Add HTTP interface, templates, generate_from_template, unified Dockerfile

DEPLOYMENT_QUICKREF.md

@@ -0,0 +1,153 @@
+# docx-mcp Server - Deployment Quick Reference
+
+## Key Facts
+
+| Item | Value |
+|------|-------|
+| **Transport Method** | stdio (stdin/stdout) |
+| **Network Port** | Not required for local use |
+| **API Key** | Not required |
+| **Authentication** | OS-level + container security |
+
+---
+
+## Port Requirements
+
+### Local Deployment (Recommended)
+**No port required** - the server communicates via stdin/stdout directly.
+
+### Remote Deployment (Optional)
+If remote access is needed, wrap with a stdio-to-network bridge:
+
+| Bridge Type | Port | Protocol |
+|-------------|------|----------|
+| WebSocket | 8080 | ws:// |
+| TCP | 8080 | tcp:// |
+
+---
+
+## Quick Start
+
+### Build
+```bash
+# Minimal (recommended)
+docker build -f Dockerfile.sandboxed -t docx-mcp:sandboxed .
+
+# With LibreOffice (better PDF conversion)
+docker build -f Dockerfile.libreoffice -t docx-mcp:libreoffice .
+```
+
+### Run (Local)
+```bash
+docker run --rm \
+    --name docx-mcp \
+    --read-only \
+    --cap-drop ALL \
+    --tmpfs /tmp/docx-mcp \
+    --memory 512m \
+    docx-mcp:sandboxed
+```
+
+### Run (Remote via Docker Compose)
+```bash
+docker-compose up -d
+```
+
+---
+
+## MCP Client Configuration
+
+### Claude Desktop
+```json
+{
+  "mcpServers": {
+    "docx": {
+      "command": "docker",
+      "args": [
+        "run", "--rm", "--read-only", "--cap-drop ALL",
+        "--tmpfs /tmp/docx-mcp", "--memory 512m",
+        "docx-mcp:sandboxed"
+      ]
+    }
+  }
+}
+```
+
+### Cursor
+```json
+{
+  "mcp": {
+    "servers": {
+      "docx": {
+        "command": "docker",
+        "args": [
+          "run", "--rm", "--read-only", "--cap-drop ALL",
+          "--tmpfs /tmp/docx-mcp", "--memory 512m",
+          "docx-mcp:sandboxed"
+        ]
+      }
+    }
+  }
+}
+```
+
+---
+
+## Security Profiles
+
+### Readonly Mode
+```bash
+docker run --rm \
+    -e DOCX_MCP_READONLY=true \
+    -e DOCX_MCP_WHITELIST="open_document,extract_text,get_metadata,search_text" \
+    docx-mcp:sandboxed
+```
+
+### Maximum Security
+```bash
+docker run --rm \
+    --read-only \
+    --cap-drop ALL \
+    --network none \
+    --tmpfs /tmp/docx-mcp \
+    -e DOCX_MCP_READONLY=true \
+    -e DOCX_MCP_SANDBOX=true \
+    -e DOCX_MCP_NO_EXTERNAL_TOOLS=true \
+    -e DOCX_MCP_NO_NETWORK=true \
+    docx-mcp:sandboxed
+```
+
+---
+
+## Environment Variables
+
+| Variable | Default | Description |
+|----------|---------|-------------|
+| `DOCX_MCP_READONLY` | `false` | Restrict to read-only operations |
+| `DOCX_MCP_SANDBOX` | `true` | Restrict file operations to temp |
+| `DOCX_MCP_NO_EXTERNAL_TOOLS` | `true` | Disable LibreOffice etc. |
+| `DOCX_MCP_NO_NETWORK` | `true` | Disable network access |
+| `DOCX_MCP_MAX_SIZE` | `52428800` | Max document size (bytes) |
+| `DOCX_MCP_MAX_DOCS` | `20` | Max concurrent documents |
+| `DOCX_MCP_WHITELIST` | - | Allowed tools (comma-separated) |
+| `DOCX_MCP_BLACKLIST` | - | Blocked tools (comma-separated) |
+
+---
+
+## Files Created
+
+| File | Description |
+|------|-------------|
+| `Dockerfile.sandboxed` | Minimal security-focused image |
+| `Dockerfile.libreoffice` | Full features with LibreOffice |
+| `docker-compose.yml` | Production deployment config |
+| `DEPLOYMENT.md` | Comprehensive deployment guide |
+
+---
+
+## Summary
+
+- **Port Required:** No (for local) / 8080 (for remote with bridge)
+- **API Key:** No
+- **Authentication:** Container isolation + OS controls
+- **Recommended:** Local stdio transport with security features enabled