{"server":{"$schema":"https://static.modelcontextprotocol.io/schemas/2025-12-11/server.schema.json","name":"io.github.pvliesdonk/paperless-mcp","description":"Paperless-NGX over MCP: search, read, upload and tag documents; manage correspondents and types.","title":"Paperless MCP","repository":{"url":"https://github.com/pvliesdonk/paperless-mcp","source":"github"},"version":"2.1.0","websiteUrl":"https://pvliesdonk.github.io/paperless-mcp/","packages":[{"registryType":"pypi","identifier":"pvliesdonk-paperless-mcp","version":"2.1.0","runtimeHint":"uvx","transport":{"type":"stdio"},"environmentVariables":[{"description":"Persistent-state backend URL shared by every pvl-core subsystem that needs state. `memory://` is in-process and lost on restart; `file:///path` persists on one server; `redis://`, `dynamodb://` and `mongodb://` each need their matching extra. When unset, defaults to `file:///data/state` (the volume family Docker images mount), or to `memory://` (with a warning) on a host where that directory is not usable.","default":"file:///data/state","name":"PAPERLESS_MCP_KV_STORE_URL"},{"description":"Comma-separated explicit tool names this instance exposes; every other tool is hidden from listings and cannot be invoked. Names matching no registered tool are inert. Mutually exclusive with `tools_deny`. Takes effect through `apply_tool_visibility`.","name":"PAPERLESS_MCP_TOOLS_ALLOW"},{"description":"Comma-separated explicit tool names hidden from this instance (absent from listings, cannot be invoked). Names matching no registered tool are inert. Mutually exclusive with `tools_allow`. Takes effect through `apply_tool_visibility`.","name":"PAPERLESS_MCP_TOOLS_DENY"},{"description":"Rename this server instance; defaults to the project name.","name":"PAPERLESS_MCP_SERVER_NAME"},{"description":"Concise routing context that distinguishes this deployment's material or responsibility.","name":"PAPERLESS_MCP_INSTANCE_DESCRIPTION"},{"description":"Deployment-specific behavioral policy added to the generated MCP instructions.","name":"PAPERLESS_MCP_INSTRUCTIONS_EXTRA"},{"description":"Legacy: replaces all generated MCP instructions (deprecated; use _INSTANCE_DESCRIPTION for routing and _INSTRUCTIONS_EXTRA for policy).","name":"PAPERLESS_MCP_INSTRUCTIONS"},{"description":"Log level for FastMCP internals and app loggers (DEBUG / INFO / WARNING / ERROR / CRITICAL). The -v CLI flag overrides to DEBUG.","default":"INFO","choices":["DEBUG","INFO","WARNING","ERROR","CRITICAL"],"name":"FASTMCP_LOG_LEVEL"},{"description":"Rich color output for a terminal; false gives one plain or JSON line per record. Off in the container image and the systemd unit, since neither is a terminal and Rich wraps a structured record at its 80-column fallback.","format":"boolean","default":"true","name":"FASTMCP_ENABLE_RICH_LOGGING"},{"description":"Base URL of the Paperless-NGX REST API, without a trailing slash. The server refuses to start without it.","name":"PAPERLESS_MCP_PAPERLESS_URL"},{"description":"Paperless service-account token used for outbound API requests. The server refuses to start without it.","isSecret":true,"name":"PAPERLESS_MCP_API_TOKEN"},{"description":"Per-request HTTP timeout in seconds.","format":"number","default":"30.0","name":"PAPERLESS_MCP_HTTP_TIMEOUT_SECONDS"},{"description":"Retries for idempotent requests after network errors or 5xx responses.","format":"number","default":"2","name":"PAPERLESS_MCP_HTTP_RETRIES"},{"description":"Default page size for list tools, from 1 through 100.","format":"number","default":"25","name":"PAPERLESS_MCP_DEFAULT_PAGE_SIZE"},{"description":"Public Paperless UI URL for user-visible links; defaults to PAPERLESS_URL.","name":"PAPERLESS_MCP_PAPERLESS_PUBLIC_URL"}]},{"registryType":"oci","identifier":"ghcr.io/pvliesdonk/paperless-mcp:v2.1.0","transport":{"type":"streamable-http","url":"http://localhost:{--port}/mcp"},"packageArguments":[{"description":"Port for the HTTP transport","default":"8000","type":"named","name":"--port"}],"environmentVariables":[{"description":"Public base URL of the deployed server, for example `https://mcp.example.com`. Required for OIDC. Also the fallback source of the MCP Apps domain when `app_domain` is unset.","placeholder":"https://mcp.example.com","name":"PAPERLESS_MCP_BASE_URL"},{"description":"Single shared bearer token; enables bearer auth unless `bearer_tokens_file` is set, which takes precedence.","isSecret":true,"placeholder":"<secret>","name":"PAPERLESS_MCP_BEARER_TOKEN"},{"description":"OIDC discovery document URL, for example `https://auth.example.com/.well-known/openid-configuration`.","placeholder":"https://auth.example.com/.well-known/openid-configuration","name":"PAPERLESS_MCP_OIDC_CONFIG_URL"},{"description":"OIDC client identifier registered with the provider.","placeholder":"mcp-client","name":"PAPERLESS_MCP_OIDC_CLIENT_ID"},{"description":"OIDC client secret registered with the provider.","isSecret":true,"placeholder":"your-client-secret","name":"PAPERLESS_MCP_OIDC_CLIENT_SECRET"},{"description":"Expected `aud` claim; tokens issued for another audience are rejected.","placeholder":"mcp-api","name":"PAPERLESS_MCP_OIDC_AUDIENCE"},{"description":"Scopes a caller must present, space- or comma-separated. Defaults to `openid` in oidc-proxy mode.","default":"openid","name":"PAPERLESS_MCP_OIDC_REQUIRED_SCOPES"},{"description":"Scopes advertised to MCP clients in protected-resource metadata, space- or comma-separated. Overrides the default `openid offline_access`; `oidc_required_scopes` is always added on top. Set this when the registered client is not permitted `offline_access`, or to have clients request extra claim scopes (such as `groups`) without also requiring them in every token.","default":"openid offline_access","name":"PAPERLESS_MCP_OIDC_ADVERTISED_SCOPES"},{"description":"Signing key for issued tokens; used in oidc-proxy mode only. When unset, the key is derived deterministically from `oidc_client_secret`, so tokens survive a restart. Rotating that secret then invalidates every issued token. Set this explicitly to decouple token validity from secret rotation. Generate with `openssl rand -hex 32`.","isSecret":true,"default":"derived","name":"PAPERLESS_MCP_OIDC_JWT_SIGNING_KEY"},{"description":"Validate the access token instead of the id token.","format":"boolean","default":"false","name":"PAPERLESS_MCP_OIDC_VERIFY_ACCESS_TOKEN"},{"description":"Persistent-state backend URL shared by every pvl-core subsystem that needs state. `memory://` is in-process and lost on restart; `file:///path` persists on one server; `redis://`, `dynamodb://` and `mongodb://` each need their matching extra. When unset, defaults to `file:///data/state` (the volume family Docker images mount), or to `memory://` (with a warning) on a host where that directory is not usable.","default":"file:///data/state","name":"PAPERLESS_MCP_KV_STORE_URL"},{"description":"MCP Apps iframe domain, used for CSP sandboxing. Overrides the host derived from `base_url`.","name":"PAPERLESS_MCP_APP_DOMAIN"},{"description":"Comma-separated explicit tool names this instance exposes; every other tool is hidden from listings and cannot be invoked. Names matching no registered tool are inert. Mutually exclusive with `tools_deny`. Takes effect through `apply_tool_visibility`.","name":"PAPERLESS_MCP_TOOLS_ALLOW"},{"description":"Comma-separated explicit tool names hidden from this instance (absent from listings, cannot be invoked). Names matching no registered tool are inert. Mutually exclusive with `tools_allow`. Takes effect through `apply_tool_visibility`.","name":"PAPERLESS_MCP_TOOLS_DENY"},{"description":"Explicit auth-mode override, accepting `remote` or `oidc-proxy` (case- and whitespace-insensitive). When unset the mode is auto-detected from which auth variables are set; the override exists because having all four OIDC variables set is ambiguous between those two modes. Other values are ignored with a warning.","name":"PAPERLESS_MCP_AUTH_MODE"},{"description":"Path to a TOML file mapping bearer tokens to subjects; overrides the single-token `bearer_token` mode.","format":"filepath","placeholder":"/etc/paperless-mcp/tokens.toml","name":"PAPERLESS_MCP_BEARER_TOKENS_FILE"},{"description":"Subject assigned to the single-token bearer mode; ignored when `bearer_tokens_file` is set, since mapped mode carries per-token subjects.","default":"bearer-anon","name":"PAPERLESS_MCP_BEARER_DEFAULT_SUBJECT"},{"description":"Rename this server instance; defaults to the project name.","name":"PAPERLESS_MCP_SERVER_NAME"},{"description":"Concise routing context that distinguishes this deployment's material or responsibility.","name":"PAPERLESS_MCP_INSTANCE_DESCRIPTION"},{"description":"Deployment-specific behavioral policy added to the generated MCP instructions.","name":"PAPERLESS_MCP_INSTRUCTIONS_EXTRA"},{"description":"Legacy: replaces all generated MCP instructions (deprecated; use _INSTANCE_DESCRIPTION for routing and _INSTRUCTIONS_EXTRA for policy).","name":"PAPERLESS_MCP_INSTRUCTIONS"},{"description":"Mount path for the MCP endpoint; the health routes derive their prefix from it.","default":"/mcp","name":"PAPERLESS_MCP_HTTP_PATH"},{"description":"How much the unauthenticated /health and /health/ready bodies say: status, standard (adds name, version and per-check verdicts), or full (adds redacted reasons; trusted networks only).","default":"standard","choices":["status","standard","full"],"name":"PAPERLESS_MCP_HEALTH_DETAIL"},{"description":"Run the server process as this UID; the container entrypoint reassigns ownership of writable paths to match.","format":"number","default":"1000","name":"PUID"},{"description":"Run the server process as this GID; pair with PUID to match the owner of a mounted volume.","format":"number","default":"1000","name":"PGID"},{"description":"Log level for FastMCP internals and app loggers (DEBUG / INFO / WARNING / ERROR / CRITICAL). The -v CLI flag overrides to DEBUG.","default":"INFO","choices":["DEBUG","INFO","WARNING","ERROR","CRITICAL"],"name":"FASTMCP_LOG_LEVEL"},{"description":"Rich color output for a terminal; false gives one plain or JSON line per record. Off in the container image and the systemd unit, since neither is a terminal and Rich wraps a structured record at its 80-column fallback.","format":"boolean","default":"true","name":"FASTMCP_ENABLE_RICH_LOGGING"},{"description":"Base URL of the Paperless-NGX REST API, without a trailing slash. The server refuses to start without it.","name":"PAPERLESS_MCP_PAPERLESS_URL"},{"description":"Paperless service-account token used for outbound API requests. The server refuses to start without it.","isSecret":true,"name":"PAPERLESS_MCP_API_TOKEN"},{"description":"Per-request HTTP timeout in seconds.","format":"number","default":"30.0","name":"PAPERLESS_MCP_HTTP_TIMEOUT_SECONDS"},{"description":"Retries for idempotent requests after network errors or 5xx responses.","format":"number","default":"2","name":"PAPERLESS_MCP_HTTP_RETRIES"},{"description":"Default page size for list tools, from 1 through 100.","format":"number","default":"25","name":"PAPERLESS_MCP_DEFAULT_PAGE_SIZE"},{"description":"Public Paperless UI URL for user-visible links; defaults to PAPERLESS_URL.","name":"PAPERLESS_MCP_PAPERLESS_PUBLIC_URL"}]}]},"_meta":{"io.modelcontextprotocol.registry/official":{"status":"active","statusChangedAt":"2026-09-19T18:55:36.904748Z","publishedAt":"2026-09-19T18:55:36.904748Z","updatedAt":"2026-09-19T18:55:36.904748Z","isLatest":true}}}