# docx-mcp Server - Deployment Quick Reference

## Key Facts

| Item | Value |
|------|-------|
| **Transport Method** | stdio (stdin/stdout) |
| **Network Port** | Not required for local use |
| **API Key** | Not required |
| **Authentication** | OS-level + container security |

---

## Port Requirements

### Local Deployment (Recommended)
**No port required** - the server communicates via stdin/stdout directly.

### Remote Deployment (Optional)
If remote access is needed, wrap with a stdio-to-network bridge:

| Bridge Type | Port | Protocol |
|-------------|------|----------|
| WebSocket | 8080 | ws:// |
| TCP | 8080 | tcp:// |

---

## Quick Start

### Build
```bash
# Minimal (recommended)
docker build -f Dockerfile.sandboxed -t docx-mcp:sandboxed .

# With LibreOffice (better PDF conversion)
docker build -f Dockerfile.libreoffice -t docx-mcp:libreoffice .
```

### Run (Local)
```bash
docker run --rm \
    --name docx-mcp \
    --read-only \
    --cap-drop ALL \
    --tmpfs /tmp/docx-mcp \
    --memory 512m \
    docx-mcp:sandboxed
```

### Run (Remote via Docker Compose)
```bash
docker-compose up -d
```

---

## MCP Client Configuration

### Claude Desktop
```json
{
  "mcpServers": {
    "docx": {
      "command": "docker",
      "args": [
        "run", "--rm", "--read-only", "--cap-drop ALL",
        "--tmpfs /tmp/docx-mcp", "--memory 512m",
        "docx-mcp:sandboxed"
      ]
    }
  }
}
```

### Cursor
```json
{
  "mcp": {
    "servers": {
      "docx": {
        "command": "docker",
        "args": [
          "run", "--rm", "--read-only", "--cap-drop ALL",
          "--tmpfs /tmp/docx-mcp", "--memory 512m",
          "docx-mcp:sandboxed"
        ]
      }
    }
  }
}
```

---

## Security Profiles

### Readonly Mode
```bash
docker run --rm \
    -e DOCX_MCP_READONLY=true \
    -e DOCX_MCP_WHITELIST="open_document,extract_text,get_metadata,search_text" \
    docx-mcp:sandboxed
```

### Maximum Security
```bash
docker run --rm \
    --read-only \
    --cap-drop ALL \
    --network none \
    --tmpfs /tmp/docx-mcp \
    -e DOCX_MCP_READONLY=true \
    -e DOCX_MCP_SANDBOX=true \
    -e DOCX_MCP_NO_EXTERNAL_TOOLS=true \
    -e DOCX_MCP_NO_NETWORK=true \
    docx-mcp:sandboxed
```

---

## Environment Variables

| Variable | Default | Description |
|----------|---------|-------------|
| `DOCX_MCP_READONLY` | `false` | Restrict to read-only operations |
| `DOCX_MCP_SANDBOX` | `true` | Restrict file operations to temp |
| `DOCX_MCP_NO_EXTERNAL_TOOLS` | `true` | Disable LibreOffice etc. |
| `DOCX_MCP_NO_NETWORK` | `true` | Disable network access |
| `DOCX_MCP_MAX_SIZE` | `52428800` | Max document size (bytes) |
| `DOCX_MCP_MAX_DOCS` | `20` | Max concurrent documents |
| `DOCX_MCP_WHITELIST` | - | Allowed tools (comma-separated) |
| `DOCX_MCP_BLACKLIST` | - | Blocked tools (comma-separated) |

---

## Files Created

| File | Description |
|------|-------------|
| `Dockerfile.sandboxed` | Minimal security-focused image |
| `Dockerfile.libreoffice` | Full features with LibreOffice |
| `docker-compose.yml` | Production deployment config |
| `DEPLOYMENT.md` | Comprehensive deployment guide |

---

## Summary

- **Port Required:** No (for local) / 8080 (for remote with bridge)
- **API Key:** No
- **Authentication:** Container isolation + OS controls
- **Recommended:** Local stdio transport with security features enabled