Chris Coutinho 4a5766b84e feat(config): enable DCR for multi-user BasicAuth with offline access
Allows multi-user BasicAuth mode to use Dynamic Client Registration (DCR)
for OAuth credentials when ENABLE_OFFLINE_ACCESS is enabled, making it
consistent with OAuth modes and reducing configuration burden.

**Changes:**

Configuration Validation:
- Relaxed OAuth credential requirements for multi-user BasicAuth
- OAuth credentials now optional when offline access enabled
- Will use DCR as fallback if NEXTCLOUD_OIDC_CLIENT_ID/SECRET not set
- Updated validation to log info instead of error when DCR will be used

Startup Logic (app.py):
- Added DCR workflow for multi-user BasicAuth before uvicorn starts
- Creates oauth_context for management APIs when offline access enabled
- Allows Astrolabe to authenticate management API calls with OAuth
- DCR runs synchronously at same lifecycle point as OAuth modes
- Added traceback import for better error logging
- Fixed type assertions for nextcloud_host
- Fixed undefined variable references in vector sync logging

Management API:
- Improved auth mode detection using proper detect_auth_mode()
- Added auth_mode field to /status endpoint:
  * "basic" - Single-user BasicAuth
  * "multi_user_basic" - Multi-user BasicAuth
  * "oauth" - OAuth modes
  * "smithery" - Smithery stateless
- Added supports_app_passwords indicator for multi-user BasicAuth

Docker Compose:
- Updated mcp-multi-user-basic service configuration:
  * Enabled vector sync (VECTOR_SYNC_ENABLED=true)
  * Added ENABLE_OFFLINE_ACCESS=true for app password support
  * Added NEXTCLOUD_MCP_SERVER_URL for Astrolabe integration
  * Documented optional static OAuth credentials

Testing:
- Updated test_config_validators.py to expect DCR fallback
- Enhanced configure_astrolabe_for_mcp_server fixture with verification
- Added debug logging to test_users_setup fixture

**Workflow:**
1. User configures ENABLE_OFFLINE_ACCESS=true
2. Server checks for static NEXTCLOUD_OIDC_CLIENT_ID/SECRET
3. If not found, performs DCR before uvicorn starts
4. DCR registers client with Nextcloud OIDC provider
5. OAuth credentials used for Astrolabe management API auth
6. Background sync can retrieve user app passwords via Astrolabe

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
2025-12-22 19:43:24 +01:00
2025-11-19 23:44:23 +01:00
2025-12-20 20:42:29 +00:00
2025-11-23 16:12:37 +01:00
2025-05-05 03:11:16 +02:00
2025-12-20 20:42:29 +00:00
2025-12-20 20:42:29 +00:00

Nextcloud MCP Server

Nextcloud MCP Server

Docker Image smithery badge

A production-ready MCP server that connects AI assistants to your Nextcloud instance.

Enable Large Language Models like Claude, GPT, and Gemini to interact with your Nextcloud data through a secure API. Create notes, manage calendars, organize contacts, work with files, and more - all through natural language conversations.

This is a dedicated standalone MCP server designed for external MCP clients like Claude Code and IDEs. It runs independently of Nextcloud (Docker, VM, Kubernetes, or local) and provides deep CRUD operations across Nextcloud apps.

Note

Looking for AI features inside Nextcloud? Nextcloud also provides Context Agent, which powers the Assistant app and runs as an ExApp inside Nextcloud. See docs/comparison-context-agent.md for a detailed comparison of use cases.

Quick Start

The fastest way to get started is via Smithery - no Docker or self-hosting required:

  1. Visit the Smithery marketplace page
  2. Click "Deploy" and configure:
    • Nextcloud URL: Your Nextcloud instance (e.g., https://cloud.example.com)
    • Username: Your Nextcloud username
    • App Password: Generate one in Nextcloud → Settings → Security → Devices & sessions

Note

Smithery runs in stateless mode without semantic search. For full features, use Docker or see ADR-016.

Docker (Self-Hosted)

For full features including semantic search, run with Docker:

# 1. Create a minimal configuration
cat > .env << EOF
NEXTCLOUD_HOST=https://your.nextcloud.instance.com
NEXTCLOUD_USERNAME=your_username
NEXTCLOUD_PASSWORD=your_app_password
EOF

# 2. Start the server
docker run -p 127.0.0.1:8000:8000 --env-file .env --rm \
  ghcr.io/cbcoutinho/nextcloud-mcp-server:latest

# 3. Test the connection
curl http://127.0.0.1:8000/health/ready

# 4. Connect to the endpoint
http://127.0.0.1:8000/sse

# Or with --transport streamable-http
http://127.0.0.1:8000/mcp

Next Steps:

  • Connect your MCP client (Claude Desktop, IDEs, mcp dev, etc.)
  • See docs/installation.md for other deployment options (local, Kubernetes)

Key Features

  • 90+ MCP Tools - Comprehensive API coverage across 8 Nextcloud apps
  • MCP Resources - Structured data URIs for browsing Nextcloud data
  • Semantic Search (Experimental) - Optional vector-powered search for Notes, Files, News items, and Deck cards (requires Qdrant + Ollama)
  • Document Processing - OCR and text extraction from PDFs, DOCX, images with progress notifications
  • Flexible Deployment - Docker, Kubernetes (Helm), VM, or local installation
  • Production-Ready Auth - Basic Auth with app passwords (recommended) or OAuth2/OIDC (experimental)
  • Multiple Transports - SSE, HTTP, and streamable-http support

Supported Apps

App Tools Capabilities
Notes 7 Full CRUD, keyword search, semantic search
Calendar 20+ Events, todos (tasks), recurring events, attendees, availability
Contacts 8 Full CardDAV support, address books
Files (WebDAV) 12 Filesystem access, OCR/document processing
Deck 15 Boards, stacks, cards, labels, assignments
Cookbook 13 Recipe management, URL import (schema.org)
Tables 5 Row operations on Nextcloud Tables
Sharing 10+ Create and manage shares
Semantic Search 2+ Vector search for Notes, Files, News items, and Deck cards (experimental, opt-in, requires infrastructure)

Want to see another Nextcloud app supported? Open an issue or contribute a pull request!

Authentication

Important

OAuth2/OIDC is experimental and requires a manual patch to the user_oidc app:

  • Required patch: Bearer token support (issue #1221)
  • Impact: Without the patch, most app-specific APIs fail with 401 errors
  • Recommendation: Use Basic Auth for production until upstream patches are merged

See docs/oauth-upstream-status.md for patch status and workarounds.

Recommended: Basic Auth with app-specific passwords provides secure, production-ready authentication. See docs/authentication.md for setup details and OAuth configuration.

Authentication Modes

The server supports two authentication modes:

Single-User Mode (BasicAuth):

  • One set of credentials shared by all MCP clients
  • Simple setup: username + app password in environment variables
  • All clients access Nextcloud as the same user
  • Best for: Personal use, development, single-user deployments

Multi-User Mode (OAuth):

  • Each MCP client authenticates separately with their own Nextcloud account
  • Per-user scopes and permissions (clients only see tools they're authorized for)
  • More secure: tokens expire, credentials never shared with server
  • Best for: Teams, multi-user deployments, production environments with multiple users

See docs/authentication.md for detailed setup instructions.

The server provides an experimental RAG pipeline to enable Semantic Search that enables MCP clients to find information in Nextcloud based on meaning rather than just keywords. Instead of matching "machine learning" only when those exact words appear, it understands that "neural networks," "AI models," and "deep learning" are semantically related concepts.

Example:

  • Keyword search: Query "car" only finds notes containing "car"
  • Semantic search: Query "car" also finds notes about "automobile," "vehicle," "sedan," "transportation"

This enables natural language queries and helps discover related content across your Nextcloud notes.

Note

Semantic Search is experimental and opt-in:

  • Disabled by default (ENABLE_SEMANTIC_SEARCH=false)
  • Currently supports Notes app only (multi-app support planned)
  • Requires additional infrastructure: vector database + embedding service
  • Answer generation (nc_semantic_search_answer) requires MCP client sampling support

See docs/semantic-search-architecture.md for architecture details and docs/configuration.md for setup instructions.

Documentation

Getting Started

Features

Advanced Topics

Examples

Create a Note

AI: "Create a note called 'Meeting Notes' with today's agenda"
→ Uses nc_notes_create_note tool

Import Recipes

AI: "Import the recipe from https://www.example.com/recipe/chocolate-cake"
→ Uses nc_cookbook_import_recipe tool with schema.org metadata extraction

Schedule Meetings

AI: "Schedule a team meeting for next Tuesday at 2pm"
→ Uses nc_calendar_create_event tool

Manage Files

AI: "Create a folder called 'Project X' and move all PDFs there"
→ Uses nc_webdav_create_directory and nc_webdav_move tools

Semantic Search (Experimental, Opt-in)

AI: "Find notes related to machine learning concepts"
→ Uses nc_semantic_search to find semantically similar notes (requires Qdrant + Ollama setup)

Note: For AI-generated answers with citations, use nc_semantic_search_answer (requires MCP client with sampling support).

Contributing

Contributions are welcome!

Security

MseeP.ai Security Assessment

This project takes security seriously:

  • Production-ready Basic Auth with app-specific passwords
  • OAuth2/OIDC support (experimental, requires upstream patches)
  • Per-user access tokens
  • No credential storage in OAuth mode
  • Regular security assessments

Found a security issue? Please report it privately to the maintainers.

License

This project is licensed under the AGPL-3.0 License. See LICENSE for details.

Star History

Star History Chart

References

S
Description
Fork of cbcoutinho/nextcloud-mcp-server - Nextcloud MCP Server
Readme AGPL-3.0 12 MiB
Languages
Python 95.9%
HTML 2.7%
Shell 0.7%
JavaScript 0.3%
Smarty 0.2%
Other 0.2%