Update README

CHANGELOG.md

@@ -1,28 +1,3 @@
-## v0.52.0 (2025-12-13)
-
-### Feat
-
-- **vector**: add Deck card vector search with visualization support
-
-## v0.51.0 (2025-12-13)
-
-### Feat
-
-- **vector-viz**: add news_item support for links and chunk expansion
-
-## v0.50.2 (2025-12-13)
-
-### Fix
-
-- **news**: revert get_item() to use get_items() + filter
-
-## v0.50.1 (2025-12-12)
-
-### Fix
-
-- Disable DNS rebinding protection for containerized deployments
-- **deps**: update dependency mcp to >=1.23,<1.24
-
 ## v0.50.0 (2025-12-11)
 
 ### Feat

Dockerfile

@@ -1,4 +1,4 @@
-FROM docker.io/library/python:3.12-slim-trixie@sha256:fa48eefe2146644c2308b909d6bb7651a768178f84fc9550dcd495e4d6d84d01
+FROM docker.io/library/python:3.12-slim-trixie@sha256:590cad70271b6c1795c6a11fb5c110efca593adbd0d4883cd19c36df6a56467b
 
 COPY --from=ghcr.io/astral-sh/uv:0.9.17@sha256:5cb6b54d2bc3fe2eb9a8483db958a0b9eebf9edff68adedb369df8e7b98711a2 /uv /uvx /bin/
 

Dockerfile.smithery

@@ -12,7 +12,7 @@
 # - Per-session app password authentication
 # - Multi-user support via Smithery session config
 
-FROM docker.io/library/python:3.12-slim-trixie@sha256:fa48eefe2146644c2308b909d6bb7651a768178f84fc9550dcd495e4d6d84d01
+FROM docker.io/library/python:3.12-slim-trixie@sha256:590cad70271b6c1795c6a11fb5c110efca593adbd0d4883cd19c36df6a56467b
 
 WORKDIR /app
 

README.md

@@ -1,11 +1,12 @@
+```markdown
 <p align="center">
   <img src="astrolabe.svg" alt="Nextcloud MCP Server" width="128" height="128">
 </p>
 
 # Nextcloud MCP Server
 
-[![Docker Image](https://img.shields.io/badge/docker-ghcr.io/cbcoutinho/nextcloud--mcp--server-blue)](https://github.com/cbcoutinho/nextcloud-mcp-server/pkgs/container/nextcloud-mcp-server)
 [![smithery badge](https://smithery.ai/badge/@cbcoutinho/nextcloud-mcp-server)](https://smithery.ai/server/@cbcoutinho/nextcloud-mcp-server)
+[![Docker Image](https://img.shields.io/badge/docker-ghcr.io/cbcoutinho/nextcloud--mcp--server-blue)](https://github.com/cbcoutinho/nextcloud-mcp-server/pkgs/container/nextcloud-mcp-server)
 
 **A production-ready MCP server that connects AI assistants to your Nextcloud instance.**
 
@@ -63,7 +64,7 @@ http://127.0.0.1:8000/mcp
 
 - **90+ MCP Tools** - Comprehensive API coverage across 8 Nextcloud apps
 - **MCP Resources** - Structured data URIs for browsing Nextcloud data
-- **Semantic Search (Experimental)** - Optional vector-powered search for Notes, Files, News items, and Deck cards (requires Qdrant + Ollama)
+- **Semantic Search (Experimental)** - Optional vector-powered search for Notes (requires Qdrant + Ollama)
 - **Document Processing** - OCR and text extraction from PDFs, DOCX, images with progress notifications
 - **Flexible Deployment** - Docker, Kubernetes (Helm), VM, or local installation
 - **Production-Ready Auth** - Basic Auth with app passwords (recommended) or OAuth2/OIDC (experimental)
@@ -81,7 +82,7 @@ http://127.0.0.1:8000/mcp
 | **Cookbook** | 13 | Recipe management, URL import (schema.org) |
 | **Tables** | 5 | Row operations on Nextcloud Tables |
 | **Sharing** | 10+ | Create and manage shares |
-| **Semantic Search** | 2+ | Vector search for Notes, Files, News items, and Deck cards (experimental, opt-in, requires infrastructure) |
+| **Semantic Search** | 2+ | Vector search for Notes (experimental, opt-in, requires infrastructure) |
 
 Want to see another Nextcloud app supported? [Open an issue](https://github.com/cbcoutinho/nextcloud-mcp-server/issues) or contribute a pull request!
 
@@ -145,7 +146,7 @@ This enables natural language queries and helps discover related content across
 ### Features
 - **[App Documentation](docs/)** - Notes, Calendar, Contacts, WebDAV, Deck, Cookbook, Tables
 - **[Document Processing](docs/configuration.md#document-processing)** - OCR and text extraction setup
-- **[Semantic Search Architecture](docs/semantic-search-architecture.md)** - Experimental vector search (Notes, Files, News items, Deck cards; opt-in)
+- **[Semantic Search Architecture](docs/semantic-search-architecture.md)** - Experimental vector search (Notes only, opt-in)
 - **[Vector Sync UI Guide](docs/user-guide/vector-sync-ui.md)** - Browser interface for semantic search visualization and testing
 
 ### Advanced Topics
@@ -223,3 +224,4 @@ This project is licensed under the AGPL-3.0 License. See [LICENSE](./LICENSE) fo
 - [Model Context Protocol](https://github.com/modelcontextprotocol)
 - [MCP Python SDK](https://github.com/modelcontextprotocol/python-sdk)
 - [Nextcloud](https://nextcloud.com/)
+```

charts/nextcloud-mcp-server/Chart.yaml

@@ -2,8 +2,8 @@ apiVersion: v2
 name: nextcloud-mcp-server
 description: A Helm chart for Nextcloud MCP Server - enables AI assistants to interact with Nextcloud
 type: application
-version: 0.52.0
-appVersion: "0.52.0"
+version: 0.50.0
+appVersion: "0.50.0"
 keywords:
   - nextcloud
   - mcp

docker-compose.yml

@@ -21,7 +21,7 @@ services:
     restart: always
 
   app:
-    image: docker.io/library/nextcloud:32.0.3@sha256:54993ed39dc77f7a6ade142b1625972cb7a9393074325373402d47231314afbb
+    image: docker.io/library/nextcloud:32.0.2@sha256:04cc19547e586ac75e08dd056c11330d4ce4c5c561c89405b326180a37c19afb
     restart: always
     ports:
       - 0.0.0.0:8080:80

docs/MCP-1.23-DNS-REBINDING-FIX.md

@@ -1,104 +0,0 @@
-# MCP 1.23.x DNS Rebinding Protection Fix
-
-## Problem
-
-MCP Python SDK 1.23.0 introduced **automatic DNS rebinding protection** that breaks containerized deployments (Kubernetes, Docker) when the protection is unintentionally auto-enabled.
-
-### Root Cause
-
-From `mcp/server/fastmcp/server.py:177-183` in the Python SDK:
-
-```python
-# Auto-enable DNS rebinding protection for localhost (IPv4 and IPv6)
-if transport_security is None and host in ("127.0.0.1", "localhost", "::1"):
-    transport_security = TransportSecuritySettings(
-        enable_dns_rebinding_protection=True,
-        allowed_hosts=["127.0.0.1:*", "localhost:*", "[::1]:*"],
-        allowed_origins=["http://127.0.0.1:*", "http://localhost:*", "http://[::1]:*"],
-    )
-```
-
-### What Was Happening
-
-1. **FastMCP initialization** in `app.py` didn't pass `host` or `transport_security` parameters
-2. **Defaults applied**: `host="127.0.0.1"`, `transport_security=None`
-3. **Auto-enablement triggered**: Condition `transport_security is None and host == "127.0.0.1"` was TRUE
-4. **Protection activated** with `allowed_hosts=["127.0.0.1:*", "localhost:*", "[::1]:*"]`
-5. **Kubernetes requests rejected**: `Host: nextcloud-mcp-server.default.svc.cluster.local:8000` didn't match allowed hosts
-
-### Why `--host 0.0.0.0` Didn't Help
-
-The `--host` CLI flag (used in Dockerfile/docker-compose) controls **uvicorn's bind address**, NOT the **FastMCP `host` parameter**. These are separate concerns:
-
-- **Uvicorn bind address** (`--host 0.0.0.0`): Where the HTTP server listens
-- **FastMCP host parameter** (defaulted to `"127.0.0.1"`): Used for auto-enablement logic
-
-## Solution
-
-Explicitly disable DNS rebinding protection by passing `transport_security=TransportSecuritySettings(enable_dns_rebinding_protection=False)` to all FastMCP instances.
-
-### Changes Made
-
-Modified `nextcloud_mcp_server/app.py`:
-
-1. **Import** `TransportSecuritySettings` from `mcp.server.transport_security`
-2. **Updated all three FastMCP initializations**:
-   - OAuth mode (line 1015)
-   - Smithery stateless mode (line 1030)
-   - BasicAuth mode (line 1040)
-
-Each now includes:
-```python
-transport_security=TransportSecuritySettings(enable_dns_rebinding_protection=False)
-```
-
-## Impact
-
-### ✅ What This Fixes
-
-- **Kubernetes deployments**: Requests with k8s service DNS names now work
-- **Docker deployments**: Port-mapped requests (localhost:8000 → container) now work
-- **Reverse proxy deployments**: Proxied requests with various Host headers now work
-- **Ingress controllers**: Requests via ingress hostnames now work
-
-### 🔒 Security Considerations
-
-DNS rebinding protection defends against attacks where:
-1. Attacker controls a DNS domain (e.g., `evil.com`)
-2. DNS initially resolves to attacker's IP
-3. After victim's browser caches the origin, DNS changes to victim's localhost
-4. Attacker's page can now make requests to victim's localhost services
-
-**Why it's safe to disable for this deployment:**
-
-1. **OAuth authentication required** in production deployments (ADR-002, ADR-004)
-2. **Network-level isolation** in containerized environments (k8s network policies, Docker networks)
-3. **MCP is server-to-server**, not exposed to browsers (no CORS concerns)
-4. **Host header validation inappropriate** for multi-tenant k8s environments
-
-If DNS rebinding protection is needed for specific deployments, it can be re-enabled with a custom allowed hosts list:
-
-```python
-transport_security=TransportSecuritySettings(
-    enable_dns_rebinding_protection=True,
-    allowed_hosts=[
-        "nextcloud-mcp-server.default.svc.cluster.local:*",
-        "mcp.example.com:*",
-        # Add all your expected Host header values
-    ]
-)
-```
-
-## Testing
-
-- ✅ Ruff linting passes
-- ✅ Type checking passes (pre-existing warnings unrelated)
-- ✅ Module imports successfully
-- ✅ Compatible with MCP 1.23.x
-
-## References
-
-- [MCP Python SDK 1.23.0 Release](https://github.com/modelcontextprotocol/python-sdk/releases/tag/v1.23.0)
-- Commit: `d3a1841` - "Auto-enable DNS rebinding protection for localhost servers"
-- Issue #373 (original report of k8s breakage)
-- PR #382 (MCP 1.23.x upgrade)

docs/semantic-search-architecture.md

@@ -5,7 +5,7 @@ This document explains the architecture of the semantic search feature in the Ne
 > [!IMPORTANT]
 > **Status: Experimental**
 > - Disabled by default (`VECTOR_SYNC_ENABLED=false`)
-> - Currently supports **Notes, Files (PDFs), News items, and Deck cards**
+> - Currently supports **Notes app only** (multi-app architecture ready, additional apps planned)
 > - Requires additional infrastructure (Qdrant vector database + Ollama embedding service)
 > - RAG answer generation requires MCP client sampling support
 
@@ -39,9 +39,9 @@ Semantic search enables:
 
 ### Current Support
 
-- **Supported Apps**: Notes, Files (PDFs with text extraction), News items, Deck cards
-- **Planned Apps**: Calendar events, Calendar tasks, Contacts
-- **Architecture**: Multi-app plugin system ready for additional apps
+- **Supported Apps**: Notes (fully implemented)
+- **Planned Apps**: Calendar events, Calendar tasks, Deck cards, Files (with text extraction), Contacts
+- **Architecture**: Multi-app plugin system ready, awaiting implementation
 
 ## System Components
 

nextcloud_mcp_server/app.py

@@ -19,7 +19,6 @@ import httpx
 from anyio.streams.memory import MemoryObjectReceiveStream, MemoryObjectSendStream
 from mcp.server.auth.settings import AuthSettings
 from mcp.server.fastmcp import Context, FastMCP
-from mcp.server.transport_security import TransportSecuritySettings
 from pydantic import AnyHttpUrl
 from starlette.applications import Starlette
 from starlette.middleware.authentication import AuthenticationMiddleware
@@ -1017,11 +1016,6 @@ def get_app(transport: str = "streamable-http", enabled_apps: list[str] | None =
             lifespan=oauth_lifespan,
             token_verifier=token_verifier,
             auth=auth_settings,
-            # Disable DNS rebinding protection for containerized deployments (k8s, Docker)
-            # MCP 1.23+ auto-enables this for localhost, breaking k8s service DNS names
-            transport_security=TransportSecuritySettings(
-                enable_dns_rebinding_protection=False
-            ),
         )
     else:
         # ADR-016: Use Smithery lifespan for stateless mode, BasicAuth otherwise
@@ -1030,26 +1024,11 @@ def get_app(transport: str = "streamable-http", enabled_apps: list[str] | None =
             # json_response=True returns plain JSON-RPC instead of SSE format,
             # required for Smithery scanner compatibility
             mcp = FastMCP(
-                "Nextcloud MCP",
-                lifespan=app_lifespan_smithery,
-                json_response=True,
-                # Disable DNS rebinding protection for containerized deployments (k8s, Docker)
-                # MCP 1.23+ auto-enables this for localhost, breaking k8s service DNS names
-                transport_security=TransportSecuritySettings(
-                    enable_dns_rebinding_protection=False
-                ),
+                "Nextcloud MCP", lifespan=app_lifespan_smithery, json_response=True
             )
         else:
             logger.info("Configuring MCP server for BasicAuth mode")
-            mcp = FastMCP(
-                "Nextcloud MCP",
-                lifespan=app_lifespan_basic,
-                # Disable DNS rebinding protection for containerized deployments (k8s, Docker)
-                # MCP 1.23+ auto-enables this for localhost, breaking k8s service DNS names
-                transport_security=TransportSecuritySettings(
-                    enable_dns_rebinding_protection=False
-                ),
-            )
+            mcp = FastMCP("Nextcloud MCP", lifespan=app_lifespan_basic)
 
     @mcp.resource("nc://capabilities")
     async def nc_get_capabilities():

nextcloud_mcp_server/auth/static/vector-viz.js

@@ -201,15 +201,8 @@ function vizApp() {
                     return `${baseUrl}/apps/calendar`;
                 case 'contact':
                     return `${baseUrl}/apps/contacts`;
-                case 'deck_card':
-                    // URL pattern: /apps/deck/board/:boardId/card/:cardId
-                    if (result.metadata && result.metadata.board_id) {
-                        return `${baseUrl}/apps/deck/board/${result.metadata.board_id}/card/${result.id}`;
-                    }
-                    // Fallback if board_id not available
+                case 'deck':
                     return `${baseUrl}/apps/deck`;
-                case 'news_item':
-                    return `${baseUrl}/apps/news/item/${result.id}`;
                 default:
                     return `${baseUrl}`;
             }

nextcloud_mcp_server/auth/templates/vector_viz.html

@@ -65,12 +65,8 @@
                                     <span>Contacts</span>
                                 </label>
                                 <label style="display: flex; align-items: center; cursor: pointer; font-weight: normal;">
-                                    <input type="checkbox" x-model="docTypes" value="deck_card" style="margin-right: 4px;">
-                                    <span>Deck Cards</span>
-                                </label>
-                                <label style="display: flex; align-items: center; cursor: pointer; font-weight: normal;">
-                                    <input type="checkbox" x-model="docTypes" value="news_item" style="margin-right: 4px;">
-                                    <span>News</span>
+                                    <input type="checkbox" x-model="docTypes" value="deck" style="margin-right: 4px;">
+                                    <span>Deck</span>
                                 </label>
                             </div>
                         </div>

nextcloud_mcp_server/auth/viz_routes.py

@@ -298,7 +298,6 @@ async def vector_visualization_search(request: Request) -> JSONResponse:
                             "title": r.title,
                             "excerpt": r.excerpt,
                             "score": r.score,
-                            "metadata": r.metadata,
                         }
                         for r in search_results
                     ],
@@ -459,7 +458,6 @@ async def vector_visualization_search(request: Request) -> JSONResponse:
                 ),  # Raw score from algorithm
                 "chunk_start_offset": r.chunk_start_offset,
                 "chunk_end_offset": r.chunk_end_offset,
-                "metadata": r.metadata,  # Include metadata (e.g., board_id for deck_card)
             }
             for r in search_results
         ]

nextcloud_mcp_server/client/news.py

@@ -228,10 +228,6 @@ class NewsClient(BaseNextcloudClient):
     async def get_item(self, item_id: int) -> dict[str, Any]:
         """Get a specific item by ID.
 
-        Note: The News API doesn't have a direct single-item endpoint,
-        so we fetch all items and filter. For efficiency, consider
-        caching or using get_items with specific feed if known.
-
         Args:
             item_id: Item ID
 
@@ -239,15 +235,10 @@ class NewsClient(BaseNextcloudClient):
             Item data
 
         Raises:
-            ValueError: If item not found
+            HTTPStatusError: 404 if item not found
         """
-        # Fetch all items and find the one we need
-        # This is inefficient but the API doesn't provide a direct endpoint
-        items = await self.get_items(batch_size=-1, get_read=True)
-        for item in items:
-            if item.get("id") == item_id:
-                return item
-        raise ValueError(f"Item {item_id} not found")
+        response = await self._make_request("GET", f"{self.API_BASE}/items/{item_id}")
+        return response.json()
 
     async def get_updated_items(
         self,

nextcloud_mcp_server/search/bm25_hybrid.py

@@ -219,18 +219,6 @@ class BM25HybridSearchAlgorithm(SearchAlgorithm):
 
                 seen_chunks.add(chunk_key)
 
-                # Build metadata dict with common fields
-                metadata = {
-                    "chunk_index": result.payload.get("chunk_index"),
-                    "total_chunks": result.payload.get("total_chunks"),
-                    "search_method": f"bm25_hybrid_{self.fusion_name}",
-                }
-
-                # Add deck_card-specific metadata for frontend URL construction
-                if doc_type == "deck_card":
-                    if board_id := result.payload.get("board_id"):
-                        metadata["board_id"] = board_id
-
                 # Return unverified results (verification happens at output stage)
                 results.append(
                     SearchResult(
@@ -239,7 +227,11 @@ class BM25HybridSearchAlgorithm(SearchAlgorithm):
                         title=result.payload.get("title", "Untitled"),
                         excerpt=result.payload.get("excerpt", ""),
                         score=result.score,  # Fusion score (RRF or DBSF)
-                        metadata=metadata,
+                        metadata={
+                            "chunk_index": result.payload.get("chunk_index"),
+                            "total_chunks": result.payload.get("total_chunks"),
+                            "search_method": f"bm25_hybrid_{self.fusion_name}",
+                        },
                         chunk_start_offset=result.payload.get("chunk_start_offset"),
                         chunk_end_offset=result.payload.get("chunk_end_offset"),
                         page_number=result.payload.get("page_number"),

nextcloud_mcp_server/search/context.py

@@ -209,64 +209,6 @@ async def _get_file_path_from_qdrant(
         return None
 
 
-async def _get_deck_metadata_from_qdrant(
-    user_id: str, card_id: int
-) -> dict[str, int] | None:
-    """Retrieve board_id and stack_id for a deck card from Qdrant payload.
-
-    Args:
-        user_id: User ID who owns the card
-        card_id: Card ID
-
-    Returns:
-        Dictionary with board_id and stack_id, or None if not found
-    """
-    try:
-        from qdrant_client.models import FieldCondition, Filter, MatchValue
-
-        from nextcloud_mcp_server.config import get_settings
-        from nextcloud_mcp_server.vector.qdrant_client import get_qdrant_client
-
-        qdrant_client = await get_qdrant_client()
-        settings = get_settings()
-
-        # Query for any chunk of this card (we just need metadata)
-        scroll_result = await qdrant_client.scroll(
-            collection_name=settings.get_collection_name(),
-            scroll_filter=Filter(
-                must=[
-                    FieldCondition(key="user_id", match=MatchValue(value=user_id)),
-                    FieldCondition(key="doc_id", match=MatchValue(value=card_id)),
-                    FieldCondition(key="doc_type", match=MatchValue(value="deck_card")),
-                ]
-            ),
-            limit=1,
-            with_payload=["board_id", "stack_id"],
-            with_vectors=False,
-        )
-
-        if scroll_result[0]:
-            point = scroll_result[0][0]
-            board_id = point.payload.get("board_id")
-            stack_id = point.payload.get("stack_id")
-            if board_id is not None and stack_id is not None:
-                logger.debug(
-                    f"Retrieved deck metadata for card {card_id}: "
-                    f"board_id={board_id}, stack_id={stack_id}"
-                )
-                return {"board_id": int(board_id), "stack_id": int(stack_id)}
-
-        logger.debug(
-            f"Could not find deck metadata in Qdrant for card {card_id} "
-            f"(might be legacy data without board_id/stack_id)"
-        )
-        return None
-
-    except Exception as e:
-        logger.debug(f"Error querying Qdrant for deck metadata: {e}")
-        return None
-
-
 @dataclass
 class ChunkContext:
     """Expanded chunk with surrounding context and position markers.
@@ -452,9 +394,7 @@ async def get_chunk_with_context(
         logger.debug(f"Resolved file_id {doc_id} to file_path {file_path}")
 
     # Fetch full document text
-    full_text = await _fetch_document_text(
-        nc_client, resolved_doc_id, doc_type, user_id
-    )
+    full_text = await _fetch_document_text(nc_client, resolved_doc_id, doc_type)
     if full_text is None:
         logger.warning(
             f"Could not fetch document text for {doc_type} {doc_id}, "
@@ -513,7 +453,7 @@ async def get_chunk_with_context(
 
 
 async def _fetch_document_text(
-    nc_client: NextcloudClient, doc_id: str | int, doc_type: str, user_id: str
+    nc_client: NextcloudClient, doc_id: str | int, doc_type: str
 ) -> str | None:
     """Fetch full text content of a document.
 
@@ -584,93 +524,6 @@ async def _fetch_document_text(
                     f"Error fetching file content for {doc_id}: {e}", exc_info=True
                 )
                 return None
-        elif doc_type == "news_item":
-            # Fetch news item by ID
-            from nextcloud_mcp_server.vector.html_processor import html_to_markdown
-
-            item = await nc_client.news.get_item(int(doc_id))
-            # Reconstruct full content as indexed: title + source + URL + body
-            # This ensures chunk offsets align with indexed content structure
-            body_markdown = html_to_markdown(item.get("body", ""))
-            item_title = item.get("title", "")
-            item_url = item.get("url", "")
-            feed_title = item.get("feedTitle", "")
-
-            content_parts = [item_title]
-            if feed_title:
-                content_parts.append(f"Source: {feed_title}")
-            if item_url:
-                content_parts.append(f"URL: {item_url}")
-            content_parts.append("")  # Blank line
-            content_parts.append(body_markdown)
-            return "\n".join(content_parts)
-        elif doc_type == "deck_card":
-            # Fetch card from Deck API
-            # Try to get board_id/stack_id from Qdrant metadata (O(1) lookup)
-            # Otherwise fall back to iteration (legacy data)
-            card = None
-            deck_metadata = await _get_deck_metadata_from_qdrant(user_id, int(doc_id))
-
-            if deck_metadata:
-                # Fast path: Direct lookup with known board_id/stack_id
-                board_id = deck_metadata["board_id"]
-                stack_id = deck_metadata["stack_id"]
-                try:
-                    card = await nc_client.deck.get_card(
-                        board_id=board_id, stack_id=stack_id, card_id=int(doc_id)
-                    )
-                    logger.debug(
-                        f"Retrieved deck card {doc_id} using metadata "
-                        f"(board_id={board_id}, stack_id={stack_id})"
-                    )
-                except Exception as e:
-                    logger.warning(
-                        f"Failed to fetch card with metadata (board_id={board_id}, "
-                        f"stack_id={stack_id}, card_id={doc_id}): {e}, falling back to iteration"
-                    )
-
-            # Fallback: Iterate through all boards/stacks (for legacy data or if fast path failed)
-            if card is None:
-                boards = await nc_client.deck.get_boards()
-                card_found = False
-
-                for board in boards:
-                    if card_found:
-                        break
-
-                    # Skip deleted boards (soft delete: deletedAt > 0)
-                    if board.deletedAt > 0:
-                        logger.debug(
-                            f"Skipping deleted board {board.id} while searching for card {doc_id}"
-                        )
-                        continue
-
-                    stacks = await nc_client.deck.get_stacks(board.id)
-
-                    for stack in stacks:
-                        if card_found:
-                            break
-                        if stack.cards:
-                            for c in stack.cards:
-                                if c.id == int(doc_id):
-                                    card = c
-                                    card_found = True
-                                    logger.debug(
-                                        f"Found deck card {doc_id} in board {board.id}, "
-                                        f"stack {stack.id} (fallback iteration)"
-                                    )
-                                    break
-
-                if not card_found:
-                    logger.warning(f"Deck card {doc_id} not found in any board/stack")
-                    return None
-
-            # Reconstruct full content as indexed: title + "\n\n" + description
-            # This ensures chunk offsets align with indexed content structure
-            content_parts = [card.title]
-            if card.description:
-                content_parts.append(card.description)
-            return "\n\n".join(content_parts)
         else:
             logger.warning(f"Unsupported doc_type for context expansion: {doc_type}")
             return None

nextcloud_mcp_server/search/semantic.py

@@ -151,17 +151,6 @@ class SemanticSearchAlgorithm(SearchAlgorithm):
 
             seen_chunks.add(chunk_key)
 
-            # Build metadata dict with common fields
-            metadata = {
-                "chunk_index": result.payload.get("chunk_index"),
-                "total_chunks": result.payload.get("total_chunks"),
-            }
-
-            # Add deck_card-specific metadata for frontend URL construction
-            if doc_type == "deck_card":
-                if board_id := result.payload.get("board_id"):
-                    metadata["board_id"] = board_id
-
             # Return unverified results (verification happens at output stage)
             results.append(
                 SearchResult(
@@ -170,7 +159,10 @@ class SemanticSearchAlgorithm(SearchAlgorithm):
                     title=result.payload.get("title", "Untitled"),
                     excerpt=result.payload.get("excerpt", ""),
                     score=result.score,
-                    metadata=metadata,
+                    metadata={
+                        "chunk_index": result.payload.get("chunk_index"),
+                        "total_chunks": result.payload.get("total_chunks"),
+                    },
                     chunk_start_offset=result.payload.get("chunk_start_offset"),
                     chunk_end_offset=result.payload.get("chunk_end_offset"),
                     page_number=result.payload.get("page_number"),

nextcloud_mcp_server/server/semantic.py

@@ -65,13 +65,13 @@ def configure_semantic_tools(mcp: FastMCP):
         database for optimal relevance. This provides the best of both semantic
         understanding and keyword precision.
 
-        Requires VECTOR_SYNC_ENABLED=true. Supports indexing of notes, files,
-        news items, and deck cards.
+        Requires VECTOR_SYNC_ENABLED=true. Currently only "note" documents are
+        fully supported for indexing.
 
         Args:
             query: Natural language or keyword search query
             limit: Maximum number of results to return (default: 10)
-            doc_types: Document types to search (e.g., ["note", "file", "deck_card", "news_item"]). None = search all indexed types (default)
+            doc_types: Document types to search (e.g., ["note", "file"]). None = search all indexed types (default)
             score_threshold: Minimum fusion score (0-1, default: 0.0)
             fusion: Fusion algorithm: "rrf" (Reciprocal Rank Fusion, default) or "dbsf" (Distribution-Based Score Fusion)
                    RRF: Good general-purpose fusion using reciprocal ranks

nextcloud_mcp_server/vector/processor.py

@@ -6,7 +6,6 @@ Processes documents from stream: fetches content, generates embeddings, stores i
 import logging
 import time
 import uuid
-from typing import Any, cast
 
 import anyio
 from anyio.abc import TaskStatus
@@ -312,97 +311,6 @@ async def _index_document(
             file_path = None
             content_bytes = None
             content_type = None
-        elif doc_task.doc_type == "deck_card":
-            # Fetch card from Deck API
-            # Use metadata from scanner if available (O(1) lookup)
-            # Otherwise fall back to iteration (legacy data)
-            card = None
-            board = None
-            stack = None
-
-            if (
-                doc_task.metadata
-                and "board_id" in doc_task.metadata
-                and "stack_id" in doc_task.metadata
-            ):
-                # Fast path: Direct lookup with known board_id/stack_id
-                board_id = doc_task.metadata["board_id"]
-                stack_id = doc_task.metadata["stack_id"]
-                try:
-                    card = await nc_client.deck.get_card(
-                        board_id=int(board_id),
-                        stack_id=int(stack_id),
-                        card_id=int(doc_task.doc_id),
-                    )
-                    # Fetch board and stack info for metadata
-                    boards = await nc_client.deck.get_boards()
-                    for b in boards:
-                        if b.id == int(board_id):
-                            board = b
-                            stacks = await nc_client.deck.get_stacks(b.id)
-                            for s in stacks:
-                                if s.id == int(stack_id):
-                                    stack = s
-                                    break
-                            break
-                except Exception as e:
-                    logger.warning(
-                        f"Failed to fetch card with metadata (board_id={board_id}, stack_id={stack_id}, card_id={doc_task.doc_id}): {e}, falling back to iteration"
-                    )
-
-            # Fallback: Iterate through all boards/stacks (for legacy data or if fast path failed)
-            if card is None:
-                boards = await nc_client.deck.get_boards()
-                card_found = False
-
-                for b in boards:
-                    if card_found:
-                        break
-                    # Skip deleted boards (soft delete: deletedAt > 0)
-                    if b.deletedAt > 0:
-                        continue
-                    stacks = await nc_client.deck.get_stacks(b.id)
-                    for s in stacks:
-                        if card_found:
-                            break
-                        if s.cards:
-                            for c in s.cards:
-                                if c.id == int(doc_task.doc_id):
-                                    card = c
-                                    board = b
-                                    stack = s
-                                    card_found = True
-                                    break
-
-                if not card_found:
-                    raise ValueError(
-                        f"Deck card {doc_task.doc_id} not found in any board/stack"
-                    )
-
-            # Build content from card title and description
-            content_parts = [card.title]
-            if card.description:
-                content_parts.append(card.description)
-            content = "\n\n".join(content_parts)
-            title = card.title
-
-            # Store deck-specific metadata
-            file_metadata = {
-                "board_id": board.id,
-                "board_title": board.title,
-                "stack_id": stack.id,
-                "stack_title": stack.title,
-                "card_type": card.type,
-                "duedate": (card.duedate.isoformat() if card.duedate else None),
-                "archived": card.archived,
-                "owner": (
-                    card.owner.uid if hasattr(card.owner, "uid") else str(card.owner)
-                ),
-            }
-            etag = card.etag or ""
-            file_path = None
-            content_bytes = None
-            content_type = None
         elif doc_task.doc_type == "file":
             # For files, doc_id is now the numeric file ID, file_path comes from DocumentTask
             if not doc_task.file_path:
@@ -491,16 +399,14 @@ async def _index_document(
     # Assign page numbers to chunks if page boundaries are available (PDFs)
     page_boundaries = file_metadata.get("page_boundaries")
     if doc_task.doc_type == "file" and page_boundaries is not None:
-        # Type narrowing: page_boundaries is guaranteed to be list[dict] here
-        page_boundaries_list = cast(list[dict[str, Any]], page_boundaries)
         with trace_operation(
             "vector_sync.assign_page_numbers",
             attributes={
                 "vector_sync.chunk_count": len(chunks),
-                "vector_sync.page_count": len(page_boundaries_list),
+                "vector_sync.page_count": len(page_boundaries),
             },
         ):
-            assign_page_numbers(chunks, page_boundaries_list)
+            assign_page_numbers(chunks, page_boundaries)
 
             # Diagnostic: Verify page number assignment
             assigned_count = sum(1 for c in chunks if c.page_number is not None)
@@ -523,8 +429,8 @@ async def _index_document(
                     f"Text length: {len(content)}, "
                     f"Chunks: {len(chunks)}, "
                     f"Chunk offset range: [{chunks[0].start_offset}:{chunks[-1].end_offset}], "
-                    f"Page boundaries: {len(page_boundaries_list)} pages, "
-                    f"First boundary: {page_boundaries_list[0] if page_boundaries_list else 'None'}"
+                    f"Page boundaries: {len(page_boundaries)} pages, "
+                    f"First boundary: {page_boundaries[0] if page_boundaries else 'None'}"
                 )
 
     # Extract chunk texts for embedding
@@ -598,9 +504,6 @@ async def _index_document(
                 logger.warning("No page boundaries available, skipping highlighting")
                 return
 
-            # Type narrowing: page_boundaries is guaranteed to be list[dict] here
-            page_boundaries_list = cast(list[dict[str, Any]], page_boundaries)
-
             logger.info(
                 f"Batch generating highlighted page images for {len(chunk_data)} PDF chunks"
             )
@@ -611,7 +514,7 @@ async def _index_document(
                 lambda: PDFHighlighter.highlight_chunks_batch(
                     pdf_bytes=content_bytes,
                     chunks=chunk_data,
-                    page_boundaries=page_boundaries_list,
+                    page_boundaries=page_boundaries,
                     full_text=content,
                     color="yellow",
                     zoom=2.0,
@@ -720,20 +623,6 @@ async def _index_document(
                         if doc_task.doc_type == "news_item"
                         else {}
                     ),
-                    # Deck card-specific metadata
-                    **(
-                        {
-                            "board_id": file_metadata.get("board_id"),
-                            "board_title": file_metadata.get("board_title"),
-                            "stack_id": file_metadata.get("stack_id"),
-                            "stack_title": file_metadata.get("stack_title"),
-                            "card_type": file_metadata.get("card_type"),
-                            "duedate": file_metadata.get("duedate"),
-                            "owner": file_metadata.get("owner"),
-                        }
-                        if doc_task.doc_type == "deck_card"
-                        else {}
-                    ),
                     # Highlighted page image (PDF only)
                     **(
                         {

nextcloud_mcp_server/vector/scanner.py

@@ -36,9 +36,6 @@ class DocumentTask:
     operation: str  # "index" or "delete"
     modified_at: int
     file_path: str | None = None  # File path for files (when doc_id is file_id)
-    metadata: dict[str, int | str] | None = (
-        None  # Additional metadata (e.g., board_id/stack_id for deck_card)
-    )
 
 
 # Track documents potentially deleted (grace period before actual deletion)
@@ -82,11 +79,9 @@ async def get_last_indexed_timestamp(user_id: str) -> int | None:
 
         if scroll_result[0]:
             timestamps = [
-                point.payload.get("indexed_at", 0)
-                for point in scroll_result[0]
-                if point.payload is not None
+                point.payload.get("indexed_at", 0) for point in scroll_result[0]
             ]
-            max_timestamp = max(timestamps) if timestamps else 0
+            max_timestamp = max(timestamps)
             logger.info(
                 f"Max indexed_at: {max_timestamp}, timestamps sample: {timestamps[:3]}"
             )
@@ -569,23 +564,9 @@ async def scan_user_documents(
         except Exception as e:
             logger.warning(f"Failed to scan news items for {user_id}: {e}")
 
-        # Scan Deck cards
-        deck_queued = 0
-        try:
-            deck_queued = await scan_deck_cards(
-                user_id=user_id,
-                send_stream=send_stream,
-                nc_client=nc_client,
-                initial_sync=initial_sync,
-                scan_id=scan_id,
-            )
-            queued += deck_queued
-        except Exception as e:
-            logger.warning(f"Failed to scan deck cards for {user_id}: {e}")
-
         if queued > 0:
             logger.info(
-                f"Sent {queued} documents ({file_queued} files, {news_queued} news items, {deck_queued} deck cards) for incremental sync: {user_id}"
+                f"Sent {queued} documents ({file_queued} files, {news_queued} news items) for incremental sync: {user_id}"
             )
         else:
             logger.debug(f"No changes detected for {user_id}")
@@ -772,202 +753,3 @@ async def scan_news_items(
                     _potentially_deleted[doc_key] = current_time
 
     return queued
-
-
-async def scan_deck_cards(
-    user_id: str,
-    send_stream: MemoryObjectSendStream[DocumentTask],
-    nc_client: NextcloudClient,
-    initial_sync: bool,
-    scan_id: int,
-) -> int:
-    """
-    Scan user's Deck cards and queue changed cards for indexing.
-
-    Indexes cards from all non-archived boards and stacks.
-
-    Args:
-        user_id: User to scan
-        send_stream: Stream to send changed documents to processors
-        nc_client: Authenticated Nextcloud client
-        initial_sync: If True, send all documents (first-time sync)
-        scan_id: Scan identifier for logging
-
-    Returns:
-        Number of cards queued for processing
-    """
-    settings = get_settings()
-    queued = 0
-
-    # Get indexed deck card IDs from Qdrant (for deletion tracking)
-    indexed_card_ids: set[str] = set()
-    if not initial_sync:
-        qdrant_client = await get_qdrant_client()
-        scroll_result = await qdrant_client.scroll(
-            collection_name=settings.get_collection_name(),
-            scroll_filter=Filter(
-                must=[
-                    FieldCondition(key="user_id", match=MatchValue(value=user_id)),
-                    FieldCondition(key="doc_type", match=MatchValue(value="deck_card")),
-                ]
-            ),
-            with_payload=["doc_id"],
-            with_vectors=False,
-            limit=10000,
-        )
-        indexed_card_ids = {
-            point.payload["doc_id"]
-            for point in (scroll_result[0] or [])
-            if point.payload is not None
-        }
-        logger.debug(f"Found {len(indexed_card_ids)} indexed deck cards in Qdrant")
-
-    # Fetch all boards
-    boards = await nc_client.deck.get_boards()
-    logger.debug(f"[SCAN-{scan_id}] Found {len(boards)} deck boards")
-
-    card_count = 0
-    nextcloud_card_ids: set[str] = set()
-
-    # Iterate through boards
-    for board in boards:
-        # Skip archived boards
-        if board.archived:
-            continue
-
-        # Skip deleted boards (soft delete: deletedAt > 0)
-        if board.deletedAt > 0:
-            logger.debug(f"[SCAN-{scan_id}] Skipping deleted board {board.id}")
-            continue
-
-        # Get stacks for this board
-        stacks = await nc_client.deck.get_stacks(board.id)
-
-        # Iterate through stacks
-        for stack in stacks:
-            # Skip if stack has no cards
-            if not stack.cards:
-                continue
-
-            # Iterate through cards in stack
-            for card in stack.cards:
-                # Skip archived cards
-                if card.archived:
-                    continue
-
-                card_count += 1
-                doc_id = str(card.id)
-                nextcloud_card_ids.add(doc_id)
-
-                # Use lastModified timestamp if available
-                modified_at = card.lastModified or 0
-
-                if initial_sync:
-                    # Send everything on first sync - write placeholder first
-                    await write_placeholder_point(
-                        doc_id=doc_id,
-                        doc_type="deck_card",
-                        user_id=user_id,
-                        modified_at=modified_at,
-                    )
-                    await send_stream.send(
-                        DocumentTask(
-                            user_id=user_id,
-                            doc_id=doc_id,
-                            doc_type="deck_card",
-                            operation="index",
-                            modified_at=modified_at,
-                            metadata={"board_id": board.id, "stack_id": stack.id},
-                        )
-                    )
-                    queued += 1
-                else:
-                    # Incremental sync: check if card exists and compare modified_at
-                    doc_key = (user_id, doc_id)
-                    if doc_key in _potentially_deleted:
-                        logger.debug(
-                            f"Deck card {doc_id} reappeared, removing from deletion grace period"
-                        )
-                        del _potentially_deleted[doc_key]
-
-                    # Query Qdrant for existing entry
-                    existing_metadata = await query_document_metadata(
-                        doc_id=doc_id, doc_type="deck_card", user_id=user_id
-                    )
-
-                    needs_indexing = False
-                    if existing_metadata is None:
-                        needs_indexing = True
-                    elif existing_metadata.get("modified_at", 0) < modified_at:
-                        needs_indexing = True
-                    elif existing_metadata.get("is_placeholder", False):
-                        queued_at = existing_metadata.get("queued_at", 0)
-                        placeholder_age = time.time() - queued_at
-                        stale_threshold = settings.vector_sync_scan_interval * 5
-                        if placeholder_age > stale_threshold:
-                            logger.debug(
-                                f"Found stale placeholder for deck card {doc_id} "
-                                f"(age={placeholder_age:.1f}s), requeuing"
-                            )
-                            needs_indexing = True
-
-                    if needs_indexing:
-                        await write_placeholder_point(
-                            doc_id=doc_id,
-                            doc_type="deck_card",
-                            user_id=user_id,
-                            modified_at=modified_at,
-                        )
-                        await send_stream.send(
-                            DocumentTask(
-                                user_id=user_id,
-                                doc_id=doc_id,
-                                doc_type="deck_card",
-                                operation="index",
-                                modified_at=modified_at,
-                                metadata={"board_id": board.id, "stack_id": stack.id},
-                            )
-                        )
-                        queued += 1
-
-    logger.info(
-        f"[SCAN-{scan_id}] Found {card_count} deck cards (non-archived) for {user_id}"
-    )
-    record_vector_sync_scan(card_count)
-
-    # Check for deleted cards (not initial sync)
-    if not initial_sync:
-        grace_period = settings.vector_sync_scan_interval * 1.5
-        current_time = time.time()
-
-        for doc_id in indexed_card_ids:
-            if doc_id not in nextcloud_card_ids:
-                doc_key = (user_id, doc_id)
-
-                if doc_key in _potentially_deleted:
-                    first_missing_time = _potentially_deleted[doc_key]
-                    time_missing = current_time - first_missing_time
-
-                    if time_missing >= grace_period:
-                        logger.info(
-                            f"Deck card {doc_id} missing for {time_missing:.1f}s "
-                            f"(>{grace_period:.1f}s grace period), sending deletion"
-                        )
-                        await send_stream.send(
-                            DocumentTask(
-                                user_id=user_id,
-                                doc_id=doc_id,
-                                doc_type="deck_card",
-                                operation="delete",
-                                modified_at=0,
-                            )
-                        )
-                        queued += 1
-                        del _potentially_deleted[doc_key]
-                else:
-                    logger.debug(
-                        f"Deck card {doc_id} missing for first time, starting grace period"
-                    )
-                    _potentially_deleted[doc_key] = current_time
-
-    return queued

pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "nextcloud-mcp-server"
-version = "0.52.0"
+version = "0.50.0"
 description = "Model Context Protocol (MCP) server for Nextcloud integration - enables AI assistants to interact with Nextcloud data"
 authors = [
     {name = "Chris Coutinho", email = "chris@coutinho.io"}
@@ -10,7 +10,7 @@ license = {text = "AGPL-3.0-only"}
 requires-python = ">=3.11"
 keywords = ["nextcloud", "mcp", "model-context-protocol", "llm", "ai", "claude", "webdav", "caldav", "carddav"]
 dependencies = [
-    "mcp[cli] (>=1.23,<1.24)",
+    "mcp[cli] (>=1.22,<1.23)",
     "httpx (>=0.28.1,<0.29.0)",
     "pillow (>=10.3.0,<12.0.0)", # Compatible with fastembed
     "icalendar (>=6.0.0,<7.0.0)",
@@ -101,7 +101,6 @@ extend-select = ["I"]
 
 [tool.uv.sources]
 caldav = { git = "https://github.com/cbcoutinho/caldav", branch = "feature/httpx" }
-qdrant-client = { git = "https://github.com/cbcoutinho/qdrant-client", branch = "fix/fusion-score-threshold" }
 
 [build-system]
 requires = ["uv_build>=0.9.4,<0.10.0"]

tests/client/news/test_news_api.py

@@ -310,16 +310,14 @@ async def test_news_api_get_items_unread_only(mocker):
 
 
 async def test_news_api_get_item(mocker):
-    """Test that get_item fetches all items and filters for the requested ID."""
-    # Create multiple items, only one should be returned
-    items = [
-        create_mock_news_item(item_id=100, title="Other Item 1"),
-        create_mock_news_item(item_id=123, title="Single Item"),
-        create_mock_news_item(item_id=200, title="Other Item 2"),
-    ]
+    """Test that get_item fetches a single item by ID."""
+    item = create_mock_news_item(item_id=123, title="Single Item")
+    mock_response = create_mock_response(status_code=200, json_data=item)
 
     mock_client = mocker.AsyncMock(spec=httpx.AsyncClient)
-    mock_get_items = mocker.patch.object(NewsClient, "get_items", return_value=items)
+    mock_make_request = mocker.patch.object(
+        NewsClient, "_make_request", return_value=mock_response
+    )
 
     client = NewsClient(mock_client, "testuser")
     result = await client.get_item(item_id=123)
@@ -327,24 +325,7 @@ async def test_news_api_get_item(mocker):
     assert result["id"] == 123
     assert result["title"] == "Single Item"
 
-    # Verify it fetched all items with correct params
-    mock_get_items.assert_called_once_with(batch_size=-1, get_read=True)
-
-
-async def test_news_api_get_item_not_found(mocker):
-    """Test that get_item raises ValueError when item not found."""
-    items = [
-        create_mock_news_item(item_id=100, title="Item 1"),
-        create_mock_news_item(item_id=200, title="Item 2"),
-    ]
-
-    mock_client = mocker.AsyncMock(spec=httpx.AsyncClient)
-    mocker.patch.object(NewsClient, "get_items", return_value=items)
-
-    client = NewsClient(mock_client, "testuser")
-
-    with pytest.raises(ValueError, match="Item 999 not found"):
-        await client.get_item(item_id=999)
+    mock_make_request.assert_called_once_with("GET", "/apps/news/api/v1-3/items/123")
 
 
 async def test_news_api_get_updated_items(mocker):

tests/integration/test_deck_vector_search.py

@@ -1,238 +0,0 @@
-"""Integration tests for Deck card vector search.
-
-These tests validate that Deck cards are properly indexed and searchable
-via semantic search.
-"""
-
-import pytest
-
-pytestmark = [pytest.mark.integration, pytest.mark.smoke]
-
-
-async def test_deck_card_semantic_search(nc_mcp_client, nc_client, mocker):
-    """Test that Deck cards can be indexed and searched via semantic search.
-
-    This test:
-    1. Creates a Deck board with a card
-    2. Manually triggers indexing (simulates vector sync)
-    3. Performs semantic search filtering by deck_card doc_type
-    4. Verifies the card is found in results
-    """
-    # Skip if vector sync is not enabled
-    settings_response = await nc_mcp_client.call_tool("nc_get_vector_sync_status", {})
-    if settings_response.isError:
-        pytest.skip("Vector sync not enabled")
-
-    # Create a test board
-    board_title = "Test Board for Vector Search"
-    board = await nc_client.deck.create_board(title=board_title, color="ff0000")
-
-    try:
-        # Create a stack for the board
-        stack = await nc_client.deck.create_stack(
-            board_id=board.id, title="Test Stack", order=0
-        )
-
-        # Create a test card with searchable content
-        card_title = "Machine Learning Project Plan"
-        card_description = """
-        # ML Project Outline
-
-        ## Phase 1: Data Collection
-        - Gather training data from multiple sources
-        - Clean and preprocess the dataset
-
-        ## Phase 2: Model Training
-        - Experiment with different neural network architectures
-        - Use gradient descent optimization
-
-        ## Phase 3: Deployment
-        - Deploy model to production environment
-        - Monitor performance metrics
-        """
-        card = await nc_client.deck.create_card(
-            board_id=board.id,
-            stack_id=stack.id,
-            title=card_title,
-            description=card_description,
-        )
-
-        # Note: In a real integration test with vector sync enabled,
-        # we would wait for the background scanner to index the card.
-        # For now, we'll test the scanning function directly if needed.
-
-        # TODO: Once vector sync is running in test environment,
-        # add actual semantic search test here
-        # For now, just verify the card was created successfully
-        assert card.id is not None
-        assert card.title == card_title
-        assert card.description == card_description
-
-        # Test semantic search with deck_card filter
-        # Note: This will only work if vector sync is actually running
-        # and the card has been indexed
-        try:
-            search_result = await nc_mcp_client.call_tool(
-                "nc_semantic_search",
-                {
-                    "query": "machine learning neural networks",
-                    "doc_types": ["deck_card"],
-                    "limit": 10,
-                },
-            )
-
-            # If vector sync is working, we should find the card
-            if not search_result.isError:
-                data = search_result.structuredContent
-                results = data.get("results", [])
-
-                # Check if our card is in the results
-                found_card = any(
-                    r.get("doc_type") == "deck_card" and r.get("title") == card_title
-                    for r in results
-                )
-
-                # Log result for debugging
-                if found_card:
-                    print("✓ Successfully found Deck card in vector search")
-                else:
-                    print(
-                        "⚠ Deck card not found in search (may need time for indexing)"
-                    )
-        except Exception as e:
-            # If search fails, it might be because indexing hasn't happened yet
-            print(f"⚠ Semantic search failed (indexing may not be complete): {e}")
-
-    finally:
-        # Cleanup: delete the board
-        try:
-            await nc_client.deck.delete_board(board.id)
-        except Exception as e:
-            print(f"Warning: Failed to cleanup test board: {e}")
-
-
-async def test_deck_card_appears_in_cross_app_search(nc_mcp_client, nc_client):
-    """Test that Deck cards appear in cross-app semantic search (no doc_type filter).
-
-    This verifies that when searching without specifying doc_types,
-    Deck cards are included in the results alongside notes, files, etc.
-    """
-    # Skip if vector sync is not enabled
-    settings_response = await nc_mcp_client.call_tool("nc_get_vector_sync_status", {})
-    if settings_response.isError:
-        pytest.skip("Vector sync not enabled")
-
-    # Create a test board with a distinctive card
-    board_title = "Cross-App Search Test Board"
-    board = await nc_client.deck.create_board(title=board_title, color="00ff00")
-
-    try:
-        # Create a stack for the board
-        stack = await nc_client.deck.create_stack(
-            board_id=board.id, title="Test Stack", order=0
-        )
-
-        # Use a very distinctive term to make it easy to find
-        unique_term = "xylophone_banana_unicorn_test"
-        _card = await nc_client.deck.create_card(
-            board_id=board.id,
-            stack_id=stack.id,
-            title=f"Test Card with {unique_term}",
-            description=f"This card contains the unique search term: {unique_term}",
-        )
-
-        # Test cross-app search (no doc_type filter)
-        try:
-            search_result = await nc_mcp_client.call_tool(
-                "nc_semantic_search",
-                {
-                    "query": unique_term,
-                    "limit": 20,
-                },
-            )
-
-            if not search_result.isError:
-                data = search_result.structuredContent
-                results = data.get("results", [])
-
-                # Check if deck_card appears in cross-app results
-                deck_cards_found = [
-                    r for r in results if r.get("doc_type") == "deck_card"
-                ]
-
-                if deck_cards_found:
-                    print(
-                        f"✓ Found {len(deck_cards_found)} Deck card(s) in cross-app search"
-                    )
-                else:
-                    print(
-                        "⚠ No Deck cards in cross-app search (may need time for indexing)"
-                    )
-        except Exception as e:
-            print(f"⚠ Cross-app search failed: {e}")
-
-    finally:
-        # Cleanup
-        try:
-            await nc_client.deck.delete_board(board.id)
-        except Exception as e:
-            print(f"Warning: Failed to cleanup test board: {e}")
-
-
-async def test_deck_card_chunk_context(nc_client):
-    """Test that Deck card chunk context can be fetched for visualization.
-
-    This test validates that the vector viz UI can display Deck card previews
-    by fetching the chunk context via the context expansion module.
-    """
-    from nextcloud_mcp_server.search.context import get_chunk_with_context
-
-    # Create board, stack, and card
-    board = await nc_client.deck.create_board(title="Test Board", color="ff0000")
-
-    try:
-        stack = await nc_client.deck.create_stack(
-            board_id=board.id, title="Test Stack", order=0
-        )
-
-        card_title = "Test Card for Context Expansion"
-        card_description = "This is a test description that should be fetched by the context expansion module when displaying chunk previews in the vector visualization UI."
-
-        card = await nc_client.deck.create_card(
-            board_id=board.id,
-            stack_id=stack.id,
-            title=card_title,
-            description=card_description,
-        )
-
-        # Fetch chunk context (simulates viz UI request)
-        # The chunk spans the title, so start=0 and end=len(card_title)
-        context = await get_chunk_with_context(
-            nc_client=nc_client,
-            user_id=nc_client.username,
-            doc_id=card.id,
-            doc_type="deck_card",
-            chunk_start=0,
-            chunk_end=len(card_title),
-            context_chars=100,
-        )
-
-        # Verify context was fetched successfully
-        assert context is not None, "Chunk context should not be None"
-        assert card_title in context.chunk_text, (
-            f"Card title '{card_title}' should be in chunk_text"
-        )
-
-        # Verify context includes description
-        assert card_description[:50] in context.after_context, (
-            "Card description should be in after_context"
-        )
-
-        print(f"✓ Successfully fetched chunk context for Deck card {card.id}")
-
-    finally:
-        # Cleanup
-        try:
-            await nc_client.deck.delete_board(board.id)
-        except Exception as e:
-            print(f"Warning: Failed to cleanup test board: {e}")

tests/server/test_dns_rebinding_fix.py

@@ -1,174 +0,0 @@
-"""
-Test that DNS rebinding protection is properly disabled for containerized deployments.
-
-This test verifies that the fix for MCP 1.23.x DNS rebinding protection works correctly.
-Without the fix, requests with Host headers that don't match the default allowed list
-(127.0.0.1:*, localhost:*, [::1]:*) would be rejected with a 421 Misdirected Request error.
-"""
-
-import httpx
-import pytest
-
-
-@pytest.mark.integration
-async def test_accepts_various_host_headers():
-    """Test that the MCP server accepts requests with various Host headers.
-
-    This test simulates what happens in containerized deployments where the Host
-    header might be a k8s service DNS name, a proxied hostname, or other values
-    that don't match the default allowed list.
-
-    Without the DNS rebinding protection fix, these requests would fail with:
-    - 421 Misdirected Request (for Host header mismatch)
-    - 403 Forbidden (for Origin header mismatch)
-    """
-    mcp_url = "http://localhost:8000/mcp"
-
-    # Test various Host headers that would be rejected by DNS rebinding protection
-    test_cases = [
-        {
-            "name": "Kubernetes service DNS",
-            "headers": {
-                "Host": "nextcloud-mcp-server.default.svc.cluster.local:8000",
-                "Content-Type": "application/json",
-                "Accept": "application/json, text/event-stream",
-            },
-        },
-        {
-            "name": "Custom domain",
-            "headers": {
-                "Host": "mcp.example.com:8000",
-                "Content-Type": "application/json",
-                "Accept": "application/json, text/event-stream",
-            },
-        },
-        {
-            "name": "Proxied hostname",
-            "headers": {
-                "Host": "proxy.internal:8000",
-                "Content-Type": "application/json",
-                "Accept": "application/json, text/event-stream",
-            },
-        },
-        {
-            "name": "Default localhost (should always work)",
-            "headers": {
-                "Host": "localhost:8000",
-                "Content-Type": "application/json",
-                "Accept": "application/json, text/event-stream",
-            },
-        },
-    ]
-
-    # Create a simple initialize request payload
-    initialize_request = {
-        "jsonrpc": "2.0",
-        "method": "initialize",
-        "params": {
-            "protocolVersion": "2024-11-05",
-            "capabilities": {},
-            "clientInfo": {"name": "test-client", "version": "1.0.0"},
-        },
-        "id": 1,
-    }
-
-    async with httpx.AsyncClient() as client:
-        for test_case in test_cases:
-            print(f"\n🧪 Testing: {test_case['name']}")
-            print(f"   Host header: {test_case['headers']['Host']}")
-
-            response = await client.post(
-                mcp_url,
-                json=initialize_request,
-                headers=test_case["headers"],
-                timeout=10.0,
-            )
-
-            # With DNS rebinding protection enabled (MCP 1.23 default), these would fail with:
-            # - 421 Misdirected Request (Host header not in allowed list)
-            # - 403 Forbidden (Origin header not in allowed list)
-            #
-            # With our fix (enable_dns_rebinding_protection=False), they should succeed
-            assert response.status_code in [200, 202], (
-                f"Request failed for {test_case['name']}: "
-                f"status={response.status_code}, "
-                f"headers={test_case['headers']}, "
-                f"body={response.text[:200]}"
-            )
-
-            print(f"   ✅ Status: {response.status_code}")
-
-            # For SSE responses (status 200), verify we got SSE format
-            # For JSON responses (status 202), verify we got valid JSON
-            if response.status_code == 200:
-                # SSE response - should start with "event: message" or similar
-                response_text = response.text
-                assert "event:" in response_text or "data:" in response_text, (
-                    f"Expected SSE format for {test_case['name']}, got: {response_text[:200]}"
-                )
-                print("   ✅ Received SSE stream response")
-            elif response.status_code == 202:
-                # JSON response for notifications
-                response_json = response.json()
-                assert "jsonrpc" in response_json or response_json is None, (
-                    f"Invalid response for {test_case['name']}: {response_json}"
-                )
-                print("   ✅ Received JSON response")
-
-
-@pytest.mark.integration
-async def test_dns_rebinding_protection_is_disabled():
-    """Verify that DNS rebinding protection is actually disabled in the configuration.
-
-    This test makes a request that would DEFINITELY fail if DNS rebinding protection
-    was enabled with default settings (only allowing 127.0.0.1:*, localhost:*, [::1]:*).
-    """
-    mcp_url = "http://localhost:8000/mcp"
-
-    # Use a Host header that would NEVER be in the default allowed list
-    malicious_host = "evil.attacker.com:8000"
-
-    initialize_request = {
-        "jsonrpc": "2.0",
-        "method": "initialize",
-        "params": {
-            "protocolVersion": "2024-11-05",
-            "capabilities": {},
-            "clientInfo": {"name": "test-client", "version": "1.0.0"},
-        },
-        "id": 1,
-    }
-
-    async with httpx.AsyncClient() as client:
-        response = await client.post(
-            mcp_url,
-            json=initialize_request,
-            headers={
-                "Host": malicious_host,
-                "Content-Type": "application/json",
-                "Accept": "application/json, text/event-stream",
-            },
-            timeout=10.0,
-        )
-
-        # If DNS rebinding protection was enabled, this would return:
-        # - 421 Misdirected Request (Host header validation failed)
-        #
-        # Since we disabled it, this should succeed (status 200 or 202)
-        assert response.status_code in [200, 202], (
-            f"DNS rebinding protection may still be enabled! "
-            f"Request with Host='{malicious_host}' was rejected: "
-            f"status={response.status_code}, body={response.text[:500]}"
-        )
-
-        # Verify we got a valid response (SSE or JSON)
-        if response.status_code == 200:
-            response_text = response.text
-            assert "event:" in response_text or "data:" in response_text, (
-                f"Expected SSE format, got: {response_text[:200]}"
-            )
-
-        print("✅ DNS rebinding protection is properly disabled")
-        print(
-            f"   Request with Host '{malicious_host}' succeeded: {response.status_code}"
-        )

uv.lock

@@ -1671,7 +1671,7 @@ wheels = [
 
 [[package]]
 name = "mcp"
-version = "1.23.2"
+version = "1.22.0"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
     { name = "anyio" },
@@ -1689,9 +1689,9 @@ dependencies = [
     { name = "typing-inspection" },
     { name = "uvicorn", marker = "sys_platform != 'emscripten'" },
 ]
-sdist = { url = "https://files.pythonhosted.org/packages/39/a9/0e95530946408747ae200e86553ceda0dbd851d4ae9bbe0d02a69cbd6ad5/mcp-1.23.2.tar.gz", hash = "sha256:df4e4b7273dca2aaf428f9cf7a25bbac0c9007528a65004854b246aef3d157bc", size = 599953, upload-time = "2025-12-08T15:51:02.432Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/a3/a2/c5ec0ab38b35ade2ae49a90fada718fbc76811dc5aa1760414c6aaa6b08a/mcp-1.22.0.tar.gz", hash = "sha256:769b9ac90ed42134375b19e777a2858ca300f95f2e800982b3e2be62dfc0ba01", size = 471788, upload-time = "2025-11-20T20:11:28.095Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/ad/6a/1a726905cf41a69d00989e8dfd9de7bd9b4a9f3c8723dac3077b0ba1a7b9/mcp-1.23.2-py3-none-any.whl", hash = "sha256:d8e4c6af0317ad954ea0a53dfb5e229dddea2d0a54568c080e82e8fae4a8264e", size = 231897, upload-time = "2025-12-08T15:51:01.023Z" },
+    { url = "https://files.pythonhosted.org/packages/a9/bb/711099f9c6bb52770f56e56401cdfb10da5b67029f701e0df29362df4c8e/mcp-1.22.0-py3-none-any.whl", hash = "sha256:bed758e24df1ed6846989c909ba4e3df339a27b4f30f1b8b627862a4bade4e98", size = 175489, upload-time = "2025-11-20T20:11:26.542Z" },
 ]
 
 [package.optional-dependencies]
@@ -1962,7 +1962,7 @@ wheels = [
 
 [[package]]
 name = "nextcloud-mcp-server"
-version = "0.52.0"
+version = "0.50.0"
 source = { editable = "." }
 dependencies = [
     { name = "aiosqlite" },
@@ -2027,7 +2027,7 @@ requires-dist = [
     { name = "jinja2", specifier = ">=3.1.6" },
     { name = "langchain-text-splitters", specifier = ">=1.0.0" },
     { name = "markdownify", specifier = ">=0.14.1" },
-    { name = "mcp", extras = ["cli"], specifier = ">=1.23,<1.24" },
+    { name = "mcp", extras = ["cli"], specifier = ">=1.22,<1.23" },
     { name = "openai", specifier = ">=2.8.1" },
     { name = "opentelemetry-api", specifier = ">=1.28.2" },
     { name = "opentelemetry-exporter-otlp-proto-grpc", specifier = ">=1.28.2" },
@@ -2044,7 +2044,7 @@ requires-dist = [
     { name = "pymupdf4llm", specifier = ">=0.2.2" },
     { name = "python-json-logger", specifier = ">=3.2.0" },
     { name = "pythonvcard4", specifier = ">=0.2.0" },
-    { name = "qdrant-client", git = "https://github.com/cbcoutinho/qdrant-client?branch=fix%2Ffusion-score-threshold" },
+    { name = "qdrant-client", specifier = ">=1.7.0" },
 ]
 
 [package.metadata.requires-dev]
@@ -3329,8 +3329,8 @@ wheels = [
 
 [[package]]
 name = "qdrant-client"
-version = "1.16.2"
-source = { git = "https://github.com/cbcoutinho/qdrant-client?branch=fix%2Ffusion-score-threshold#a62ec3098bca86af799147695a0e2b6fb759b3aa" }
+version = "1.16.1"
+source = { registry = "https://pypi.org/simple" }
 dependencies = [
     { name = "grpcio" },
     { name = "httpx", extra = ["http2"] },
@@ -3340,6 +3340,10 @@ dependencies = [
     { name = "pydantic" },
     { name = "urllib3" },
 ]
+sdist = { url = "https://files.pythonhosted.org/packages/d9/68/fec3816a223c0b73b0e0036460be45c61ce2770ffb9197ac371e4f615ddc/qdrant_client-1.16.1.tar.gz", hash = "sha256:676c7c10fd4d4cb2981b8fcb32fd764f5f661b04b7334d024034d07212f971fd", size = 332130, upload-time = "2025-11-25T04:31:54.212Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/60/e2/60a20d04b0595c641516463168909c5bbcc192d3d6eacb637c1677109c6a/qdrant_client-1.16.1-py3-none-any.whl", hash = "sha256:1eefe89f66e8a468ba0de1680e28b441e69825cfb62e8fb2e457c15e24ce5e3b", size = 378481, upload-time = "2025-11-25T04:31:52.629Z" },
+]
 
 [[package]]
 name = "questionary"