docs: add SECURITY.md and GitHub issue templates
Add a security policy directing private vulnerability reports to security@astrolabecloud.com instead of public issues, and update the README's Security section to point at it. Add structured issue forms under .github/ISSUE_TEMPLATE/ covering bugs, feature requests, questions, and documentation, plus a config.yml that disables blank issues and routes security reports and open-ended questions to the appropriate channels. The bug template captures fields most commonly missing from past reports (server/Nextcloud/app versions, deployment mode, transport, MCP client). Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
This commit is contained in:
Chris Coutinho
co-authored by
Claude Opus 4.7
Claude Opus 4.7
parent
a9c5759869
commit
8cc84ac08b
@@ -0,0 +1,141 @@
|
||||
name: Bug report
|
||||
description: Report a bug, crash, or unexpected behavior in nextcloud-mcp-server
|
||||
title: "[Bug]: "
|
||||
labels: ["bug"]
|
||||
body:
|
||||
- type: markdown
|
||||
attributes:
|
||||
value: |
|
||||
Thanks for taking the time to file a bug report.
|
||||
|
||||
**Before submitting**, please check that:
|
||||
- You're running a recent version (`uvx nextcloud-mcp-server --version` or check the Docker tag).
|
||||
- The issue isn't already reported in [open issues](https://github.com/cbcoutinho/nextcloud-mcp-server/issues).
|
||||
- Security issues should **not** be filed here — see [SECURITY.md](https://github.com/cbcoutinho/nextcloud-mcp-server/blob/master/SECURITY.md).
|
||||
|
||||
- type: textarea
|
||||
id: summary
|
||||
attributes:
|
||||
label: Summary
|
||||
description: One or two sentences describing what went wrong.
|
||||
placeholder: "nc_contacts_create silently drops EMAIL/TEL/ORG fields — only the full name is saved."
|
||||
validations:
|
||||
required: true
|
||||
|
||||
- type: textarea
|
||||
id: reproduction
|
||||
attributes:
|
||||
label: Steps to reproduce
|
||||
description: Minimal steps to trigger the bug. Include the exact MCP tool call(s) and arguments where relevant.
|
||||
placeholder: |
|
||||
1. Call `nc_contacts_create` with `full_name`, `email`, `phone`
|
||||
2. Inspect the contact in the Nextcloud web UI
|
||||
3. Only the name is present
|
||||
validations:
|
||||
required: true
|
||||
|
||||
- type: textarea
|
||||
id: expected
|
||||
attributes:
|
||||
label: Expected vs actual behavior
|
||||
placeholder: |
|
||||
Expected: All provided fields are written to the vCard.
|
||||
Actual: Only FN is saved; EMAIL, TEL, ORG are silently dropped.
|
||||
validations:
|
||||
required: true
|
||||
|
||||
- type: textarea
|
||||
id: logs
|
||||
attributes:
|
||||
label: Logs and error output
|
||||
description: |
|
||||
Include the full error message / stack trace from the MCP server, and any relevant entries from
|
||||
`docker compose exec app cat /var/www/html/data/nextcloud.log | jq | tail` (Nextcloud side).
|
||||
Redact tokens, passwords, and personal data.
|
||||
render: shell
|
||||
validations:
|
||||
required: false
|
||||
|
||||
- type: input
|
||||
id: mcp_server_version
|
||||
attributes:
|
||||
label: nextcloud-mcp-server version
|
||||
description: e.g. `0.73.0`, Docker tag, or git SHA.
|
||||
placeholder: "0.73.0"
|
||||
validations:
|
||||
required: true
|
||||
|
||||
- type: input
|
||||
id: nextcloud_version
|
||||
attributes:
|
||||
label: Nextcloud server version
|
||||
placeholder: "Nextcloud 30.0.2"
|
||||
validations:
|
||||
required: true
|
||||
|
||||
- type: input
|
||||
id: nextcloud_app_versions
|
||||
attributes:
|
||||
label: Affected Nextcloud app version(s)
|
||||
description: |
|
||||
For bugs in a specific app integration, list the installed app version(s) — e.g. Notes 5.0.0, Deck 1.13.0,
|
||||
Cookbook 0.11.2. Run `docker compose exec app php occ app:list` or check Apps in the Nextcloud UI.
|
||||
placeholder: "Notes 5.0.0"
|
||||
validations:
|
||||
required: false
|
||||
|
||||
- type: dropdown
|
||||
id: deployment_mode
|
||||
attributes:
|
||||
label: Deployment mode
|
||||
options:
|
||||
- Single-user (BasicAuth)
|
||||
- Multi-user BasicAuth (pass-through)
|
||||
- Login Flow v2
|
||||
- OAuth / OIDC (Nextcloud user_oidc)
|
||||
- OAuth / OIDC (external IdP, e.g. Keycloak)
|
||||
- Other / not sure
|
||||
validations:
|
||||
required: true
|
||||
|
||||
- type: dropdown
|
||||
id: transport
|
||||
attributes:
|
||||
label: MCP transport
|
||||
options:
|
||||
- stdio
|
||||
- streamable-http
|
||||
- sse (legacy)
|
||||
- Other / not sure
|
||||
validations:
|
||||
required: true
|
||||
|
||||
- type: dropdown
|
||||
id: install_method
|
||||
attributes:
|
||||
label: How are you running the server?
|
||||
options:
|
||||
- uvx
|
||||
- Docker / docker compose
|
||||
- Helm chart on Kubernetes
|
||||
- Local checkout (`uv run`)
|
||||
- Other
|
||||
validations:
|
||||
required: true
|
||||
|
||||
- type: input
|
||||
id: mcp_client
|
||||
attributes:
|
||||
label: MCP client
|
||||
description: e.g. Claude Desktop, Claude Code, an IDE extension, custom client + LLM.
|
||||
placeholder: "Claude Code"
|
||||
validations:
|
||||
required: true
|
||||
|
||||
- type: textarea
|
||||
id: additional
|
||||
attributes:
|
||||
label: Additional context
|
||||
description: Anything else that might help — workarounds you found, related issues, suspected root cause, etc.
|
||||
validations:
|
||||
required: false
|
||||
@@ -0,0 +1,8 @@
|
||||
blank_issues_enabled: false
|
||||
contact_links:
|
||||
- name: Security vulnerability
|
||||
url: https://github.com/cbcoutinho/nextcloud-mcp-server/blob/master/SECURITY.md
|
||||
about: Do not file security issues publicly. Email security@astrolabecloud.com — see SECURITY.md.
|
||||
- name: Question or discussion
|
||||
url: https://github.com/cbcoutinho/nextcloud-mcp-server/discussions
|
||||
about: For general questions, deployment help, or open-ended discussion, please use Discussions instead of opening an issue.
|
||||
@@ -0,0 +1,29 @@
|
||||
name: Documentation issue
|
||||
description: Report unclear, missing, or incorrect documentation
|
||||
title: "[Docs]: "
|
||||
labels: ["documentation"]
|
||||
body:
|
||||
- type: input
|
||||
id: location
|
||||
attributes:
|
||||
label: Where is the issue?
|
||||
description: File path, doc URL, or section heading.
|
||||
placeholder: "docs/authentication.md — 'Multi-User OAuth' section"
|
||||
validations:
|
||||
required: true
|
||||
|
||||
- type: textarea
|
||||
id: problem
|
||||
attributes:
|
||||
label: What's wrong or missing?
|
||||
description: Describe what was confusing, incorrect, or absent. If something didn't work as documented, include what you tried.
|
||||
validations:
|
||||
required: true
|
||||
|
||||
- type: textarea
|
||||
id: suggestion
|
||||
attributes:
|
||||
label: Suggested improvement
|
||||
description: Optional — proposed wording, missing example, or a link to a better explanation.
|
||||
validations:
|
||||
required: false
|
||||
@@ -0,0 +1,58 @@
|
||||
name: Feature request
|
||||
description: Suggest a new Nextcloud app integration, MCP tool, or capability
|
||||
title: "[Feature]: "
|
||||
labels: ["enhancement"]
|
||||
body:
|
||||
- type: markdown
|
||||
attributes:
|
||||
value: |
|
||||
Thanks for suggesting an improvement! See the [Supported Apps table](https://github.com/cbcoutinho/nextcloud-mcp-server#supported-apps)
|
||||
for what's already covered.
|
||||
|
||||
- type: textarea
|
||||
id: problem
|
||||
attributes:
|
||||
label: What problem are you trying to solve?
|
||||
description: Describe the use case from the user's perspective. What can't you do today?
|
||||
placeholder: "I want to start Nextcloud Talk calls and post messages to rooms from an AI assistant."
|
||||
validations:
|
||||
required: true
|
||||
|
||||
- type: input
|
||||
id: nextcloud_app
|
||||
attributes:
|
||||
label: Nextcloud app or feature involved
|
||||
description: If this is about a specific Nextcloud app (Talk, Photos, Mail, etc.) or API, name it here.
|
||||
placeholder: "Talk (spreed)"
|
||||
validations:
|
||||
required: false
|
||||
|
||||
- type: textarea
|
||||
id: proposal
|
||||
attributes:
|
||||
label: Proposed solution
|
||||
description: |
|
||||
What would the MCP tool(s) look like? Include suggested tool names, inputs/outputs, and any relevant
|
||||
Nextcloud API endpoints if you've researched them.
|
||||
placeholder: |
|
||||
- `nc_talk_list_rooms()` — returns rooms the user is a member of
|
||||
- `nc_talk_send_message(room_token, message)`
|
||||
- Backed by the OCS Talk API: /ocs/v2.php/apps/spreed/api/v4/...
|
||||
validations:
|
||||
required: false
|
||||
|
||||
- type: textarea
|
||||
id: alternatives
|
||||
attributes:
|
||||
label: Alternatives considered
|
||||
description: Any workarounds you've tried, or other tools/projects that solve a similar problem.
|
||||
validations:
|
||||
required: false
|
||||
|
||||
- type: textarea
|
||||
id: additional
|
||||
attributes:
|
||||
label: Additional context
|
||||
description: Screenshots, links to Nextcloud API docs, related issues, etc.
|
||||
validations:
|
||||
required: false
|
||||
@@ -0,0 +1,56 @@
|
||||
name: Question / setup help
|
||||
description: Configuration, deployment, or "how do I…" questions
|
||||
title: "[Question]: "
|
||||
labels: ["question"]
|
||||
body:
|
||||
- type: markdown
|
||||
attributes:
|
||||
value: |
|
||||
For open-ended discussion, please consider [GitHub Discussions](https://github.com/cbcoutinho/nextcloud-mcp-server/discussions) instead.
|
||||
Use this template for specific, answerable questions about configuration or behavior.
|
||||
|
||||
- type: textarea
|
||||
id: question
|
||||
attributes:
|
||||
label: Your question
|
||||
description: What are you trying to do, and what's not working or unclear?
|
||||
validations:
|
||||
required: true
|
||||
|
||||
- type: textarea
|
||||
id: tried
|
||||
attributes:
|
||||
label: What have you tried?
|
||||
description: Commands run, config files, docs you've already read.
|
||||
validations:
|
||||
required: false
|
||||
|
||||
- type: input
|
||||
id: mcp_server_version
|
||||
attributes:
|
||||
label: nextcloud-mcp-server version
|
||||
placeholder: "0.73.0"
|
||||
validations:
|
||||
required: true
|
||||
|
||||
- type: input
|
||||
id: nextcloud_version
|
||||
attributes:
|
||||
label: Nextcloud server version
|
||||
placeholder: "Nextcloud 30.0.2"
|
||||
validations:
|
||||
required: false
|
||||
|
||||
- type: dropdown
|
||||
id: deployment_mode
|
||||
attributes:
|
||||
label: Deployment mode
|
||||
options:
|
||||
- Single-user (BasicAuth)
|
||||
- Multi-user BasicAuth (pass-through)
|
||||
- Login Flow v2
|
||||
- OAuth / OIDC (Nextcloud user_oidc)
|
||||
- OAuth / OIDC (external IdP, e.g. Keycloak)
|
||||
- Not yet decided
|
||||
validations:
|
||||
required: true
|
||||
@@ -248,7 +248,7 @@ This project takes security seriously:
|
||||
- No credential storage in OAuth mode
|
||||
- Regular security assessments
|
||||
|
||||
Found a security issue? Please report it privately to the maintainers.
|
||||
Found a security issue? **Do not open a public GitHub issue.** Please report it privately by emailing **security@astrolabecloud.com**. See [SECURITY.md](./SECURITY.md) for details.
|
||||
|
||||
## License
|
||||
|
||||
|
||||
+18
@@ -0,0 +1,18 @@
|
||||
# Security Policy
|
||||
|
||||
## Reporting a Vulnerability
|
||||
|
||||
**Please do not report security vulnerabilities through public GitHub issues.**
|
||||
|
||||
If you discover a security vulnerability in this project, report it privately by emailing:
|
||||
|
||||
**security@astrolabecloud.com**
|
||||
|
||||
Please include as much of the following information as possible to help us triage your report:
|
||||
|
||||
- A description of the vulnerability and its potential impact
|
||||
- Steps to reproduce the issue (proof-of-concept code, if applicable)
|
||||
- The version(s) of the project affected
|
||||
- Any known mitigations or workarounds
|
||||
|
||||
We will acknowledge receipt of your report and work with you on coordinated disclosure.
|
||||
Reference in New Issue
Block a user