---
bezeichner: "io.github.pvliesdonk/paperless-mcp"
art: "mcp_server"
slug: "io-github-pvliesdonk-paperless-mcp"
paketkoordinate: "pypi:pvliesdonk-paperless-mcp"
status: "aktiv"
homepage: "https://pvliesdonk.github.io/paperless-mcp/"
erhebungsstand: "2026-10-10T01:17:01.464Z"
namensraum: "io.github.pvliesdonk"
registerseite: "https://tracevero.de/mcp/io-github-pvliesdonk-paperless-mcp"
abgerufen_am: "2026-10-10"
zugangsdaten_erforderlich: false
ausfuehrungsort: "lokal"
dateisystem_pfadargument: true
quelloffen_einsehbar: true
einsatzgebiet: "dokument"
roh_beschreibung: "Paperless-NGX over MCP: search, read, upload and tag documents; manage correspondents and types."
version: "3.0.0"
roh_umgebungsvariablen: "PAPERLESS_MCP_KV_STORE_URL, PAPERLESS_MCP_TOOLS_ALLOW, PAPERLESS_MCP_TOOLS_DENY, PAPERLESS_MCP_SERVER_NAME, PAPERLESS_MCP_INSTANCE_DESCRIPTION, PAPERLESS_MCP_INSTRUCTIONS_EXTRA, PAPERLESS_MCP_INSTRUCTIONS, PAPERLESS_MCP_LOG_LEVEL, PAPERLESS_MCP_LOG_FORMAT, PAPERLESS_MCP_PAPERLESS_URL, PAPERLESS_MCP_API_TOKEN, PAPERLESS_MCP_HTTP_TIMEOUT_SECONDS, PAPERLESS_MCP_HTTP_RETRIES, PAPERLESS_MCP_DEFAULT_PAGE_SIZE, PAPERLESS_MCP_PAPERLESS_PUBLIC_URL, PAPERLESS_MCP_TRANSFER_TTL_DEFAULT_S, PAPERLESS_MCP_TRANSFER_TTL_MAX_S, PAPERLESS_MCP_TRANSFER_GRACE_TTL_S, PAPERLESS_MCP_TRANSFER_LEASE_S, PAPERLESS_MCP_TRANSFER_MAX_UPLOAD_BYTES, PAPERLESS_MCP_SHUTDOWN_GRACE_S, PAPERLESS_MCP_BASE_URL, PAPERLESS_MCP_BEARER_TOKEN, PAPERLESS_MCP_OIDC_CONFIG_URL, PAPERLESS_MCP_OIDC_CLIENT_ID, PAPERLESS_MCP_OIDC_CLIENT_SECRET, PAPERLESS_MCP_OIDC_AUDIENCE, PAPERLESS_MCP_OIDC_REQUIRED_SCOPES, PAPERLESS_MCP_OIDC_ADVERTISED_SCOPES, PAPERLESS_MCP_OIDC_JWT_SIGNING_KEY, PAPERLESS_MCP_OIDC_VERIFY_ACCESS_TOKEN, PAPERLESS_MCP_KV_STORE_URL, PAPERLESS_MCP_APP_DOMAIN, PAPERLESS_MCP_TOOLS_ALLOW, PAPERLESS_MCP_TOOLS_DENY, PAPERLESS_MCP_AUTH_MODE, PAPERLESS_MCP_BEARER_TOKENS_FILE, PAPERLESS_MCP_BEARER_DEFAULT_SUBJECT, PAPERLESS_MCP_SERVER_NAME, PAPERLESS_MCP_INSTANCE_DESCRIPTION, PAPERLESS_MCP_INSTRUCTIONS_EXTRA, PAPERLESS_MCP_INSTRUCTIONS, PAPERLESS_MCP_HTTP_PATH, PAPERLESS_MCP_HEALTH_DETAIL, PUID, PGID, PAPERLESS_MCP_LOG_LEVEL, PAPERLESS_MCP_LOG_FORMAT, PAPERLESS_MCP_PAPERLESS_URL, PAPERLESS_MCP_API_TOKEN, PAPERLESS_MCP_HTTP_TIMEOUT_SECONDS, PAPERLESS_MCP_HTTP_RETRIES, PAPERLESS_MCP_DEFAULT_PAGE_SIZE, PAPERLESS_MCP_PAPERLESS_PUBLIC_URL, PAPERLESS_MCP_TRANSFER_TTL_DEFAULT_S, PAPERLESS_MCP_TRANSFER_TTL_MAX_S, PAPERLESS_MCP_TRANSFER_GRACE_TTL_S, PAPERLESS_MCP_TRANSFER_LEASE_S, PAPERLESS_MCP_TRANSFER_MAX_UPLOAD_BYTES"
roh_geheime_pflichtvariablen: ""
roh_transportarten: "stdio, streamable-http"
roh_pfadargumente: ""
roh_repository_url: "https://github.com/pvliesdonk/paperless-mcp"
roh_paketquellen: "oci, pypi"
roh_geheime_pflichtkopfzeilen: ""
roh_pfad_umgebungsvariablen: "PAPERLESS_MCP_BEARER_TOKENS_FILE"
roh_remote_adressen: ""
roh_remote_hosts: ""
roh_statusmeldung: ""
roh_veroeffentlicht_am: "2026-09-21"
roh_aktualisiert_am: "2026-09-21"
roh_schemafassung: "https://static.modelcontextprotocol.io/schemas/2025-12-11/server.schema.json"
roh_bereitstellungsform: "paket"
roh_repository_quelle: "github"
roh_repository_unterordner: ""
roh_paketbezeichner: "ghcr.io/pvliesdonk/paperless-mcp:v3.0.0, pvliesdonk-paperless-mcp"
roh_paketversionen: "3.0.0"
roh_laufzeithinweise: "uvx"
roh_umgebungsformate: "boolean, filepath, number"
roh_umgebungsbeschreibungen: "PAPERLESS_MCP_API_TOKEN=Paperless service-account token used for outbound API requests. The server refuses to start without it. · PAPERLESS_MCP_APP_DOMAIN=MCP Apps iframe domain, used for CSP sandboxing. Overrides the host derived from `base_url`. · PAPERLESS_MCP_AUTH_MODE=Explicit auth-mode override, accepting `remote` or `oidc-proxy` (case- and whitespace-insensitive). When unset the mode is auto-detected from which auth variables are set; the override exists because having all four OIDC variables set is ambiguous between those two modes. Other values are ignored with a warning. · PAPERLESS_MCP_BASE_URL=Public base URL of the deployed server, for example `https://mcp.example.com`. Required for OIDC. Also the fallback source of the MCP Apps domain when `app_domain` is unset. · PAPERLESS_MCP_BEARER_DEFAULT_SUBJECT=Subject assigned to the single-token bearer mode; ignored when `bearer_tokens_file` is set, since mapped mode carries per-token subjects. · PAPERLESS_MCP_BEARER_TOKEN=Single shared bearer token; enables bearer auth unless `bearer_tokens_file` is set, which takes precedence. · PAPERLESS_MCP_BEARER_TOKENS_FILE=Path to a TOML file mapping bearer tokens to subjects; overrides the single-token `bearer_token` mode. · PAPERLESS_MCP_DEFAULT_PAGE_SIZE=Default page size for list tools, from 1 through 100. · PAPERLESS_MCP_HEALTH_DETAIL=How much the unauthenticated /health and /health/ready bodies say: status, standard (adds name, version and per-check verdicts), or full (adds redacted reasons; trusted networks only). · PAPERLESS_MCP_HTTP_PATH=Mount path for the MCP endpoint; the health routes derive their prefix from it. · PAPERLESS_MCP_HTTP_RETRIES=Retries for idempotent requests after network errors or 5xx responses. · PAPERLESS_MCP_HTTP_TIMEOUT_SECONDS=Per-request HTTP timeout in seconds. · PAPERLESS_MCP_INSTANCE_DESCRIPTION=Concise routing context that distinguishes this deployment's material or responsibility. · PAPERLESS_MCP_INSTRUCTIONS=Legacy: replaces all generated MCP instructions (deprecated; use _INSTANCE_DESCRIPTION for routing and _INSTRUCTIONS_EXTRA for policy). · PAPERLESS_MCP_INSTRUCTIONS_EXTRA=Deployment-specific behavioral policy added to the generated MCP instructions. · PAPERLESS_MCP_KV_STORE_URL=Persistent-state backend URL shared by every pvl-core subsystem that needs state. `memory://` is in-process and lost on restart; `file:///path` persists on one server; `redis://`, `dynamodb://` and `mongodb://` each need their matching extra. When unset, defaults to `file:///data/state` (the volume family Docker images mount), or to `memory://` (with a warning) on a host where that directory is not usable. · PAPERLESS_MCP_LOG_FORMAT=Log rendering. rich is one colour event key=value line per record, for a terminal; json is one JSON object per record, for a collector. Unset picks rich when stderr is a terminal and json everywhere else, so a container or journald gets JSON with no configuration. · PAPERLESS_MCP_LOG_LEVEL=Log level for every logger in the process, FastMCP's included (DEBUG / INFO / WARNING / ERROR / CRITICAL). The -v CLI flag overrides to DEBUG. The unprefixed FASTMCP_LOG_LEVEL still works for one major version and logs a deprecation warning. · PAPERLESS_MCP_OIDC_ADVERTISED_SCOPES=Scopes advertised to MCP clients in protected-resource metadata, space- or comma-separated. Overrides the default `openid offline_access`; `oidc_required_scopes` is always added on top. Set this when the registered client is not permitted `offline_access`, or to have clients request extra claim scopes (such as `groups`) without also requiring them in every token. · PAPERLESS_MCP_OIDC_AUDIENCE=Expected `aud` claim; tokens issued for another audience are rejected. · PAPERLESS_MCP_OIDC_CLIENT_ID=OIDC client identifier registered with the provider. · PAPERLESS_MCP_OIDC_CLIENT_SECRET=OIDC client secret registered with the provider. · PAPERLESS_MCP_OIDC_CONFIG_URL=OIDC discovery document URL, for example `https://auth.example.com/.well-known/openid-configuration`. · PAPERLESS_MCP_OIDC_JWT_SIGNING_KEY=Signing key for issued tokens; used in oidc-proxy mode only. When unset, the key is derived deterministically from `oidc_client_secret`, so tokens survive a restart. Rotating that secret then invalidates every issued token. Set this explicitly to decouple token validity from secret rotation. Generate with `openssl rand -hex 32`. · PAPERLESS_MCP_OIDC_REQUIRED_SCOPES=Scopes a caller must present, space- or comma-separated. Defaults to `openid` in oidc-proxy mode. · PAPERLESS_MCP_OIDC_VERIFY_ACCESS_TOKEN=Validate the access token instead of the id token. · PAPERLESS_MCP_PAPERLESS_PUBLIC_URL=Public Paperless UI URL for user-visible links; defaults to PAPERLESS_URL. · PAPERLESS_MCP_PAPERLESS_URL=Base URL of the Paperless-NGX REST API, without a trailing slash. The server refuses to start without it. · PAPERLESS_MCP_SERVER_NAME=Rename this server instance; defaults to the project name. · PAPERLESS_MCP_SHUTDOWN_GRACE_S=Seconds SIGTERM may spend draining in-flight requests before the HTTP server exits. Keep it at or below the termination grace period the orchestrator allows. `0` drops in-flight requests immediately. · PAPERLESS_MCP_TOOLS_ALLOW=Comma-separated explicit tool names this instance exposes; every other tool is hidden from listings and cannot be invoked. Names matching no registered tool are inert. Mutually exclusive with `tools_deny`. Takes effect through `apply_tool_visibility`. · PAPERLESS_MCP_TOOLS_DENY=Comma-separated explicit tool names hidden from this instance (absent from listings, cannot be invoked). Names matching no registered tool are inert. Mutually exclusive with `tools_allow`. Takes effect through `apply_tool_visibility`. · PAPERLESS_MCP_TRANSFER_GRACE_TTL_S=Post-success grace window in seconds: a served token's TTL shrinks to this so a stalled transfer can retry within it. · PAPERLESS_MCP_TRANSFER_LEASE_S=Crashed-handler reclaim window in seconds for an in-flight reservation. · PAPERLESS_MCP_TRANSFER_MAX_UPLOAD_BYTES=Maximum size in bytes of a single upload. · PAPERLESS_MCP_TRANSFER_TTL_DEFAULT_S=Link lifetime in seconds when the caller requests no explicit TTL. · PAPERLESS_MCP_TRANSFER_TTL_MAX_S=Ceiling in seconds a caller-requested link TTL is clamped to. · PGID=Run the server process as this GID; pair with PUID to match the owner of a mounted volume. · PUID=Run the server process as this UID; the container entrypoint reassigns ownership of writable paths to match."
roh_symbolformate: ""
roh_verbindungswege: "{\"packages\":[{\"registryType\":\"pypi\",\"identifier\":\"pvliesdonk-paperless-mcp\",\"version\":\"3.0.0\",\"runtimeHint\":\"uvx\",\"transport\":\"stdio\",\"environment\":[{\"name\":\"PAPERLESS_MCP_KV_STORE_URL\",\"description\":\"Persistent-state backend URL shared by every pvl-core subsystem that needs state. `memory://` is in-process and lost on restart; `file:///path` persists on one server; `redis://`, `dynamodb://` and `mongodb://` each need their matching extra. When unset, defaults to `file:///data/state` (the volume family Docker images mount), or to `memory://` (with a warning) on a host where that directory is not usable.\",\"required\":false,\"secret\":false},{\"name\":\"PAPERLESS_MCP_TOOLS_ALLOW\",\"description\":\"Comma-separated explicit tool names this instance exposes; every other tool is hidden from listings and cannot be invoked. Names matching no registered tool are inert. Mutually exclusive with `tools_deny`. Takes effect through `apply_tool_visibility`.\",\"required\":false,\"secret\":false},{\"name\":\"PAPERLESS_MCP_TOOLS_DENY\",\"description\":\"Comma-separated explicit tool names hidden from this instance (absent from listings, cannot be invoked). Names matching no registered tool are inert. Mutually exclusive with `tools_allow`. Takes effect through `apply_tool_visibility`.\",\"required\":false,\"secret\":false},{\"name\":\"PAPERLESS_MCP_SERVER_NAME\",\"description\":\"Rename this server instance; defaults to the project name.\",\"required\":false,\"secret\":false},{\"name\":\"PAPERLESS_MCP_INSTANCE_DESCRIPTION\",\"description\":\"Concise routing context that distinguishes this deployment's material or responsibility.\",\"required\":false,\"secret\":false},{\"name\":\"PAPERLESS_MCP_INSTRUCTIONS_EXTRA\",\"description\":\"Deployment-specific behavioral policy added to the generated MCP instructions.\",\"required\":false,\"secret\":false},{\"name\":\"PAPERLESS_MCP_INSTRUCTIONS\",\"description\":\"Legacy: replaces all generated MCP instructions (deprecated; use _INSTANCE_DESCRIPTION for routing and _INSTRUCTIONS_EXTRA for policy).\",\"required\":false,\"secret\":false},{\"name\":\"PAPERLESS_MCP_LOG_LEVEL\",\"description\":\"Log level for every logger in the process, FastMCP's included (DEBUG / INFO / WARNING / ERROR / CRITICAL). The -v CLI flag overrides to DEBUG. The unprefixed FASTMCP_LOG_LEVEL still works for one major version and logs a deprecation warning.\",\"required\":false,\"secret\":false},{\"name\":\"PAPERLESS_MCP_LOG_FORMAT\",\"description\":\"Log rendering. rich is one colour event key=value line per record, for a terminal; json is one JSON object per record, for a collector. Unset picks rich when stderr is a terminal and json everywhere else, so a container or journald gets JSON with no configuration.\",\"required\":false,\"secret\":false},{\"name\":\"PAPERLESS_MCP_PAPERLESS_URL\",\"description\":\"Base URL of the Paperless-NGX REST API, without a trailing slash. The server refuses to start without it.\",\"required\":false,\"secret\":false},{\"name\":\"PAPERLESS_MCP_API_TOKEN\",\"description\":\"Paperless service-account token used for outbound API requests. The server refuses to start without it.\",\"required\":false,\"secret\":true},{\"name\":\"PAPERLESS_MCP_HTTP_TIMEOUT_SECONDS\",\"description\":\"Per-request HTTP timeout in seconds.\",\"format\":\"number\",\"required\":false,\"secret\":false},{\"name\":\"PAPERLESS_MCP_HTTP_RETRIES\",\"description\":\"Retries for idempotent requests after network errors or 5xx responses.\",\"format\":\"number\",\"required\":false,\"secret\":false},{\"name\":\"PAPERLESS_MCP_DEFAULT_PAGE_SIZE\",\"description\":\"Default page size for list tools, from 1 through 100.\",\"format\":\"number\",\"required\":false,\"secret\":false},{\"name\":\"PAPERLESS_MCP_PAPERLESS_PUBLIC_URL\",\"description\":\"Public Paperless UI URL for user-visible links; defaults to PAPERLESS_URL.\",\"required\":false,\"secret\":false},{\"name\":\"PAPERLESS_MCP_TRANSFER_TTL_DEFAULT_S\",\"description\":\"Link lifetime in seconds when the caller requests no explicit TTL.\",\"format\":\"number\",\"required\":false,\"secret\":false},{\"name\":\"PAPERLESS_MCP_TRANSFER_TTL_MAX_S\",\"description\":\"Ceiling in seconds a caller-requested link TTL is clamped to.\",\"format\":\"number\",\"required\":false,\"secret\":false},{\"name\":\"PAPERLESS_MCP_TRANSFER_GRACE_TTL_S\",\"description\":\"Post-success grace window in seconds: a served token's TTL shrinks to this so a stalled transfer can retry within it.\",\"format\":\"number\",\"required\":false,\"secret\":false},{\"name\":\"PAPERLESS_MCP_TRANSFER_LEASE_S\",\"description\":\"Crashed-handler reclaim window in seconds for an in-flight reservation.\",\"format\":\"number\",\"required\":false,\"secret\":false},{\"name\":\"PAPERLESS_MCP_TRANSFER_MAX_UPLOAD_BYTES\",\"description\":\"Maximum size in bytes of a single upload.\",\"format\":\"number\",\"required\":false,\"secret\":false}],\"additional_arguments_declared\":false},{\"registryType\":\"oci\",\"identifier\":\"ghcr.io/pvliesdonk/paperless-mcp:v3.0.0\",\"transport\":\"streamable-http\",\"environment\":[{\"name\":\"PAPERLESS_MCP_SHUTDOWN_GRACE_S\",\"description\":\"Seconds SIGTERM may spend draining in-flight requests before the HTTP server exits. Keep it at or below the termination grace period the orchestrator allows. `0` drops in-flight requests immediately.\",\"format\":\"number\",\"required\":false,\"secret\":false},{\"name\":\"PAPERLESS_MCP_BASE_URL\",\"description\":\"Public base URL of the deployed server, for example `https://mcp.example.com`. Required for OIDC. Also the fallback source of the MCP Apps domain when `app_domain` is unset.\",\"required\":false,\"secret\":false},{\"name\":\"PAPERLESS_MCP_BEARER_TOKEN\",\"description\":\"Single shared bearer token; enables bearer auth unless `bearer_tokens_file` is set, which takes precedence.\",\"required\":false,\"secret\":true},{\"name\":\"PAPERLESS_MCP_OIDC_CONFIG_URL\",\"description\":\"OIDC discovery document URL, for example `https://auth.example.com/.well-known/openid-configuration`.\",\"required\":false,\"secret\":false},{\"name\":\"PAPERLESS_MCP_OIDC_CLIENT_ID\",\"description\":\"OIDC client identifier registered with the provider.\",\"required\":false,\"secret\":false},{\"name\":\"PAPERLESS_MCP_OIDC_CLIENT_SECRET\",\"description\":\"OIDC client secret registered with the provider.\",\"required\":false,\"secret\":true},{\"name\":\"PAPERLESS_MCP_OIDC_AUDIENCE\",\"description\":\"Expected `aud` claim; tokens issued for another audience are rejected.\",\"required\":false,\"secret\":false},{\"name\":\"PAPERLESS_MCP_OIDC_REQUIRED_SCOPES\",\"description\":\"Scopes a caller must present, space- or comma-separated. Defaults to `openid` in oidc-proxy mode.\",\"required\":false,\"secret\":false},{\"name\":\"PAPERLESS_MCP_OIDC_ADVERTISED_SCOPES\",\"description\":\"Scopes advertised to MCP clients in protected-resource metadata, space- or comma-separated. Overrides the default `openid offline_access`; `oidc_required_scopes` is always added on top. Set this when the registered client is not permitted `offline_access`, or to have clients request extra claim scopes (such as `groups`) without also requiring them in every token.\",\"required\":false,\"secret\":false},{\"name\":\"PAPERLESS_MCP_OIDC_JWT_SIGNING_KEY\",\"description\":\"Signing key for issued tokens; used in oidc-proxy mode only. When unset, the key is derived deterministically from `oidc_client_secret`, so tokens survive a restart. Rotating that secret then invalidates every issued token. Set this explicitly to decouple token validity from secret rotation. Generate with `openssl rand -hex 32`.\",\"required\":false,\"secret\":true},{\"name\":\"PAPERLESS_MCP_OIDC_VERIFY_ACCESS_TOKEN\",\"description\":\"Validate the access token instead of the id token.\",\"format\":\"boolean\",\"required\":false,\"secret\":false},{\"name\":\"PAPERLESS_MCP_KV_STORE_URL\",\"description\":\"Persistent-state backend URL shared by every pvl-core subsystem that needs state. `memory://` is in-process and lost on restart; `file:///path` persists on one server; `redis://`, `dynamodb://` and `mongodb://` each need their matching extra. When unset, defaults to `file:///data/state` (the volume family Docker images mount), or to `memory://` (with a warning) on a host where that directory is not usable.\",\"required\":false,\"secret\":false},{\"name\":\"PAPERLESS_MCP_APP_DOMAIN\",\"description\":\"MCP Apps iframe domain, used for CSP sandboxing. Overrides the host derived from `base_url`.\",\"required\":false,\"secret\":false},{\"name\":\"PAPERLESS_MCP_TOOLS_ALLOW\",\"description\":\"Comma-separated explicit tool names this instance exposes; every other tool is hidden from listings and cannot be invoked. Names matching no registered tool are inert. Mutually exclusive with `tools_deny`. Takes effect through `apply_tool_visibility`.\",\"required\":false,\"secret\":false},{\"name\":\"PAPERLESS_MCP_TOOLS_DENY\",\"description\":\"Comma-separated explicit tool names hidden from this instance (absent from listings, cannot be invoked). Names matching no registered tool are inert. Mutually exclusive with `tools_allow`. Takes effect through `apply_tool_visibility`.\",\"required\":false,\"secret\":false},{\"name\":\"PAPERLESS_MCP_AUTH_MODE\",\"description\":\"Explicit auth-mode override, accepting `remote` or `oidc-proxy` (case- and whitespace-insensitive). When unset the mode is auto-detected from which auth variables are set; the override exists because having all four OIDC variables set is ambiguous between those two modes. Other values are ignored with a warning.\",\"required\":false,\"secret\":false},{\"name\":\"PAPERLESS_MCP_BEARER_TOKENS_FILE\",\"description\":\"Path to a TOML file mapping bearer tokens to subjects; overrides the single-token `bearer_token` mode.\",\"format\":\"filepath\",\"required\":false,\"secret\":false},{\"name\":\"PAPERLESS_MCP_BEARER_DEFAULT_SUBJECT\",\"description\":\"Subject assigned to the single-token bearer mode; ignored when `bearer_tokens_file` is set, since mapped mode carries per-token subjects.\",\"required\":false,\"secret\":false},{\"name\":\"PAPERLESS_MCP_SERVER_NAME\",\"description\":\"Rename this server instance; defaults to the project name.\",\"required\":false,\"secret\":false},{\"name\":\"PAPERLESS_MCP_INSTANCE_DESCRIPTION\",\"description\":\"Concise routing context that distinguishes this deployment's material or responsibility.\",\"required\":false,\"secret\":false},{\"name\":\"PAPERLESS_MCP_INSTRUCTIONS_EXTRA\",\"description\":\"Deployment-specific behavioral policy added to the generated MCP instructions.\",\"required\":false,\"secret\":false},{\"name\":\"PAPERLESS_MCP_INSTRUCTIONS\",\"description\":\"Legacy: replaces all generated MCP instructions (deprecated; use _INSTANCE_DESCRIPTION for routing and _INSTRUCTIONS_EXTRA for policy).\",\"required\":false,\"secret\":false},{\"name\":\"PAPERLESS_MCP_HTTP_PATH\",\"description\":\"Mount path for the MCP endpoint; the health routes derive their prefix from it.\",\"required\":false,\"secret\":false},{\"name\":\"PAPERLESS_MCP_HEALTH_DETAIL\",\"description\":\"How much the unauthenticated /health and /health/ready bodies say: status, standard (adds name, version and per-check verdicts), or full (adds redacted reasons; trusted networks only).\",\"required\":false,\"secret\":false},{\"name\":\"PUID\",\"description\":\"Run the server process as this UID; the container entrypoint reassigns ownership of writable paths to match.\",\"format\":\"number\",\"required\":false,\"secret\":false},{\"name\":\"PGID\",\"description\":\"Run the server process as this GID; pair with PUID to match the owner of a mounted volume.\",\"format\":\"number\",\"required\":false,\"secret\":false},{\"name\":\"PAPERLESS_MCP_LOG_LEVEL\",\"description\":\"Log level for every logger in the process, FastMCP's included (DEBUG / INFO / WARNING / ERROR / CRITICAL). The -v CLI flag overrides to DEBUG. The unprefixed FASTMCP_LOG_LEVEL still works for one major version and logs a deprecation warning.\",\"required\":false,\"secret\":false},{\"name\":\"PAPERLESS_MCP_LOG_FORMAT\",\"description\":\"Log rendering. rich is one colour event key=value line per record, for a terminal; json is one JSON object per record, for a collector. Unset picks rich when stderr is a terminal and json everywhere else, so a container or journald gets JSON with no configuration.\",\"required\":false,\"secret\":false},{\"name\":\"PAPERLESS_MCP_PAPERLESS_URL\",\"description\":\"Base URL of the Paperless-NGX REST API, without a trailing slash. The server refuses to start without it.\",\"required\":false,\"secret\":false},{\"name\":\"PAPERLESS_MCP_API_TOKEN\",\"description\":\"Paperless service-account token used for outbound API requests. The server refuses to start without it.\",\"required\":false,\"secret\":true},{\"name\":\"PAPERLESS_MCP_HTTP_TIMEOUT_SECONDS\",\"description\":\"Per-request HTTP timeout in seconds.\",\"format\":\"number\",\"required\":false,\"secret\":false},{\"name\":\"PAPERLESS_MCP_HTTP_RETRIES\",\"description\":\"Retries for idempotent requests after network errors or 5xx responses.\",\"format\":\"number\",\"required\":false,\"secret\":false},{\"name\":\"PAPERLESS_MCP_DEFAULT_PAGE_SIZE\",\"description\":\"Default page size for list tools, from 1 through 100.\",\"format\":\"number\",\"required\":false,\"secret\":false},{\"name\":\"PAPERLESS_MCP_PAPERLESS_PUBLIC_URL\",\"description\":\"Public Paperless UI URL for user-visible links; defaults to PAPERLESS_URL.\",\"required\":false,\"secret\":false},{\"name\":\"PAPERLESS_MCP_TRANSFER_TTL_DEFAULT_S\",\"description\":\"Link lifetime in seconds when the caller requests no explicit TTL.\",\"format\":\"number\",\"required\":false,\"secret\":false},{\"name\":\"PAPERLESS_MCP_TRANSFER_TTL_MAX_S\",\"description\":\"Ceiling in seconds a caller-requested link TTL is clamped to.\",\"format\":\"number\",\"required\":false,\"secret\":false},{\"name\":\"PAPERLESS_MCP_TRANSFER_GRACE_TTL_S\",\"description\":\"Post-success grace window in seconds: a served token's TTL shrinks to this so a stalled transfer can retry within it.\",\"format\":\"number\",\"required\":false,\"secret\":false},{\"name\":\"PAPERLESS_MCP_TRANSFER_LEASE_S\",\"description\":\"Crashed-handler reclaim window in seconds for an in-flight reservation.\",\"format\":\"number\",\"required\":false,\"secret\":false},{\"name\":\"PAPERLESS_MCP_TRANSFER_MAX_UPLOAD_BYTES\",\"description\":\"Maximum size in bytes of a single upload.\",\"format\":\"number\",\"required\":false,\"secret\":false}],\"additional_arguments_declared\":true}],\"remotes\":[]}"
---

# Paperless MCP

## Gemessene Werte

| Merkmal | Wert | Quelle | Erhoben am | Vertrauensgrad | Rohangabe |
| --- | --- | --- | --- | --- | --- |
| Pflicht-Geheimnisse deklariert | false | MCP-Register | 2026-09-18T01:17:01.510Z | abgeleitet | roh_geheime_pflichtvariablen: ; roh_geheime_pflichtkopfzeilen: |
| Ausführungsort | lokal | MCP-Register | 2026-09-18T01:17:01.510Z | abgeleitet | roh_transportarten: stdio, streamable-http |
| Pfadargument vorhanden | true | MCP-Register | 2026-09-18T01:17:01.510Z | abgeleitet | roh_pfadargumente: ; roh_pfad_umgebungsvariablen: PAPERLESS_MCP_BEARER_TOKENS_FILE |
| Repository-Adresse geführt | true | MCP-Register | 2026-09-18T01:17:01.510Z | abgeleitet | roh_repository_url: https://github.com/pvliesdonk/paperless-mcp |
| Einsatzgebiet, aus der Anbieterbeschreibung abgeleitet | dokument | MCP-Register | 2026-09-18T01:17:01.510Z | abgeleitet | roh_beschreibung: Paperless-NGX over MCP: search, read, upload and tag documents; manage correspondents and types. |
| Beschreibung (Rohangabe) | Paperless-NGX over MCP: search, read, upload and tag documents; manage correspondents and types. | MCP-Register | 2026-09-18T01:17:01.510Z | selbstauskunft |  |
| Deklarierte Version | 3.0.0 | MCP-Register | 2026-09-22T01:17:01.638Z | selbstauskunft |  |
| Umgebungsvariablen (Rohangabe) | PAPERLESS_MCP_KV_STORE_URL, PAPERLESS_MCP_TOOLS_ALLOW, PAPERLESS_MCP_TOOLS_DENY, PAPERLESS_MCP_SERVER_NAME, PAPERLESS_MCP_INSTANCE_DESCRIPTION, PAPERLESS_MCP_INSTRUCTIONS_EXTRA, PAPERLESS_MCP_INSTRUCTIONS, PAPERLESS_MCP_LOG_LEVEL, PAPERLESS_MCP_LOG_FORMAT, PAPERLESS_MCP_PAPERLESS_URL, PAPERLESS_MCP_API_TOKEN, PAPERLESS_MCP_HTTP_TIMEOUT_SECONDS, PAPERLESS_MCP_HTTP_RETRIES, PAPERLESS_MCP_DEFAULT_PAGE_SIZE, PAPERLESS_MCP_PAPERLESS_PUBLIC_URL, PAPERLESS_MCP_TRANSFER_TTL_DEFAULT_S, PAPERLESS_MCP_TRANSFER_TTL_MAX_S, PAPERLESS_MCP_TRANSFER_GRACE_TTL_S, PAPERLESS_MCP_TRANSFER_LEASE_S, PAPERLESS_MCP_TRANSFER_MAX_UPLOAD_BYTES, PAPERLESS_MCP_SHUTDOWN_GRACE_S, PAPERLESS_MCP_BASE_URL, PAPERLESS_MCP_BEARER_TOKEN, PAPERLESS_MCP_OIDC_CONFIG_URL, PAPERLESS_MCP_OIDC_CLIENT_ID, PAPERLESS_MCP_OIDC_CLIENT_SECRET, PAPERLESS_MCP_OIDC_AUDIENCE, PAPERLESS_MCP_OIDC_REQUIRED_SCOPES, PAPERLESS_MCP_OIDC_ADVERTISED_SCOPES, PAPERLESS_MCP_OIDC_JWT_SIGNING_KEY, PAPERLESS_MCP_OIDC_VERIFY_ACCESS_TOKEN, PAPERLESS_MCP_KV_STORE_URL, PAPERLESS_MCP_APP_DOMAIN, PAPERLESS_MCP_TOOLS_ALLOW, PAPERLESS_MCP_TOOLS_DENY, PAPERLESS_MCP_AUTH_MODE, PAPERLESS_MCP_BEARER_TOKENS_FILE, PAPERLESS_MCP_BEARER_DEFAULT_SUBJECT, PAPERLESS_MCP_SERVER_NAME, PAPERLESS_MCP_INSTANCE_DESCRIPTION, PAPERLESS_MCP_INSTRUCTIONS_EXTRA, PAPERLESS_MCP_INSTRUCTIONS, PAPERLESS_MCP_HTTP_PATH, PAPERLESS_MCP_HEALTH_DETAIL, PUID, PGID, PAPERLESS_MCP_LOG_LEVEL, PAPERLESS_MCP_LOG_FORMAT, PAPERLESS_MCP_PAPERLESS_URL, PAPERLESS_MCP_API_TOKEN, PAPERLESS_MCP_HTTP_TIMEOUT_SECONDS, PAPERLESS_MCP_HTTP_RETRIES, PAPERLESS_MCP_DEFAULT_PAGE_SIZE, PAPERLESS_MCP_PAPERLESS_PUBLIC_URL, PAPERLESS_MCP_TRANSFER_TTL_DEFAULT_S, PAPERLESS_MCP_TRANSFER_TTL_MAX_S, PAPERLESS_MCP_TRANSFER_GRACE_TTL_S, PAPERLESS_MCP_TRANSFER_LEASE_S, PAPERLESS_MCP_TRANSFER_MAX_UPLOAD_BYTES | MCP-Register | 2026-09-22T01:17:01.638Z | selbstauskunft |  |
| Geheime Pflichtvariablen (Rohangabe) |  | MCP-Register | 2026-09-18T01:17:01.510Z | selbstauskunft |  |
| Transportarten (Rohangabe) | stdio, streamable-http | MCP-Register | 2026-09-18T01:17:01.510Z | selbstauskunft |  |
| Pfadargumente (Rohangabe) |  | MCP-Register | 2026-09-18T01:17:01.510Z | selbstauskunft |  |
| Repository (Rohangabe) | https://github.com/pvliesdonk/paperless-mcp | MCP-Register | 2026-09-18T01:17:01.510Z | selbstauskunft |  |
| Paketquellen (Rohangabe) | oci, pypi | MCP-Register | 2026-09-18T01:17:01.510Z | selbstauskunft |  |
| Geheime Pflichtkopfzeilen (Rohangabe) |  | MCP-Register | 2026-09-18T01:17:01.510Z | selbstauskunft |  |
| Pfad-Umgebungsvariablen (Rohangabe) | PAPERLESS_MCP_BEARER_TOKENS_FILE | MCP-Register | 2026-09-18T01:17:01.510Z | selbstauskunft |  |
| Remote-Adressen (Rohangabe) |  | MCP-Register | 2026-09-18T01:17:01.510Z | selbstauskunft |  |
| Remote-Hosts (Rohangabe) |  | MCP-Register | 2026-09-18T01:17:01.510Z | selbstauskunft |  |
| Statusmeldung des Registers (Rohangabe) |  | MCP-Register | 2026-09-18T01:17:01.510Z | selbstauskunft |  |
| Im Register eingetragen am (Rohangabe) | 2026-09-21 | MCP-Register | 2026-09-22T01:17:01.638Z | selbstauskunft |  |
| Im Register geändert am (Rohangabe) | 2026-09-21 | MCP-Register | 2026-09-22T01:17:01.638Z | selbstauskunft |  |
| Schemafassung des Rohsatzes (Rohangabe) | https://static.modelcontextprotocol.io/schemas/2025-12-11/server.schema.json | MCP-Register | 2026-09-18T01:17:01.510Z | selbstauskunft |  |
| Bereitstellungsform (Rohangabe) | paket | MCP-Register | 2026-09-18T01:17:01.510Z | selbstauskunft |  |
| Repository-Plattform (Rohangabe) | github | MCP-Register | 2026-09-18T01:17:01.510Z | selbstauskunft |  |
| Repository-Unterordner (Rohangabe) |  | MCP-Register | 2026-09-18T01:17:01.510Z | selbstauskunft |  |
| Paketbezeichner (Rohangabe) | ghcr.io/pvliesdonk/paperless-mcp:v3.0.0, pvliesdonk-paperless-mcp | MCP-Register | 2026-09-22T01:17:01.638Z | selbstauskunft |  |
| Paketversionen (Rohangabe) | 3.0.0 | MCP-Register | 2026-09-22T01:17:01.638Z | selbstauskunft |  |
| Laufzeithinweise (Rohangabe) | uvx | MCP-Register | 2026-09-18T01:17:01.510Z | selbstauskunft |  |
| Formate der Umgebungsvariablen (Rohangabe) | boolean, filepath, number | MCP-Register | 2026-09-18T01:17:01.510Z | selbstauskunft |  |
| Beschreibungen der Umgebungsvariablen (Rohangabe) | PAPERLESS_MCP_API_TOKEN=Paperless service-account token used for outbound API requests. The server refuses to start without it. · PAPERLESS_MCP_APP_DOMAIN=MCP Apps iframe domain, used for CSP sandboxing. Overrides the host derived from `base_url`. · PAPERLESS_MCP_AUTH_MODE=Explicit auth-mode override, accepting `remote` or `oidc-proxy` (case- and whitespace-insensitive). When unset the mode is auto-detected from which auth variables are set; the override exists because having all four OIDC variables set is ambiguous between those two modes. Other values are ignored with a warning. · PAPERLESS_MCP_BASE_URL=Public base URL of the deployed server, for example `https://mcp.example.com`. Required for OIDC. Also the fallback source of the MCP Apps domain when `app_domain` is unset. · PAPERLESS_MCP_BEARER_DEFAULT_SUBJECT=Subject assigned to the single-token bearer mode; ignored when `bearer_tokens_file` is set, since mapped mode carries per-token subjects. · PAPERLESS_MCP_BEARER_TOKEN=Single shared bearer token; enables bearer auth unless `bearer_tokens_file` is set, which takes precedence. · PAPERLESS_MCP_BEARER_TOKENS_FILE=Path to a TOML file mapping bearer tokens to subjects; overrides the single-token `bearer_token` mode. · PAPERLESS_MCP_DEFAULT_PAGE_SIZE=Default page size for list tools, from 1 through 100. · PAPERLESS_MCP_HEALTH_DETAIL=How much the unauthenticated /health and /health/ready bodies say: status, standard (adds name, version and per-check verdicts), or full (adds redacted reasons; trusted networks only). · PAPERLESS_MCP_HTTP_PATH=Mount path for the MCP endpoint; the health routes derive their prefix from it. · PAPERLESS_MCP_HTTP_RETRIES=Retries for idempotent requests after network errors or 5xx responses. · PAPERLESS_MCP_HTTP_TIMEOUT_SECONDS=Per-request HTTP timeout in seconds. · PAPERLESS_MCP_INSTANCE_DESCRIPTION=Concise routing context that distinguishes this deployment's material or responsibility. · PAPERLESS_MCP_INSTRUCTIONS=Legacy: replaces all generated MCP instructions (deprecated; use _INSTANCE_DESCRIPTION for routing and _INSTRUCTIONS_EXTRA for policy). · PAPERLESS_MCP_INSTRUCTIONS_EXTRA=Deployment-specific behavioral policy added to the generated MCP instructions. · PAPERLESS_MCP_KV_STORE_URL=Persistent-state backend URL shared by every pvl-core subsystem that needs state. `memory://` is in-process and lost on restart; `file:///path` persists on one server; `redis://`, `dynamodb://` and `mongodb://` each need their matching extra. When unset, defaults to `file:///data/state` (the volume family Docker images mount), or to `memory://` (with a warning) on a host where that directory is not usable. · PAPERLESS_MCP_LOG_FORMAT=Log rendering. rich is one colour event key=value line per record, for a terminal; json is one JSON object per record, for a collector. Unset picks rich when stderr is a terminal and json everywhere else, so a container or journald gets JSON with no configuration. · PAPERLESS_MCP_LOG_LEVEL=Log level for every logger in the process, FastMCP's included (DEBUG / INFO / WARNING / ERROR / CRITICAL). The -v CLI flag overrides to DEBUG. The unprefixed FASTMCP_LOG_LEVEL still works for one major version and logs a deprecation warning. · PAPERLESS_MCP_OIDC_ADVERTISED_SCOPES=Scopes advertised to MCP clients in protected-resource metadata, space- or comma-separated. Overrides the default `openid offline_access`; `oidc_required_scopes` is always added on top. Set this when the registered client is not permitted `offline_access`, or to have clients request extra claim scopes (such as `groups`) without also requiring them in every token. · PAPERLESS_MCP_OIDC_AUDIENCE=Expected `aud` claim; tokens issued for another audience are rejected. · PAPERLESS_MCP_OIDC_CLIENT_ID=OIDC client identifier registered with the provider. · PAPERLESS_MCP_OIDC_CLIENT_SECRET=OIDC client secret registered with the provider. · PAPERLESS_MCP_OIDC_CONFIG_URL=OIDC discovery document URL, for example `https://auth.example.com/.well-known/openid-configuration`. · PAPERLESS_MCP_OIDC_JWT_SIGNING_KEY=Signing key for issued tokens; used in oidc-proxy mode only. When unset, the key is derived deterministically from `oidc_client_secret`, so tokens survive a restart. Rotating that secret then invalidates every issued token. Set this explicitly to decouple token validity from secret rotation. Generate with `openssl rand -hex 32`. · PAPERLESS_MCP_OIDC_REQUIRED_SCOPES=Scopes a caller must present, space- or comma-separated. Defaults to `openid` in oidc-proxy mode. · PAPERLESS_MCP_OIDC_VERIFY_ACCESS_TOKEN=Validate the access token instead of the id token. · PAPERLESS_MCP_PAPERLESS_PUBLIC_URL=Public Paperless UI URL for user-visible links; defaults to PAPERLESS_URL. · PAPERLESS_MCP_PAPERLESS_URL=Base URL of the Paperless-NGX REST API, without a trailing slash. The server refuses to start without it. · PAPERLESS_MCP_SERVER_NAME=Rename this server instance; defaults to the project name. · PAPERLESS_MCP_SHUTDOWN_GRACE_S=Seconds SIGTERM may spend draining in-flight requests before the HTTP server exits. Keep it at or below the termination grace period the orchestrator allows. `0` drops in-flight requests immediately. · PAPERLESS_MCP_TOOLS_ALLOW=Comma-separated explicit tool names this instance exposes; every other tool is hidden from listings and cannot be invoked. Names matching no registered tool are inert. Mutually exclusive with `tools_deny`. Takes effect through `apply_tool_visibility`. · PAPERLESS_MCP_TOOLS_DENY=Comma-separated explicit tool names hidden from this instance (absent from listings, cannot be invoked). Names matching no registered tool are inert. Mutually exclusive with `tools_allow`. Takes effect through `apply_tool_visibility`. · PAPERLESS_MCP_TRANSFER_GRACE_TTL_S=Post-success grace window in seconds: a served token's TTL shrinks to this so a stalled transfer can retry within it. · PAPERLESS_MCP_TRANSFER_LEASE_S=Crashed-handler reclaim window in seconds for an in-flight reservation. · PAPERLESS_MCP_TRANSFER_MAX_UPLOAD_BYTES=Maximum size in bytes of a single upload. · PAPERLESS_MCP_TRANSFER_TTL_DEFAULT_S=Link lifetime in seconds when the caller requests no explicit TTL. · PAPERLESS_MCP_TRANSFER_TTL_MAX_S=Ceiling in seconds a caller-requested link TTL is clamped to. · PGID=Run the server process as this GID; pair with PUID to match the owner of a mounted volume. · PUID=Run the server process as this UID; the container entrypoint reassigns ownership of writable paths to match. | MCP-Register | 2026-09-22T01:17:01.638Z | selbstauskunft |  |
| Symbolformate (Rohangabe) |  | MCP-Register | 2026-09-18T01:17:01.510Z | selbstauskunft |  |
| Verbindungswege (Quellstruktur) | {"packages":[{"registryType":"pypi","identifier":"pvliesdonk-paperless-mcp","version":"3.0.0","runtimeHint":"uvx","transport":"stdio","environment":[{"name":"PAPERLESS_MCP_KV_STORE_URL","description":"Persistent-state backend URL shared by every pvl-core subsystem that needs state. `memory://` is in-process and lost on restart; `file:///path` persists on one server; `redis://`, `dynamodb://` and `mongodb://` each need their matching extra. When unset, defaults to `file:///data/state` (the volume family Docker images mount), or to `memory://` (with a warning) on a host where that directory is not usable.","required":false,"secret":false},{"name":"PAPERLESS_MCP_TOOLS_ALLOW","description":"Comma-separated explicit tool names this instance exposes; every other tool is hidden from listings and cannot be invoked. Names matching no registered tool are inert. Mutually exclusive with `tools_deny`. Takes effect through `apply_tool_visibility`.","required":false,"secret":false},{"name":"PAPERLESS_MCP_TOOLS_DENY","description":"Comma-separated explicit tool names hidden from this instance (absent from listings, cannot be invoked). Names matching no registered tool are inert. Mutually exclusive with `tools_allow`. Takes effect through `apply_tool_visibility`.","required":false,"secret":false},{"name":"PAPERLESS_MCP_SERVER_NAME","description":"Rename this server instance; defaults to the project name.","required":false,"secret":false},{"name":"PAPERLESS_MCP_INSTANCE_DESCRIPTION","description":"Concise routing context that distinguishes this deployment's material or responsibility.","required":false,"secret":false},{"name":"PAPERLESS_MCP_INSTRUCTIONS_EXTRA","description":"Deployment-specific behavioral policy added to the generated MCP instructions.","required":false,"secret":false},{"name":"PAPERLESS_MCP_INSTRUCTIONS","description":"Legacy: replaces all generated MCP instructions (deprecated; use _INSTANCE_DESCRIPTION for routing and _INSTRUCTIONS_EXTRA for policy).","required":false,"secret":false},{"name":"PAPERLESS_MCP_LOG_LEVEL","description":"Log level for every logger in the process, FastMCP's included (DEBUG / INFO / WARNING / ERROR / CRITICAL). The -v CLI flag overrides to DEBUG. The unprefixed FASTMCP_LOG_LEVEL still works for one major version and logs a deprecation warning.","required":false,"secret":false},{"name":"PAPERLESS_MCP_LOG_FORMAT","description":"Log rendering. rich is one colour event key=value line per record, for a terminal; json is one JSON object per record, for a collector. Unset picks rich when stderr is a terminal and json everywhere else, so a container or journald gets JSON with no configuration.","required":false,"secret":false},{"name":"PAPERLESS_MCP_PAPERLESS_URL","description":"Base URL of the Paperless-NGX REST API, without a trailing slash. The server refuses to start without it.","required":false,"secret":false},{"name":"PAPERLESS_MCP_API_TOKEN","description":"Paperless service-account token used for outbound API requests. The server refuses to start without it.","required":false,"secret":true},{"name":"PAPERLESS_MCP_HTTP_TIMEOUT_SECONDS","description":"Per-request HTTP timeout in seconds.","format":"number","required":false,"secret":false},{"name":"PAPERLESS_MCP_HTTP_RETRIES","description":"Retries for idempotent requests after network errors or 5xx responses.","format":"number","required":false,"secret":false},{"name":"PAPERLESS_MCP_DEFAULT_PAGE_SIZE","description":"Default page size for list tools, from 1 through 100.","format":"number","required":false,"secret":false},{"name":"PAPERLESS_MCP_PAPERLESS_PUBLIC_URL","description":"Public Paperless UI URL for user-visible links; defaults to PAPERLESS_URL.","required":false,"secret":false},{"name":"PAPERLESS_MCP_TRANSFER_TTL_DEFAULT_S","description":"Link lifetime in seconds when the caller requests no explicit TTL.","format":"number","required":false,"secret":false},{"name":"PAPERLESS_MCP_TRANSFER_TTL_MAX_S","description":"Ceiling in seconds a caller-requested link TTL is clamped to.","format":"number","required":false,"secret":false},{"name":"PAPERLESS_MCP_TRANSFER_GRACE_TTL_S","description":"Post-success grace window in seconds: a served token's TTL shrinks to this so a stalled transfer can retry within it.","format":"number","required":false,"secret":false},{"name":"PAPERLESS_MCP_TRANSFER_LEASE_S","description":"Crashed-handler reclaim window in seconds for an in-flight reservation.","format":"number","required":false,"secret":false},{"name":"PAPERLESS_MCP_TRANSFER_MAX_UPLOAD_BYTES","description":"Maximum size in bytes of a single upload.","format":"number","required":false,"secret":false}],"additional_arguments_declared":false},{"registryType":"oci","identifier":"ghcr.io/pvliesdonk/paperless-mcp:v3.0.0","transport":"streamable-http","environment":[{"name":"PAPERLESS_MCP_SHUTDOWN_GRACE_S","description":"Seconds SIGTERM may spend draining in-flight requests before the HTTP server exits. Keep it at or below the termination grace period the orchestrator allows. `0` drops in-flight requests immediately.","format":"number","required":false,"secret":false},{"name":"PAPERLESS_MCP_BASE_URL","description":"Public base URL of the deployed server, for example `https://mcp.example.com`. Required for OIDC. Also the fallback source of the MCP Apps domain when `app_domain` is unset.","required":false,"secret":false},{"name":"PAPERLESS_MCP_BEARER_TOKEN","description":"Single shared bearer token; enables bearer auth unless `bearer_tokens_file` is set, which takes precedence.","required":false,"secret":true},{"name":"PAPERLESS_MCP_OIDC_CONFIG_URL","description":"OIDC discovery document URL, for example `https://auth.example.com/.well-known/openid-configuration`.","required":false,"secret":false},{"name":"PAPERLESS_MCP_OIDC_CLIENT_ID","description":"OIDC client identifier registered with the provider.","required":false,"secret":false},{"name":"PAPERLESS_MCP_OIDC_CLIENT_SECRET","description":"OIDC client secret registered with the provider.","required":false,"secret":true},{"name":"PAPERLESS_MCP_OIDC_AUDIENCE","description":"Expected `aud` claim; tokens issued for another audience are rejected.","required":false,"secret":false},{"name":"PAPERLESS_MCP_OIDC_REQUIRED_SCOPES","description":"Scopes a caller must present, space- or comma-separated. Defaults to `openid` in oidc-proxy mode.","required":false,"secret":false},{"name":"PAPERLESS_MCP_OIDC_ADVERTISED_SCOPES","description":"Scopes advertised to MCP clients in protected-resource metadata, space- or comma-separated. Overrides the default `openid offline_access`; `oidc_required_scopes` is always added on top. Set this when the registered client is not permitted `offline_access`, or to have clients request extra claim scopes (such as `groups`) without also requiring them in every token.","required":false,"secret":false},{"name":"PAPERLESS_MCP_OIDC_JWT_SIGNING_KEY","description":"Signing key for issued tokens; used in oidc-proxy mode only. When unset, the key is derived deterministically from `oidc_client_secret`, so tokens survive a restart. Rotating that secret then invalidates every issued token. Set this explicitly to decouple token validity from secret rotation. Generate with `openssl rand -hex 32`.","required":false,"secret":true},{"name":"PAPERLESS_MCP_OIDC_VERIFY_ACCESS_TOKEN","description":"Validate the access token instead of the id token.","format":"boolean","required":false,"secret":false},{"name":"PAPERLESS_MCP_KV_STORE_URL","description":"Persistent-state backend URL shared by every pvl-core subsystem that needs state. `memory://` is in-process and lost on restart; `file:///path` persists on one server; `redis://`, `dynamodb://` and `mongodb://` each need their matching extra. When unset, defaults to `file:///data/state` (the volume family Docker images mount), or to `memory://` (with a warning) on a host where that directory is not usable.","required":false,"secret":false},{"name":"PAPERLESS_MCP_APP_DOMAIN","description":"MCP Apps iframe domain, used for CSP sandboxing. Overrides the host derived from `base_url`.","required":false,"secret":false},{"name":"PAPERLESS_MCP_TOOLS_ALLOW","description":"Comma-separated explicit tool names this instance exposes; every other tool is hidden from listings and cannot be invoked. Names matching no registered tool are inert. Mutually exclusive with `tools_deny`. Takes effect through `apply_tool_visibility`.","required":false,"secret":false},{"name":"PAPERLESS_MCP_TOOLS_DENY","description":"Comma-separated explicit tool names hidden from this instance (absent from listings, cannot be invoked). Names matching no registered tool are inert. Mutually exclusive with `tools_allow`. Takes effect through `apply_tool_visibility`.","required":false,"secret":false},{"name":"PAPERLESS_MCP_AUTH_MODE","description":"Explicit auth-mode override, accepting `remote` or `oidc-proxy` (case- and whitespace-insensitive). When unset the mode is auto-detected from which auth variables are set; the override exists because having all four OIDC variables set is ambiguous between those two modes. Other values are ignored with a warning.","required":false,"secret":false},{"name":"PAPERLESS_MCP_BEARER_TOKENS_FILE","description":"Path to a TOML file mapping bearer tokens to subjects; overrides the single-token `bearer_token` mode.","format":"filepath","required":false,"secret":false},{"name":"PAPERLESS_MCP_BEARER_DEFAULT_SUBJECT","description":"Subject assigned to the single-token bearer mode; ignored when `bearer_tokens_file` is set, since mapped mode carries per-token subjects.","required":false,"secret":false},{"name":"PAPERLESS_MCP_SERVER_NAME","description":"Rename this server instance; defaults to the project name.","required":false,"secret":false},{"name":"PAPERLESS_MCP_INSTANCE_DESCRIPTION","description":"Concise routing context that distinguishes this deployment's material or responsibility.","required":false,"secret":false},{"name":"PAPERLESS_MCP_INSTRUCTIONS_EXTRA","description":"Deployment-specific behavioral policy added to the generated MCP instructions.","required":false,"secret":false},{"name":"PAPERLESS_MCP_INSTRUCTIONS","description":"Legacy: replaces all generated MCP instructions (deprecated; use _INSTANCE_DESCRIPTION for routing and _INSTRUCTIONS_EXTRA for policy).","required":false,"secret":false},{"name":"PAPERLESS_MCP_HTTP_PATH","description":"Mount path for the MCP endpoint; the health routes derive their prefix from it.","required":false,"secret":false},{"name":"PAPERLESS_MCP_HEALTH_DETAIL","description":"How much the unauthenticated /health and /health/ready bodies say: status, standard (adds name, version and per-check verdicts), or full (adds redacted reasons; trusted networks only).","required":false,"secret":false},{"name":"PUID","description":"Run the server process as this UID; the container entrypoint reassigns ownership of writable paths to match.","format":"number","required":false,"secret":false},{"name":"PGID","description":"Run the server process as this GID; pair with PUID to match the owner of a mounted volume.","format":"number","required":false,"secret":false},{"name":"PAPERLESS_MCP_LOG_LEVEL","description":"Log level for every logger in the process, FastMCP's included (DEBUG / INFO / WARNING / ERROR / CRITICAL). The -v CLI flag overrides to DEBUG. The unprefixed FASTMCP_LOG_LEVEL still works for one major version and logs a deprecation warning.","required":false,"secret":false},{"name":"PAPERLESS_MCP_LOG_FORMAT","description":"Log rendering. rich is one colour event key=value line per record, for a terminal; json is one JSON object per record, for a collector. Unset picks rich when stderr is a terminal and json everywhere else, so a container or journald gets JSON with no configuration.","required":false,"secret":false},{"name":"PAPERLESS_MCP_PAPERLESS_URL","description":"Base URL of the Paperless-NGX REST API, without a trailing slash. The server refuses to start without it.","required":false,"secret":false},{"name":"PAPERLESS_MCP_API_TOKEN","description":"Paperless service-account token used for outbound API requests. The server refuses to start without it.","required":false,"secret":true},{"name":"PAPERLESS_MCP_HTTP_TIMEOUT_SECONDS","description":"Per-request HTTP timeout in seconds.","format":"number","required":false,"secret":false},{"name":"PAPERLESS_MCP_HTTP_RETRIES","description":"Retries for idempotent requests after network errors or 5xx responses.","format":"number","required":false,"secret":false},{"name":"PAPERLESS_MCP_DEFAULT_PAGE_SIZE","description":"Default page size for list tools, from 1 through 100.","format":"number","required":false,"secret":false},{"name":"PAPERLESS_MCP_PAPERLESS_PUBLIC_URL","description":"Public Paperless UI URL for user-visible links; defaults to PAPERLESS_URL.","required":false,"secret":false},{"name":"PAPERLESS_MCP_TRANSFER_TTL_DEFAULT_S","description":"Link lifetime in seconds when the caller requests no explicit TTL.","format":"number","required":false,"secret":false},{"name":"PAPERLESS_MCP_TRANSFER_TTL_MAX_S","description":"Ceiling in seconds a caller-requested link TTL is clamped to.","format":"number","required":false,"secret":false},{"name":"PAPERLESS_MCP_TRANSFER_GRACE_TTL_S","description":"Post-success grace window in seconds: a served token's TTL shrinks to this so a stalled transfer can retry within it.","format":"number","required":false,"secret":false},{"name":"PAPERLESS_MCP_TRANSFER_LEASE_S","description":"Crashed-handler reclaim window in seconds for an in-flight reservation.","format":"number","required":false,"secret":false},{"name":"PAPERLESS_MCP_TRANSFER_MAX_UPLOAD_BYTES","description":"Maximum size in bytes of a single upload.","format":"number","required":false,"secret":false}],"additional_arguments_declared":true}],"remotes":[]} | MCP-Register | 2026-09-22T01:17:01.638Z | selbstauskunft |  |

## Verweise

- Namensraum: [[namensraum/io-github-pvliesdonk|io.github.pvliesdonk]]

---

- Registerseite: <https://tracevero.de/mcp/io-github-pvliesdonk-paperless-mcp>
- Abgerufen am: 2026-10-10