs.lyftdata.com/install/downloads/
- MCP troubleshooting: https://docs.lyftdata.com/ai/mcp/troubleshooting/
- First-job guidance: https://docs.lyftdata.com/get-started/running/