Chris CoutinhoandClaude Opus 4.7 0c6b766e7e docs: fix scope naming and round-3 reviewer feedback
The docs claimed scopes are mcp:-prefixed (mcp:notes.read,
mcp:notes.write) and that the notes.* pair "covers all Nextcloud
apps". Both are false. Per @require_scopes decorators across
nextcloud_mcp_server/server/, scopes are unprefixed and per-app:
notes.read/write, talk.read/write, files.read/write,
calendar.read/write, contacts.read/write, deck.read/write,
news.read, tables.read/write, cookbook.read/write,
todo.read/write, collectives.read/write, sharing.write,
semantic.read, plus standard OIDC scopes.

Changes:

- login-flow-v2.md: replace the false 2-row "covers all apps"
  scope table with the real per-app reference (links to
  scope_authorization.discover_all_scopes() as authoritative
  source); strip mcp: prefix from intro paragraph, sequence
  diagrams, @require_scopes example, WWW-Authenticate header
  example. Also fix sticky-session keying advice per reviewer:
  route on user identity (sub claim) rather than the raw bearer
  token, since tokens rotate on refresh.
- auth-flows.md: clarify "Astrolabe (hosted UI) → MCP" matrix
  column header; strip mcp: from sequence diagram and key
  characteristics bullet; correct "issued by MCP server" to
  "issued by configured IdP" on the Login Flow v2 token.
- authentication.md: strip mcp: from the high-level diagram and
  scope-enforcement prose; cross-link to the scope reference.
- configuration.md: add NEXTCLOUD_OIDC_CLIENT_ID,
  NEXTCLOUD_OIDC_CLIENT_SECRET, and OIDC_DISCOVERY_URL to the
  Login Flow v2 vars table — these were undocumented in the
  table after the round-2 multi-IdP fix.
- running.md: drop deprecated `version: '3.8'` from compose
  snippets (Compose v2 ignores it and emits warnings).
- testing-oidc-consent.md: fix sample authorize URL and consent
  description to use real scope names instead of mcp:-prefixed
  ones (the manual test as written would have failed with
  invalid_scope).
- CLAUDE.md: replace dead links to deleted oauth-architecture.md,
  oauth-setup.md, and audience-validation-setup.md with
  login-flow-v2.md.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
2026-04-30 03:05:33 +02:00
2025-11-19 23:44:23 +01:00
2026-04-29 23:27:51 +00:00
2025-11-23 16:12:37 +01:00
2025-05-05 03:11:16 +02:00
2026-04-29 23:27:51 +00:00
2026-04-29 23:27:51 +00:00

Nextcloud MCP Server

Nextcloud MCP Server

Docker Image

A production-ready MCP server that connects AI assistants to your Nextcloud instance.

Enable Large Language Models like Claude, GPT, and Gemini to interact with your Nextcloud data through a secure API. Create notes, manage calendars, organize contacts, work with files, and more - all through natural language conversations.

This is a dedicated standalone MCP server designed for external MCP clients like Claude Code and IDEs. It runs independently of Nextcloud (Docker, VM, Kubernetes, or local) and provides deep CRUD operations across Nextcloud apps.

Note

Looking for AI features inside Nextcloud? Nextcloud also provides Context Agent, which powers the Assistant app and runs as an ExApp inside Nextcloud. See docs/comparison-context-agent.md for a detailed comparison of use cases.

Tip

Don't want to self-host? Astrolabe Cloud is a managed hosting service for this MCP server, aimed at users and teams who want advanced features like background sync and semantic search without operating the infrastructure themselves. The service is currently under development — sign up on the landing page to join the early-adopter list.

Quick Start

Run the server locally with uvx (no installation required):

NEXTCLOUD_HOST=https://your.nextcloud.instance.com \
NEXTCLOUD_USERNAME=your_username \
NEXTCLOUD_PASSWORD=your_app_password \
  uvx nextcloud-mcp-server run --transport stdio

Or add it directly to your MCP client configuration (e.g. claude_desktop_config.json or .claude/settings.json):

{
  "mcpServers": {
    "nextcloud": {
      "command": "uvx",
      "args": ["nextcloud-mcp-server", "run", "--transport", "stdio"],
      "env": {
        "NEXTCLOUD_HOST": "https://your.nextcloud.instance.com",
        "NEXTCLOUD_USERNAME": "your_username",
        "NEXTCLOUD_PASSWORD": "your_app_password"
      }
    }
  }
}

Tip

Generate an app password in Nextcloud under Settings > Security > Devices & sessions instead of using your login password.

Docker

For full features including semantic search, run with Docker:

docker run -p 127.0.0.1:8000:8000 --rm \
  -e NEXTCLOUD_HOST=https://your.nextcloud.instance.com \
  -e NEXTCLOUD_USERNAME=your_username \
  -e NEXTCLOUD_PASSWORD=your_app_password \
  ghcr.io/cbcoutinho/nextcloud-mcp-server:latest

Then connect your MCP client (Claude Desktop, IDEs, mcp dev, etc.) to http://127.0.0.1:8000/mcp.

For Kubernetes, see cbcoutinho/helm-charts. For other deployment options and Compose profiles, see docs/installation.md.

Key Features

  • 110+ MCP Tools - Comprehensive API coverage across 10 Nextcloud apps
  • MCP Resources - Structured data URIs for browsing Nextcloud data
  • Semantic Search (Experimental) - Optional vector-powered search for Notes, Files, News items, and Deck cards (requires Qdrant + Ollama)
  • Document Processing - OCR and text extraction from PDFs, DOCX, images with progress notifications
  • Flexible Deployment - Docker, Kubernetes (Helm chart), VM, or local installation
  • Production-Ready Auth - Basic Auth with app passwords; multi-user via Login Flow v2 (OAuth-to-MCP supported, with app-password conversion to Nextcloud)
  • Multiple Transports - streamable-http (default) and stdio

Supported Apps

App Tools Capabilities
Notes 7 Full CRUD, keyword search, semantic search
Calendar 20+ Events, todos (tasks), recurring events, attendees, availability
Contacts 8 Full CardDAV support, address books
Files (WebDAV) 12 Filesystem access, OCR/document processing
Deck 15 Boards, stacks, cards, labels, assignments
Cookbook 13 Recipe management, URL import (schema.org)
Tables 5 Row operations on Nextcloud Tables
Sharing 10+ Create and manage shares
News 8 Feeds, folders, items, feed health monitoring
Collectives 16 Full CRUD on collectives, pages, and tags
Talk (spreed) 6 List conversations, read/post messages, mark as read, list participants
Semantic Search 2+ Vector search for Notes, Files, News items, and Deck cards (experimental, opt-in, requires infrastructure)

Want to see another Nextcloud app supported? Open an issue or contribute a pull request!

Authentication

The MCP server authenticates to Nextcloud using app-specific passwords (Basic Auth). Three deployment modes are supported:

Mode Best for
Single-User (BasicAuth) Personal use, development, single-user deployments
Multi-User (BasicAuth pass-through) Multi-user setups where clients send credentials via Authorization header
Multi-User (Login Flow v2) Multi-user / hosted deployments — clients authenticate to the MCP server via OAuth, and the server obtains a per-user app password from Nextcloud and uses it transparently

OAuth-direct-to-Nextcloud is no longer supported (it required upstream patches to user_oidc that were never merged). Login Flow v2 replaces it for multi-user deployments and works with stock Nextcloud.

See docs/authentication.md for setup instructions.

An experimental RAG pipeline that lets MCP clients find Nextcloud content by meaning rather than keywords — a query for "car" also surfaces notes about "vehicle" or "transportation". Disabled by default (ENABLE_SEMANTIC_SEARCH=false); requires a vector database and embedding service. See docs/semantic-search-architecture.md and docs/configuration.md.

Tip

Don't want to run Qdrant and an embedding service? Astrolabe Cloud (under development) provides semantic search and background sync as a managed service.

Documentation

Contributing

Contributions are welcome!

Security

MseeP.ai Security Assessment

Found a security issue? Do not open a public GitHub issue. Use GitHub's private vulnerability reporting, or email security@astrolabecloud.com if you can't use GitHub. See SECURITY.md for details.

License

This project is licensed under the AGPL-3.0 License. See LICENSE for details.

Star History

Star History Chart

References

S
Description
No description provided
Readme
16 MiB
Languages
Python 96.7%
HTML 1.7%
HCL 0.8%
Shell 0.5%
JavaScript 0.2%