Chris CoutinhoandClaude Opus 4.7 cafd318f36 refactor(config)!: rename OAUTH_SINGLE_AUDIENCE to LOGIN_FLOW, gate on ENABLE_LOGIN_FLOW
The AuthMode.OAUTH_SINGLE_AUDIENCE enum was a vestige of ADR-021's
original design where it co-existed with OAUTH_TOKEN_EXCHANGE. The
un-augmented OAuth bearer pass-through it represented relied on
Nextcloud-side patches to user_oidc (Bearer token validation on
non-OCS endpoints) that were never merged upstream (see
docs/authentication.md, docs/login-flow-v2.md). The working path —
mcp-login-flow profile — sets ENABLE_LOGIN_FLOW=true on top of this
mode so Login Flow v2 acquires per-user Nextcloud app passwords via
a browser flow. With OAUTH_TOKEN_EXCHANGE removed in 57303135, the
_AUDIENCE suffix in the Python name no longer disambiguates anything,
and the enum value diverged from the env-var spelling. ADR-022 (now
accepted) called for this rename as step 1 of consolidation.

- nextcloud_mcp_server/config_validators.py: rename enum to LOGIN_FLOW
  with value "login_flow". The mode_map key is now "login_flow"; the
  MODE_REQUIREMENTS entry requires `enable_login_flow=True`. Added a
  validation gate so MCP_DEPLOYMENT_MODE=login_flow without
  ENABLE_LOGIN_FLOW=true errors with a clear message pointing at
  ADR-022. Default auto-detection fallback returns LOGIN_FLOW.
- nextcloud_mcp_server/app.py: renamed three identifier references and
  switched the "Configuring MCP server for OAuth mode" log line to
  the uniform `mode.value` shape used by the other modes.
- nextcloud_mcp_server/api/management.py: renamed identifier in the
  /api/v1/status mapping. The user-visible "auth_mode": "oauth" string
  is preserved — that's a stable Astrolabe contract.
- nextcloud_mcp_server/config.py: updated Settings docstring.
- tests/unit/test_config_validators.py: renamed class
  TestOAuthSingleAudienceValidation → TestLoginFlowValidation,
  individual test methods, env-var strings; added enable_login_flow=True
  to fixtures expecting success; added a new test
  (test_login_flow_requires_enable_login_flow_flag) that exercises the
  validation gate.
- tests/unit/test_management_status_endpoint.py: renamed identifier.

BREAKING CHANGE: MCP_DEPLOYMENT_MODE=oauth_single_audience is no longer
accepted. Set MCP_DEPLOYMENT_MODE=login_flow (and keep
ENABLE_LOGIN_FLOW=true) for the same deployment. The un-augmented
OAuth path is no longer supported; if you previously ran the broken
path, you can either configure Login Flow v2 (recommended) or switch
to multi_user_basic / single_user_basic.

Dead-code pruning of `oauth_enabled and not enable_login_flow`
branches in app.py (lifespan, background sync) is deferred to a
separate follow-up PR per the consolidation plan in ADR-022.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
2026-05-12 19:34:13 +02:00
2025-11-19 23:44:23 +01:00
2026-05-11 00:48:28 +00:00
2025-11-23 16:12:37 +01:00
2025-05-05 03:11:16 +02:00
2026-05-11 00:48:28 +00:00
2026-05-11 00:48:28 +00:00

Nextcloud MCP Server

Nextcloud MCP Server

Docker Image

A production-ready MCP server that connects AI assistants to your Nextcloud instance.

Enable Large Language Models like Claude, GPT, and Gemini to interact with your Nextcloud data through a secure API. Create notes, manage calendars, organize contacts, work with files, and more - all through natural language conversations.

This is a dedicated standalone MCP server designed for external MCP clients like Claude Code and IDEs. It runs independently of Nextcloud (Docker, VM, Kubernetes, or local) and provides deep CRUD operations across Nextcloud apps.

Note

Looking for AI features inside Nextcloud? Nextcloud also provides Context Agent, which powers the Assistant app and runs as an ExApp inside Nextcloud. See docs/comparison-context-agent.md for a detailed comparison of use cases.

Tip

Don't want to self-host? Astrolabe Cloud is a managed hosting service for this MCP server, aimed at users and teams who want advanced features like background sync and semantic search without operating the infrastructure themselves. The service is currently under development — sign up on the landing page to join the early-adopter list.

Quick Start

Run the server locally with uvx (no installation required):

NEXTCLOUD_HOST=https://your.nextcloud.instance.com \
NEXTCLOUD_USERNAME=your_username \
NEXTCLOUD_PASSWORD=your_app_password \
  uvx nextcloud-mcp-server run --transport stdio

Or add it directly to your MCP client configuration (e.g. claude_desktop_config.json or .claude/settings.json):

{
  "mcpServers": {
    "nextcloud": {
      "command": "uvx",
      "args": ["nextcloud-mcp-server", "run", "--transport", "stdio"],
      "env": {
        "NEXTCLOUD_HOST": "https://your.nextcloud.instance.com",
        "NEXTCLOUD_USERNAME": "your_username",
        "NEXTCLOUD_PASSWORD": "your_app_password"
      }
    }
  }
}

Tip

Generate an app password in Nextcloud under Settings > Security > Devices & sessions instead of using your login password.

Docker

For full features including semantic search, run with Docker:

docker run -p 127.0.0.1:8000:8000 --rm \
  -e NEXTCLOUD_HOST=https://your.nextcloud.instance.com \
  -e NEXTCLOUD_USERNAME=your_username \
  -e NEXTCLOUD_PASSWORD=your_app_password \
  ghcr.io/cbcoutinho/nextcloud-mcp-server:latest

Then connect your MCP client (Claude Desktop, IDEs, mcp dev, etc.) to http://127.0.0.1:8000/mcp.

For Kubernetes, see cbcoutinho/helm-charts. For other deployment options and Compose profiles, see docs/installation.md.

Key Features

  • 110+ MCP Tools - Comprehensive API coverage across 10 Nextcloud apps
  • MCP Resources - Structured data URIs for browsing Nextcloud data
  • Semantic Search (Experimental) - Optional vector-powered search for Notes, Files, News items, and Deck cards (requires Qdrant + Ollama)
  • Document Processing - OCR and text extraction from PDFs, DOCX, images with progress notifications
  • Flexible Deployment - Docker, Kubernetes (Helm chart), VM, or local installation
  • Production-Ready Auth - Basic Auth with app passwords; multi-user via Login Flow v2 — MCP clients authenticate via OAuth, the server handles Nextcloud app passwords transparently
  • Tag-Based File Exclusion - Hide sensitive files/folders from MCP file tools by tagging them with a configured Nextcloud system tag (EXCLUDED_TAGS). See docs/configuration.md
  • Multiple Transports - streamable-http (default) and stdio

Supported Apps

App Tools Capabilities
Notes 7 Full CRUD, keyword search, semantic search
Calendar 20+ Events, todos (tasks), recurring events, attendees, availability
Contacts 8 Full CardDAV support, address books
Files (WebDAV) 12 Filesystem access, OCR/document processing
Deck 15 Boards, stacks, cards, labels, assignments
Cookbook 13 Recipe management, URL import (schema.org)
Tables 5 Row operations on Nextcloud Tables
Sharing 10+ Create and manage shares
News 8 Feeds, folders, items, feed health monitoring
Collectives 16 Full CRUD on collectives, pages, and tags
Talk (spreed) 6 List conversations, read/post messages, mark as read, list participants
Semantic Search 2+ Vector search for Notes, Files, News items, and Deck cards (experimental, opt-in, requires infrastructure)

Want to see another Nextcloud app supported? Open an issue or contribute a pull request!

Authentication

The MCP server authenticates to Nextcloud using app-specific passwords (Basic Auth). Three deployment modes are supported:

Mode Best for
Single-User (BasicAuth) Personal use, development, single-user deployments
Multi-User (BasicAuth pass-through) Multi-user setups where clients send credentials via Authorization header
Multi-User (Login Flow v2) Multi-user / hosted deployments — clients authenticate to the MCP server via OAuth, and the server obtains a per-user app password from Nextcloud and uses it transparently

OAuth-direct-to-Nextcloud is no longer supported (it required upstream patches to user_oidc that were never merged). Login Flow v2 replaces it for multi-user deployments and works with stock Nextcloud.

See docs/authentication.md for setup instructions.

An experimental RAG pipeline that lets MCP clients find Nextcloud content by meaning rather than keywords — a query for "car" also surfaces notes about "vehicle" or "transportation". Disabled by default (ENABLE_SEMANTIC_SEARCH=false); requires a vector database and embedding service. See docs/semantic-search-architecture.md and docs/configuration.md.

Tip

Don't want to run Qdrant and an embedding service? Astrolabe Cloud (under development) provides semantic search and background sync as a managed service.

Documentation

Contributing

Contributions are welcome!

Security

MseeP.ai Security Assessment

Found a security issue? Do not open a public GitHub issue. Use GitHub's private vulnerability reporting, or email security@astrolabecloud.com if you can't use GitHub. See SECURITY.md for details.

License

This project is licensed under the AGPL-3.0 License. See LICENSE for details.

Star History

Star History Chart

References

S
Description
No description provided
Readme
16 MiB
Languages
Python 96.7%
HTML 1.7%
HCL 0.8%
Shell 0.5%
JavaScript 0.2%