Zum Inhalt springen

Verlauf von Paperless MCP

io.github.pvliesdonk/paperless-mcp · Registerstatus: aktiv

Angaben zu diesem Eintrag melden

Jede veröffentlichte Änderung an diesem Eintrag, die jüngste zuerst.

Änderungen
2026-09-22Deklarierte Version: 2.1.0 → 3.0.0
2026-09-22Im Register geändert am (Rohangabe): 2026-09-19 → 2026-09-21
2026-09-22Im Register eingetragen am (Rohangabe): 2026-09-19 → 2026-09-21
2026-09-22Beschreibungen der Umgebungsvariablen (Rohangabe): FASTMCP_ENABLE_RICH_LOGGING=Rich color output for a terminal; false gives one plain or JSON line per record. Off in the container image and the systemd unit, since neither is a terminal and Rich wraps a structured record at its 80-column fallback. · FASTMCP_LOG_LEVEL=Log level for FastMCP internals and app loggers (DEBUG / INFO / WARNING / ERROR / CRITICAL). The -v CLI flag overrides to DEBUG. · PAPERLESS_MCP_API_TOKEN=Paperless service-account token used for outbound API requests. The server refuses to start without it. · PAPERLESS_MCP_APP_DOMAIN=MCP Apps iframe domain, used for CSP sandboxing. Overrides the host derived from `base_url`. · PAPERLESS_MCP_AUTH_MODE=Explicit auth-mode override, accepting `remote` or `oidc-proxy` (case- and whitespace-insensitive). When unset the mode is auto-detected from which auth variables are set; the override exists because having all four OIDC variables set is ambiguous between those two modes. Other values are ignored with a warning. · PAPERLESS_MCP_BASE_URL=Public base URL of the deployed server, for example `https://mcp.example.com`. Required for OIDC. Also the fallback source of the MCP Apps domain when `app_domain` is unset. · PAPERLESS_MCP_BEARER_DEFAULT_SUBJECT=Subject assigned to the single-token bearer mode; ignored when `bearer_tokens_file` is set, since mapped mode carries per-token subjects. · PAPERLESS_MCP_BEARER_TOKEN=Single shared bearer token; enables bearer auth unless `bearer_tokens_file` is set, which takes precedence. · PAPERLESS_MCP_BEARER_TOKENS_FILE=Path to a TOML file mapping bearer tokens to subjects; overrides the single-token `bearer_token` mode. · PAPERLESS_MCP_DEFAULT_PAGE_SIZE=Default page size for list tools, from 1 through 100. · PAPERLESS_MCP_HEALTH_DETAIL=How much the unauthenticated /health and /health/ready bodies say: status, standard (adds name, version and per-check verdicts), or full (adds redacted reasons; trusted networks only). · PAPERLESS_MCP_HTTP_PATH=Mount path for the MCP endpoint; the health routes derive their prefix from it. · PAPERLESS_MCP_HTTP_RETRIES=Retries for idempotent requests after network errors or 5xx responses. · PAPERLESS_MCP_HTTP_TIMEOUT_SECONDS=Per-request HTTP timeout in seconds. · PAPERLESS_MCP_INSTANCE_DESCRIPTION=Concise routing context that distinguishes this deployment's material or responsibility. · PAPERLESS_MCP_INSTRUCTIONS=Legacy: replaces all generated MCP instructions (deprecated; use _INSTANCE_DESCRIPTION for routing and _INSTRUCTIONS_EXTRA for policy). · PAPERLESS_MCP_INSTRUCTIONS_EXTRA=Deployment-specific behavioral policy added to the generated MCP instructions. · PAPERLESS_MCP_KV_STORE_URL=Persistent-state backend URL shared by every pvl-core subsystem that needs state. `memory://` is in-process and lost on restart; `file:///path` persists on one server; `redis://`, `dynamodb://` and `mongodb://` each need their matching extra. When unset, defaults to `file:///data/state` (the volume family Docker images mount), or to `memory://` (with a warning) on a host where that directory is not usable. · PAPERLESS_MCP_OIDC_ADVERTISED_SCOPES=Scopes advertised to MCP clients in protected-resource metadata, space- or comma-separated. Overrides the default `openid offline_access`; `oidc_required_scopes` is always added on top. Set this when the registered client is not permitted `offline_access`, or to have clients request extra claim scopes (such as `groups`) without also requiring them in every token. · PAPERLESS_MCP_OIDC_AUDIENCE=Expected `aud` claim; tokens issued for another audience are rejected. · PAPERLESS_MCP_OIDC_CLIENT_ID=OIDC client identifier registered with the provider. · PAPERLESS_MCP_OIDC_CLIENT_SECRET=OIDC client secret registered with the provider. · PAPERLESS_MCP_OIDC_CONFIG_URL=OIDC discovery document URL, for example `https://auth.example.com/.well-known/openid-configuration`. · PAPERLESS_MCP_OIDC_JWT_SIGNING_KEY=Signing key for issued tokens; used in oidc-proxy mode only. When unset, the key is derived deterministically from `oidc_client_secret`, so tokens survive a restart. Rotating that secret then invalidates every issued token. Set this explicitly to decouple token validity from secret rotation. Generate with `openssl rand -hex 32`. · PAPERLESS_MCP_OIDC_REQUIRED_SCOPES=Scopes a caller must present, space- or comma-separated. Defaults to `openid` in oidc-proxy mode. · PAPERLESS_MCP_OIDC_VERIFY_ACCESS_TOKEN=Validate the access token instead of the id token. · PAPERLESS_MCP_PAPERLESS_PUBLIC_URL=Public Paperless UI URL for user-visible links; defaults to PAPERLESS_URL. · PAPERLESS_MCP_PAPERLESS_URL=Base URL of the Paperless-NGX REST API, without a trailing slash. The server refuses to start without it. · PAPERLESS_MCP_SERVER_NAME=Rename this server instance; defaults to the project name. · PAPERLESS_MCP_TOOLS_ALLOW=Comma-separated explicit tool names this instance exposes; every other tool is hidden from listings and cannot be invoked. Names matching no registered tool are inert. Mutually exclusive with `tools_deny`. Takes effect through `apply_tool_visibility`. · PAPERLESS_MCP_TOOLS_DENY=Comma-separated explicit tool names hidden from this instance (absent from listings, cannot be invoked). Names matching no registered tool are inert. Mutually exclusive with `tools_allow`. Takes effect through `apply_tool_visibility`. · PGID=Run the server process as this GID; pair with PUID to match the owner of a mounted volume. · PUID=Run the server process as this UID; the container entrypoint reassigns ownership of writable paths to match. → PAPERLESS_MCP_API_TOKEN=Paperless service-account token used for outbound API requests. The server refuses to start without it. · PAPERLESS_MCP_APP_DOMAIN=MCP Apps iframe domain, used for CSP sandboxing. Overrides the host derived from `base_url`. · PAPERLESS_MCP_AUTH_MODE=Explicit auth-mode override, accepting `remote` or `oidc-proxy` (case- and whitespace-insensitive). When unset the mode is auto-detected from which auth variables are set; the override exists because having all four OIDC variables set is ambiguous between those two modes. Other values are ignored with a warning. · PAPERLESS_MCP_BASE_URL=Public base URL of the deployed server, for example `https://mcp.example.com`. Required for OIDC. Also the fallback source of the MCP Apps domain when `app_domain` is unset. · PAPERLESS_MCP_BEARER_DEFAULT_SUBJECT=Subject assigned to the single-token bearer mode; ignored when `bearer_tokens_file` is set, since mapped mode carries per-token subjects. · PAPERLESS_MCP_BEARER_TOKEN=Single shared bearer token; enables bearer auth unless `bearer_tokens_file` is set, which takes precedence. · PAPERLESS_MCP_BEARER_TOKENS_FILE=Path to a TOML file mapping bearer tokens to subjects; overrides the single-token `bearer_token` mode. · PAPERLESS_MCP_DEFAULT_PAGE_SIZE=Default page size for list tools, from 1 through 100. · PAPERLESS_MCP_HEALTH_DETAIL=How much the unauthenticated /health and /health/ready bodies say: status, standard (adds name, version and per-check verdicts), or full (adds redacted reasons; trusted networks only). · PAPERLESS_MCP_HTTP_PATH=Mount path for the MCP endpoint; the health routes derive their prefix from it. · PAPERLESS_MCP_HTTP_RETRIES=Retries for idempotent requests after network errors or 5xx responses. · PAPERLESS_MCP_HTTP_TIMEOUT_SECONDS=Per-request HTTP timeout in seconds. · PAPERLESS_MCP_INSTANCE_DESCRIPTION=Concise routing context that distinguishes this deployment's material or responsibility. · PAPERLESS_MCP_INSTRUCTIONS=Legacy: replaces all generated MCP instructions (deprecated; use _INSTANCE_DESCRIPTION for routing and _INSTRUCTIONS_EXTRA for policy). · PAPERLESS_MCP_INSTRUCTIONS_EXTRA=Deployment-specific behavioral policy added to the generated MCP instructions. · PAPERLESS_MCP_KV_STORE_URL=Persistent-state backend URL shared by every pvl-core subsystem that needs state. `memory://` is in-process and lost on restart; `file:///path` persists on one server; `redis://`, `dynamodb://` and `mongodb://` each need their matching extra. When unset, defaults to `file:///data/state` (the volume family Docker images mount), or to `memory://` (with a warning) on a host where that directory is not usable. · PAPERLESS_MCP_LOG_FORMAT=Log rendering. rich is one colour event key=value line per record, for a terminal; json is one JSON object per record, for a collector. Unset picks rich when stderr is a terminal and json everywhere else, so a container or journald gets JSON with no configuration. · PAPERLESS_MCP_LOG_LEVEL=Log level for every logger in the process, FastMCP's included (DEBUG / INFO / WARNING / ERROR / CRITICAL). The -v CLI flag overrides to DEBUG. The unprefixed FASTMCP_LOG_LEVEL still works for one major version and logs a deprecation warning. · PAPERLESS_MCP_OIDC_ADVERTISED_SCOPES=Scopes advertised to MCP clients in protected-resource metadata, space- or comma-separated. Overrides the default `openid offline_access`; `oidc_required_scopes` is always added on top. Set this when the registered client is not permitted `offline_access`, or to have clients request extra claim scopes (such as `groups`) without also requiring them in every token. · PAPERLESS_MCP_OIDC_AUDIENCE=Expected `aud` claim; tokens issued for another audience are rejected. · PAPERLESS_MCP_OIDC_CLIENT_ID=OIDC client identifier registered with the provider. · PAPERLESS_MCP_OIDC_CLIENT_SECRET=OIDC client secret registered with the provider. · PAPERLESS_MCP_OIDC_CONFIG_URL=OIDC discovery document URL, for example `https://auth.example.com/.well-known/openid-configuration`. · PAPERLESS_MCP_OIDC_JWT_SIGNING_KEY=Signing key for issued tokens; used in oidc-proxy mode only. When unset, the key is derived deterministically from `oidc_client_secret`, so tokens survive a restart. Rotating that secret then invalidates every issued token. Set this explicitly to decouple token validity from secret rotation. Generate with `openssl rand -hex 32`. · PAPERLESS_MCP_OIDC_REQUIRED_SCOPES=Scopes a caller must present, space- or comma-separated. Defaults to `openid` in oidc-proxy mode. · PAPERLESS_MCP_OIDC_VERIFY_ACCESS_TOKEN=Validate the access token instead of the id token. · PAPERLESS_MCP_PAPERLESS_PUBLIC_URL=Public Paperless UI URL for user-visible links; defaults to PAPERLESS_URL. · PAPERLESS_MCP_PAPERLESS_URL=Base URL of the Paperless-NGX REST API, without a trailing slash. The server refuses to start without it. · PAPERLESS_MCP_SERVER_NAME=Rename this server instance; defaults to the project name. · PAPERLESS_MCP_SHUTDOWN_GRACE_S=Seconds SIGTERM may spend draining in-flight requests before the HTTP server exits. Keep it at or below the termination grace period the orchestrator allows. `0` drops in-flight requests immediately. · PAPERLESS_MCP_TOOLS_ALLOW=Comma-separated explicit tool names this instance exposes; every other tool is hidden from listings and cannot be invoked. Names matching no registered tool are inert. Mutually exclusive with `tools_deny`. Takes effect through `apply_tool_visibility`. · PAPERLESS_MCP_TOOLS_DENY=Comma-separated explicit tool names hidden from this instance (absent from listings, cannot be invoked). Names matching no registered tool are inert. Mutually exclusive with `tools_allow`. Takes effect through `apply_tool_visibility`. · PAPERLESS_MCP_TRANSFER_GRACE_TTL_S=Post-success grace window in seconds: a served token's TTL shrinks to this so a stalled transfer can retry within it. · PAPERLESS_MCP_TRANSFER_LEASE_S=Crashed-handler reclaim window in seconds for an in-flight reservation. · PAPERLESS_MCP_TRANSFER_MAX_UPLOAD_BYTES=Maximum size in bytes of a single upload. · PAPERLESS_MCP_TRANSFER_TTL_DEFAULT_S=Link lifetime in seconds when the caller requests no explicit TTL. · PAPERLESS_MCP_TRANSFER_TTL_MAX_S=Ceiling in seconds a caller-requested link TTL is clamped to. · PGID=Run the server process as this GID; pair with PUID to match the owner of a mounted volume. · PUID=Run the server process as this UID; the container entrypoint reassigns ownership of writable paths to match.
2026-09-22Verbindungswege (Quellstruktur): {"packages":[{"registryType":"pypi","identifier":"pvliesdonk-paperless-mcp","version":"2.1.0","runtimeHint":"uvx","transport":"stdio","environment":[{"name":"PAPERLESS_MCP_KV_STORE_URL","description":"Persistent-state backend URL shared by every pvl-core subsystem that needs state. `memory://` is in-process and lost on restart; `file:///path` persists on one server; `redis://`, `dynamodb://` and `mongodb://` each need their matching extra. When unset, defaults to `file:///data/state` (the volume family Docker images mount), or to `memory://` (with a warning) on a host where that directory is not usable.","required":false,"secret":false},{"name":"PAPERLESS_MCP_TOOLS_ALLOW","description":"Comma-separated explicit tool names this instance exposes; every other tool is hidden from listings and cannot be invoked. Names matching no registered tool are inert. Mutually exclusive with `tools_deny`. Takes effect through `apply_tool_visibility`.","required":false,"secret":false},{"name":"PAPERLESS_MCP_TOOLS_DENY","description":"Comma-separated explicit tool names hidden from this instance (absent from listings, cannot be invoked). Names matching no registered tool are inert. Mutually exclusive with `tools_allow`. Takes effect through `apply_tool_visibility`.","required":false,"secret":false},{"name":"PAPERLESS_MCP_SERVER_NAME","description":"Rename this server instance; defaults to the project name.","required":false,"secret":false},{"name":"PAPERLESS_MCP_INSTANCE_DESCRIPTION","description":"Concise routing context that distinguishes this deployment's material or responsibility.","required":false,"secret":false},{"name":"PAPERLESS_MCP_INSTRUCTIONS_EXTRA","description":"Deployment-specific behavioral policy added to the generated MCP instructions.","required":false,"secret":false},{"name":"PAPERLESS_MCP_INSTRUCTIONS","description":"Legacy: replaces all generated MCP instructions (deprecated; use _INSTANCE_DESCRIPTION for routing and _INSTRUCTIONS_EXTRA for policy).","required":false,"secret":false},{"name":"FASTMCP_LOG_LEVEL","description":"Log level for FastMCP internals and app loggers (DEBUG / INFO / WARNING / ERROR / CRITICAL). The -v CLI flag overrides to DEBUG.","required":false,"secret":false},{"name":"FASTMCP_ENABLE_RICH_LOGGING","description":"Rich color output for a terminal; false gives one plain or JSON line per record. Off in the container image and the systemd unit, since neither is a terminal and Rich wraps a structured record at its 80-column fallback.","format":"boolean","required":false,"secret":false},{"name":"PAPERLESS_MCP_PAPERLESS_URL","description":"Base URL of the Paperless-NGX REST API, without a trailing slash. The server refuses to start without it.","required":false,"secret":false},{"name":"PAPERLESS_MCP_API_TOKEN","description":"Paperless service-account token used for outbound API requests. The server refuses to start without it.","required":false,"secret":true},{"name":"PAPERLESS_MCP_HTTP_TIMEOUT_SECONDS","description":"Per-request HTTP timeout in seconds.","format":"number","required":false,"secret":false},{"name":"PAPERLESS_MCP_HTTP_RETRIES","description":"Retries for idempotent requests after network errors or 5xx responses.","format":"number","required":false,"secret":false},{"name":"PAPERLESS_MCP_DEFAULT_PAGE_SIZE","description":"Default page size for list tools, from 1 through 100.","format":"number","required":false,"secret":false},{"name":"PAPERLESS_MCP_PAPERLESS_PUBLIC_URL","description":"Public Paperless UI URL for user-visible links; defaults to PAPERLESS_URL.","required":false,"secret":false}],"additional_arguments_declared":false},{"registryType":"oci","identifier":"ghcr.io/pvliesdonk/paperless-mcp:v2.1.0","transport":"streamable-http","environment":[{"name":"PAPERLESS_MCP_BASE_URL","description":"Public base URL of the deployed server, for example `https://mcp.example.com`. Required for OIDC. Also the fallback source of the MCP Apps domain when `app_domain` is unset.","required":false,"secret":false},{"name":"PAPERLESS_MCP_BEARER_TOKEN","description":"Single shared bearer token; enables bearer auth unless `bearer_tokens_file` is set, which takes precedence.","required":false,"secret":true},{"name":"PAPERLESS_MCP_OIDC_CONFIG_URL","description":"OIDC discovery document URL, for example `https://auth.example.com/.well-known/openid-configuration`.","required":false,"secret":false},{"name":"PAPERLESS_MCP_OIDC_CLIENT_ID","description":"OIDC client identifier registered with the provider.","required":false,"secret":false},{"name":"PAPERLESS_MCP_OIDC_CLIENT_SECRET","description":"OIDC client secret registered with the provider.","required":false,"secret":true},{"name":"PAPERLESS_MCP_OIDC_AUDIENCE","description":"Expected `aud` claim; tokens issued for another audience are rejected.","required":false,"secret":false},{"name":"PAPERLESS_MCP_OIDC_REQUIRED_SCOPES","description":"Scopes a caller must present, space- or comma-separated. Defaults to `openid` in oidc-proxy mode.","required":false,"secret":false},{"name":"PAPERLESS_MCP_OIDC_ADVERTISED_SCOPES","description":"Scopes advertised to MCP clients in protected-resource metadata, space- or comma-separated. Overrides the default `openid offline_access`; `oidc_required_scopes` is always added on top. Set this when the registered client is not permitted `offline_access`, or to have clients request extra claim scopes (such as `groups`) without also requiring them in every token.","required":false,"secret":false},{"name":"PAPERLESS_MCP_OIDC_JWT_SIGNING_KEY","description":"Signing key for issued tokens; used in oidc-proxy mode only. When unset, the key is derived deterministically from `oidc_client_secret`, so tokens survive a restart. Rotating that secret then invalidates every issued token. Set this explicitly to decouple token validity from secret rotation. Generate with `openssl rand -hex 32`.","required":false,"secret":true},{"name":"PAPERLESS_MCP_OIDC_VERIFY_ACCESS_TOKEN","description":"Validate the access token instead of the id token.","format":"boolean","required":false,"secret":false},{"name":"PAPERLESS_MCP_KV_STORE_URL","description":"Persistent-state backend URL shared by every pvl-core subsystem that needs state. `memory://` is in-process and lost on restart; `file:///path` persists on one server; `redis://`, `dynamodb://` and `mongodb://` each need their matching extra. When unset, defaults to `file:///data/state` (the volume family Docker images mount), or to `memory://` (with a warning) on a host where that directory is not usable.","required":false,"secret":false},{"name":"PAPERLESS_MCP_APP_DOMAIN","description":"MCP Apps iframe domain, used for CSP sandboxing. Overrides the host derived from `base_url`.","required":false,"secret":false},{"name":"PAPERLESS_MCP_TOOLS_ALLOW","description":"Comma-separated explicit tool names this instance exposes; every other tool is hidden from listings and cannot be invoked. Names matching no registered tool are inert. Mutually exclusive with `tools_deny`. Takes effect through `apply_tool_visibility`.","required":false,"secret":false},{"name":"PAPERLESS_MCP_TOOLS_DENY","description":"Comma-separated explicit tool names hidden from this instance (absent from listings, cannot be invoked). Names matching no registered tool are inert. Mutually exclusive with `tools_allow`. Takes effect through `apply_tool_visibility`.","required":false,"secret":false},{"name":"PAPERLESS_MCP_AUTH_MODE","description":"Explicit auth-mode override, accepting `remote` or `oidc-proxy` (case- and whitespace-insensitive). When unset the mode is auto-detected from which auth variables are set; the override exists because having all four OIDC variables set is ambiguous between those two modes. Other values are ignored with a warning.","required":false,"secret":false},{"name":"PAPERLESS_MCP_BEARER_TOKENS_FILE","description":"Path to a TOML file mapping bearer tokens to subjects; overrides the single-token `bearer_token` mode.","format":"filepath","required":false,"secret":false},{"name":"PAPERLESS_MCP_BEARER_DEFAULT_SUBJECT","description":"Subject assigned to the single-token bearer mode; ignored when `bearer_tokens_file` is set, since mapped mode carries per-token subjects.","required":false,"secret":false},{"name":"PAPERLESS_MCP_SERVER_NAME","description":"Rename this server instance; defaults to the project name.","required":false,"secret":false},{"name":"PAPERLESS_MCP_INSTANCE_DESCRIPTION","description":"Concise routing context that distinguishes this deployment's material or responsibility.","required":false,"secret":false},{"name":"PAPERLESS_MCP_INSTRUCTIONS_EXTRA","description":"Deployment-specific behavioral policy added to the generated MCP instructions.","required":false,"secret":false},{"name":"PAPERLESS_MCP_INSTRUCTIONS","description":"Legacy: replaces all generated MCP instructions (deprecated; use _INSTANCE_DESCRIPTION for routing and _INSTRUCTIONS_EXTRA for policy).","required":false,"secret":false},{"name":"PAPERLESS_MCP_HTTP_PATH","description":"Mount path for the MCP endpoint; the health routes derive their prefix from it.","required":false,"secret":false},{"name":"PAPERLESS_MCP_HEALTH_DETAIL","description":"How much the unauthenticated /health and /health/ready bodies say: status, standard (adds name, version and per-check verdicts), or full (adds redacted reasons; trusted networks only).","required":false,"secret":false},{"name":"PUID","description":"Run the server process as this UID; the container entrypoint reassigns ownership of writable paths to match.","format":"number","required":false,"secret":false},{"name":"PGID","description":"Run the server process as this GID; pair with PUID to match the owner of a mounted volume.","format":"number","required":false,"secret":false},{"name":"FASTMCP_LOG_LEVEL","description":"Log level for FastMCP internals and app loggers (DEBUG / INFO / WARNING / ERROR / CRITICAL). The -v CLI flag overrides to DEBUG.","required":false,"secret":false},{"name":"FASTMCP_ENABLE_RICH_LOGGING","description":"Rich color output for a terminal; false gives one plain or JSON line per record. Off in the container image and the systemd unit, since neither is a terminal and Rich wraps a structured record at its 80-column fallback.","format":"boolean","required":false,"secret":false},{"name":"PAPERLESS_MCP_PAPERLESS_URL","description":"Base URL of the Paperless-NGX REST API, without a trailing slash. The server refuses to start without it.","required":false,"secret":false},{"name":"PAPERLESS_MCP_API_TOKEN","description":"Paperless service-account token used for outbound API requests. The server refuses to start without it.","required":false,"secret":true},{"name":"PAPERLESS_MCP_HTTP_TIMEOUT_SECONDS","description":"Per-request HTTP timeout in seconds.","format":"number","required":false,"secret":false},{"name":"PAPERLESS_MCP_HTTP_RETRIES","description":"Retries for idempotent requests after network errors or 5xx responses.","format":"number","required":false,"secret":false},{"name":"PAPERLESS_MCP_DEFAULT_PAGE_SIZE","description":"Default page size for list tools, from 1 through 100.","format":"number","required":false,"secret":false},{"name":"PAPERLESS_MCP_PAPERLESS_PUBLIC_URL","description":"Public Paperless UI URL for user-visible links; defaults to PAPERLESS_URL.","required":false,"secret":false}],"additional_arguments_declared":true}],"remotes":[]} → {"packages":[{"registryType":"pypi","identifier":"pvliesdonk-paperless-mcp","version":"3.0.0","runtimeHint":"uvx","transport":"stdio","environment":[{"name":"PAPERLESS_MCP_KV_STORE_URL","description":"Persistent-state backend URL shared by every pvl-core subsystem that needs state. `memory://` is in-process and lost on restart; `file:///path` persists on one server; `redis://`, `dynamodb://` and `mongodb://` each need their matching extra. When unset, defaults to `file:///data/state` (the volume family Docker images mount), or to `memory://` (with a warning) on a host where that directory is not usable.","required":false,"secret":false},{"name":"PAPERLESS_MCP_TOOLS_ALLOW","description":"Comma-separated explicit tool names this instance exposes; every other tool is hidden from listings and cannot be invoked. Names matching no registered tool are inert. Mutually exclusive with `tools_deny`. Takes effect through `apply_tool_visibility`.","required":false,"secret":false},{"name":"PAPERLESS_MCP_TOOLS_DENY","description":"Comma-separated explicit tool names hidden from this instance (absent from listings, cannot be invoked). Names matching no registered tool are inert. Mutually exclusive with `tools_allow`. Takes effect through `apply_tool_visibility`.","required":false,"secret":false},{"name":"PAPERLESS_MCP_SERVER_NAME","description":"Rename this server instance; defaults to the project name.","required":false,"secret":false},{"name":"PAPERLESS_MCP_INSTANCE_DESCRIPTION","description":"Concise routing context that distinguishes this deployment's material or responsibility.","required":false,"secret":false},{"name":"PAPERLESS_MCP_INSTRUCTIONS_EXTRA","description":"Deployment-specific behavioral policy added to the generated MCP instructions.","required":false,"secret":false},{"name":"PAPERLESS_MCP_INSTRUCTIONS","description":"Legacy: replaces all generated MCP instructions (deprecated; use _INSTANCE_DESCRIPTION for routing and _INSTRUCTIONS_EXTRA for policy).","required":false,"secret":false},{"name":"PAPERLESS_MCP_LOG_LEVEL","description":"Log level for every logger in the process, FastMCP's included (DEBUG / INFO / WARNING / ERROR / CRITICAL). The -v CLI flag overrides to DEBUG. The unprefixed FASTMCP_LOG_LEVEL still works for one major version and logs a deprecation warning.","required":false,"secret":false},{"name":"PAPERLESS_MCP_LOG_FORMAT","description":"Log rendering. rich is one colour event key=value line per record, for a terminal; json is one JSON object per record, for a collector. Unset picks rich when stderr is a terminal and json everywhere else, so a container or journald gets JSON with no configuration.","required":false,"secret":false},{"name":"PAPERLESS_MCP_PAPERLESS_URL","description":"Base URL of the Paperless-NGX REST API, without a trailing slash. The server refuses to start without it.","required":false,"secret":false},{"name":"PAPERLESS_MCP_API_TOKEN","description":"Paperless service-account token used for outbound API requests. The server refuses to start without it.","required":false,"secret":true},{"name":"PAPERLESS_MCP_HTTP_TIMEOUT_SECONDS","description":"Per-request HTTP timeout in seconds.","format":"number","required":false,"secret":false},{"name":"PAPERLESS_MCP_HTTP_RETRIES","description":"Retries for idempotent requests after network errors or 5xx responses.","format":"number","required":false,"secret":false},{"name":"PAPERLESS_MCP_DEFAULT_PAGE_SIZE","description":"Default page size for list tools, from 1 through 100.","format":"number","required":false,"secret":false},{"name":"PAPERLESS_MCP_PAPERLESS_PUBLIC_URL","description":"Public Paperless UI URL for user-visible links; defaults to PAPERLESS_URL.","required":false,"secret":false},{"name":"PAPERLESS_MCP_TRANSFER_TTL_DEFAULT_S","description":"Link lifetime in seconds when the caller requests no explicit TTL.","format":"number","required":false,"secret":false},{"name":"PAPERLESS_MCP_TRANSFER_TTL_MAX_S","description":"Ceiling in seconds a caller-requested link TTL is clamped to.","format":"number","required":false,"secret":false},{"name":"PAPERLESS_MCP_TRANSFER_GRACE_TTL_S","description":"Post-success grace window in seconds: a served token's TTL shrinks to this so a stalled transfer can retry within it.","format":"number","required":false,"secret":false},{"name":"PAPERLESS_MCP_TRANSFER_LEASE_S","description":"Crashed-handler reclaim window in seconds for an in-flight reservation.","format":"number","required":false,"secret":false},{"name":"PAPERLESS_MCP_TRANSFER_MAX_UPLOAD_BYTES","description":"Maximum size in bytes of a single upload.","format":"number","required":false,"secret":false}],"additional_arguments_declared":false},{"registryType":"oci","identifier":"ghcr.io/pvliesdonk/paperless-mcp:v3.0.0","transport":"streamable-http","environment":[{"name":"PAPERLESS_MCP_SHUTDOWN_GRACE_S","description":"Seconds SIGTERM may spend draining in-flight requests before the HTTP server exits. Keep it at or below the termination grace period the orchestrator allows. `0` drops in-flight requests immediately.","format":"number","required":false,"secret":false},{"name":"PAPERLESS_MCP_BASE_URL","description":"Public base URL of the deployed server, for example `https://mcp.example.com`. Required for OIDC. Also the fallback source of the MCP Apps domain when `app_domain` is unset.","required":false,"secret":false},{"name":"PAPERLESS_MCP_BEARER_TOKEN","description":"Single shared bearer token; enables bearer auth unless `bearer_tokens_file` is set, which takes precedence.","required":false,"secret":true},{"name":"PAPERLESS_MCP_OIDC_CONFIG_URL","description":"OIDC discovery document URL, for example `https://auth.example.com/.well-known/openid-configuration`.","required":false,"secret":false},{"name":"PAPERLESS_MCP_OIDC_CLIENT_ID","description":"OIDC client identifier registered with the provider.","required":false,"secret":false},{"name":"PAPERLESS_MCP_OIDC_CLIENT_SECRET","description":"OIDC client secret registered with the provider.","required":false,"secret":true},{"name":"PAPERLESS_MCP_OIDC_AUDIENCE","description":"Expected `aud` claim; tokens issued for another audience are rejected.","required":false,"secret":false},{"name":"PAPERLESS_MCP_OIDC_REQUIRED_SCOPES","description":"Scopes a caller must present, space- or comma-separated. Defaults to `openid` in oidc-proxy mode.","required":false,"secret":false},{"name":"PAPERLESS_MCP_OIDC_ADVERTISED_SCOPES","description":"Scopes advertised to MCP clients in protected-resource metadata, space- or comma-separated. Overrides the default `openid offline_access`; `oidc_required_scopes` is always added on top. Set this when the registered client is not permitted `offline_access`, or to have clients request extra claim scopes (such as `groups`) without also requiring them in every token.","required":false,"secret":false},{"name":"PAPERLESS_MCP_OIDC_JWT_SIGNING_KEY","description":"Signing key for issued tokens; used in oidc-proxy mode only. When unset, the key is derived deterministically from `oidc_client_secret`, so tokens survive a restart. Rotating that secret then invalidates every issued token. Set this explicitly to decouple token validity from secret rotation. Generate with `openssl rand -hex 32`.","required":false,"secret":true},{"name":"PAPERLESS_MCP_OIDC_VERIFY_ACCESS_TOKEN","description":"Validate the access token instead of the id token.","format":"boolean","required":false,"secret":false},{"name":"PAPERLESS_MCP_KV_STORE_URL","description":"Persistent-state backend URL shared by every pvl-core subsystem that needs state. `memory://` is in-process and lost on restart; `file:///path` persists on one server; `redis://`, `dynamodb://` and `mongodb://` each need their matching extra. When unset, defaults to `file:///data/state` (the volume family Docker images mount), or to `memory://` (with a warning) on a host where that directory is not usable.","required":false,"secret":false},{"name":"PAPERLESS_MCP_APP_DOMAIN","description":"MCP Apps iframe domain, used for CSP sandboxing. Overrides the host derived from `base_url`.","required":false,"secret":false},{"name":"PAPERLESS_MCP_TOOLS_ALLOW","description":"Comma-separated explicit tool names this instance exposes; every other tool is hidden from listings and cannot be invoked. Names matching no registered tool are inert. Mutually exclusive with `tools_deny`. Takes effect through `apply_tool_visibility`.","required":false,"secret":false},{"name":"PAPERLESS_MCP_TOOLS_DENY","description":"Comma-separated explicit tool names hidden from this instance (absent from listings, cannot be invoked). Names matching no registered tool are inert. Mutually exclusive with `tools_allow`. Takes effect through `apply_tool_visibility`.","required":false,"secret":false},{"name":"PAPERLESS_MCP_AUTH_MODE","description":"Explicit auth-mode override, accepting `remote` or `oidc-proxy` (case- and whitespace-insensitive). When unset the mode is auto-detected from which auth variables are set; the override exists because having all four OIDC variables set is ambiguous between those two modes. Other values are ignored with a warning.","required":false,"secret":false},{"name":"PAPERLESS_MCP_BEARER_TOKENS_FILE","description":"Path to a TOML file mapping bearer tokens to subjects; overrides the single-token `bearer_token` mode.","format":"filepath","required":false,"secret":false},{"name":"PAPERLESS_MCP_BEARER_DEFAULT_SUBJECT","description":"Subject assigned to the single-token bearer mode; ignored when `bearer_tokens_file` is set, since mapped mode carries per-token subjects.","required":false,"secret":false},{"name":"PAPERLESS_MCP_SERVER_NAME","description":"Rename this server instance; defaults to the project name.","required":false,"secret":false},{"name":"PAPERLESS_MCP_INSTANCE_DESCRIPTION","description":"Concise routing context that distinguishes this deployment's material or responsibility.","required":false,"secret":false},{"name":"PAPERLESS_MCP_INSTRUCTIONS_EXTRA","description":"Deployment-specific behavioral policy added to the generated MCP instructions.","required":false,"secret":false},{"name":"PAPERLESS_MCP_INSTRUCTIONS","description":"Legacy: replaces all generated MCP instructions (deprecated; use _INSTANCE_DESCRIPTION for routing and _INSTRUCTIONS_EXTRA for policy).","required":false,"secret":false},{"name":"PAPERLESS_MCP_HTTP_PATH","description":"Mount path for the MCP endpoint; the health routes derive their prefix from it.","required":false,"secret":false},{"name":"PAPERLESS_MCP_HEALTH_DETAIL","description":"How much the unauthenticated /health and /health/ready bodies say: status, standard (adds name, version and per-check verdicts), or full (adds redacted reasons; trusted networks only).","required":false,"secret":false},{"name":"PUID","description":"Run the server process as this UID; the container entrypoint reassigns ownership of writable paths to match.","format":"number","required":false,"secret":false},{"name":"PGID","description":"Run the server process as this GID; pair with PUID to match the owner of a mounted volume.","format":"number","required":false,"secret":false},{"name":"PAPERLESS_MCP_LOG_LEVEL","description":"Log level for every logger in the process, FastMCP's included (DEBUG / INFO / WARNING / ERROR / CRITICAL). The -v CLI flag overrides to DEBUG. The unprefixed FASTMCP_LOG_LEVEL still works for one major version and logs a deprecation warning.","required":false,"secret":false},{"name":"PAPERLESS_MCP_LOG_FORMAT","description":"Log rendering. rich is one colour event key=value line per record, for a terminal; json is one JSON object per record, for a collector. Unset picks rich when stderr is a terminal and json everywhere else, so a container or journald gets JSON with no configuration.","required":false,"secret":false},{"name":"PAPERLESS_MCP_PAPERLESS_URL","description":"Base URL of the Paperless-NGX REST API, without a trailing slash. The server refuses to start without it.","required":false,"secret":false},{"name":"PAPERLESS_MCP_API_TOKEN","description":"Paperless service-account token used for outbound API requests. The server refuses to start without it.","required":false,"secret":true},{"name":"PAPERLESS_MCP_HTTP_TIMEOUT_SECONDS","description":"Per-request HTTP timeout in seconds.","format":"number","required":false,"secret":false},{"name":"PAPERLESS_MCP_HTTP_RETRIES","description":"Retries for idempotent requests after network errors or 5xx responses.","format":"number","required":false,"secret":false},{"name":"PAPERLESS_MCP_DEFAULT_PAGE_SIZE","description":"Default page size for list tools, from 1 through 100.","format":"number","required":false,"secret":false},{"name":"PAPERLESS_MCP_PAPERLESS_PUBLIC_URL","description":"Public Paperless UI URL for user-visible links; defaults to PAPERLESS_URL.","required":false,"secret":false},{"name":"PAPERLESS_MCP_TRANSFER_TTL_DEFAULT_S","description":"Link lifetime in seconds when the caller requests no explicit TTL.","format":"number","required":false,"secret":false},{"name":"PAPERLESS_MCP_TRANSFER_TTL_MAX_S","description":"Ceiling in seconds a caller-requested link TTL is clamped to.","format":"number","required":false,"secret":false},{"name":"PAPERLESS_MCP_TRANSFER_GRACE_TTL_S","description":"Post-success grace window in seconds: a served token's TTL shrinks to this so a stalled transfer can retry within it.","format":"number","required":false,"secret":false},{"name":"PAPERLESS_MCP_TRANSFER_LEASE_S","description":"Crashed-handler reclaim window in seconds for an in-flight reservation.","format":"number","required":false,"secret":false},{"name":"PAPERLESS_MCP_TRANSFER_MAX_UPLOAD_BYTES","description":"Maximum size in bytes of a single upload.","format":"number","required":false,"secret":false}],"additional_arguments_declared":true}],"remotes":[]}
2026-09-22Paketversionen (Rohangabe): 2.1.0 → 3.0.0
2026-09-22Paketbezeichner (Rohangabe): ghcr.io/pvliesdonk/paperless-mcp:v2.1.0, pvliesdonk-paperless-mcp → ghcr.io/pvliesdonk/paperless-mcp:v3.0.0, pvliesdonk-paperless-mcp
2026-09-22Umgebungsvariablen (Rohangabe): PAPERLESS_MCP_KV_STORE_URL, PAPERLESS_MCP_TOOLS_ALLOW, PAPERLESS_MCP_TOOLS_DENY, PAPERLESS_MCP_SERVER_NAME, PAPERLESS_MCP_INSTANCE_DESCRIPTION, PAPERLESS_MCP_INSTRUCTIONS_EXTRA, PAPERLESS_MCP_INSTRUCTIONS, FASTMCP_LOG_LEVEL, FASTMCP_ENABLE_RICH_LOGGING, PAPERLESS_MCP_PAPERLESS_URL, PAPERLESS_MCP_API_TOKEN, PAPERLESS_MCP_HTTP_TIMEOUT_SECONDS, PAPERLESS_MCP_HTTP_RETRIES, PAPERLESS_MCP_DEFAULT_PAGE_SIZE, PAPERLESS_MCP_PAPERLESS_PUBLIC_URL, PAPERLESS_MCP_BASE_URL, PAPERLESS_MCP_BEARER_TOKEN, PAPERLESS_MCP_OIDC_CONFIG_URL, PAPERLESS_MCP_OIDC_CLIENT_ID, PAPERLESS_MCP_OIDC_CLIENT_SECRET, PAPERLESS_MCP_OIDC_AUDIENCE, PAPERLESS_MCP_OIDC_REQUIRED_SCOPES, PAPERLESS_MCP_OIDC_ADVERTISED_SCOPES, PAPERLESS_MCP_OIDC_JWT_SIGNING_KEY, PAPERLESS_MCP_OIDC_VERIFY_ACCESS_TOKEN, PAPERLESS_MCP_KV_STORE_URL, PAPERLESS_MCP_APP_DOMAIN, PAPERLESS_MCP_TOOLS_ALLOW, PAPERLESS_MCP_TOOLS_DENY, PAPERLESS_MCP_AUTH_MODE, PAPERLESS_MCP_BEARER_TOKENS_FILE, PAPERLESS_MCP_BEARER_DEFAULT_SUBJECT, PAPERLESS_MCP_SERVER_NAME, PAPERLESS_MCP_INSTANCE_DESCRIPTION, PAPERLESS_MCP_INSTRUCTIONS_EXTRA, PAPERLESS_MCP_INSTRUCTIONS, PAPERLESS_MCP_HTTP_PATH, PAPERLESS_MCP_HEALTH_DETAIL, PUID, PGID, FASTMCP_LOG_LEVEL, FASTMCP_ENABLE_RICH_LOGGING, PAPERLESS_MCP_PAPERLESS_URL, PAPERLESS_MCP_API_TOKEN, PAPERLESS_MCP_HTTP_TIMEOUT_SECONDS, PAPERLESS_MCP_HTTP_RETRIES, PAPERLESS_MCP_DEFAULT_PAGE_SIZE, PAPERLESS_MCP_PAPERLESS_PUBLIC_URL → PAPERLESS_MCP_KV_STORE_URL, PAPERLESS_MCP_TOOLS_ALLOW, PAPERLESS_MCP_TOOLS_DENY, PAPERLESS_MCP_SERVER_NAME, PAPERLESS_MCP_INSTANCE_DESCRIPTION, PAPERLESS_MCP_INSTRUCTIONS_EXTRA, PAPERLESS_MCP_INSTRUCTIONS, PAPERLESS_MCP_LOG_LEVEL, PAPERLESS_MCP_LOG_FORMAT, PAPERLESS_MCP_PAPERLESS_URL, PAPERLESS_MCP_API_TOKEN, PAPERLESS_MCP_HTTP_TIMEOUT_SECONDS, PAPERLESS_MCP_HTTP_RETRIES, PAPERLESS_MCP_DEFAULT_PAGE_SIZE, PAPERLESS_MCP_PAPERLESS_PUBLIC_URL, PAPERLESS_MCP_TRANSFER_TTL_DEFAULT_S, PAPERLESS_MCP_TRANSFER_TTL_MAX_S, PAPERLESS_MCP_TRANSFER_GRACE_TTL_S, PAPERLESS_MCP_TRANSFER_LEASE_S, PAPERLESS_MCP_TRANSFER_MAX_UPLOAD_BYTES, PAPERLESS_MCP_SHUTDOWN_GRACE_S, PAPERLESS_MCP_BASE_URL, PAPERLESS_MCP_BEARER_TOKEN, PAPERLESS_MCP_OIDC_CONFIG_URL, PAPERLESS_MCP_OIDC_CLIENT_ID, PAPERLESS_MCP_OIDC_CLIENT_SECRET, PAPERLESS_MCP_OIDC_AUDIENCE, PAPERLESS_MCP_OIDC_REQUIRED_SCOPES, PAPERLESS_MCP_OIDC_ADVERTISED_SCOPES, PAPERLESS_MCP_OIDC_JWT_SIGNING_KEY, PAPERLESS_MCP_OIDC_VERIFY_ACCESS_TOKEN, PAPERLESS_MCP_KV_STORE_URL, PAPERLESS_MCP_APP_DOMAIN, PAPERLESS_MCP_TOOLS_ALLOW, PAPERLESS_MCP_TOOLS_DENY, PAPERLESS_MCP_AUTH_MODE, PAPERLESS_MCP_BEARER_TOKENS_FILE, PAPERLESS_MCP_BEARER_DEFAULT_SUBJECT, PAPERLESS_MCP_SERVER_NAME, PAPERLESS_MCP_INSTANCE_DESCRIPTION, PAPERLESS_MCP_INSTRUCTIONS_EXTRA, PAPERLESS_MCP_INSTRUCTIONS, PAPERLESS_MCP_HTTP_PATH, PAPERLESS_MCP_HEALTH_DETAIL, PUID, PGID, PAPERLESS_MCP_LOG_LEVEL, PAPERLESS_MCP_LOG_FORMAT, PAPERLESS_MCP_PAPERLESS_URL, PAPERLESS_MCP_API_TOKEN, PAPERLESS_MCP_HTTP_TIMEOUT_SECONDS, PAPERLESS_MCP_HTTP_RETRIES, PAPERLESS_MCP_DEFAULT_PAGE_SIZE, PAPERLESS_MCP_PAPERLESS_PUBLIC_URL, PAPERLESS_MCP_TRANSFER_TTL_DEFAULT_S, PAPERLESS_MCP_TRANSFER_TTL_MAX_S, PAPERLESS_MCP_TRANSFER_GRACE_TTL_S, PAPERLESS_MCP_TRANSFER_LEASE_S, PAPERLESS_MCP_TRANSFER_MAX_UPLOAD_BYTES
2026-09-20Deklarierte Version: 2.0.0 → 2.1.0
2026-09-20Im Register geändert am (Rohangabe): 2026-09-17 → 2026-09-19
2026-09-20Im Register eingetragen am (Rohangabe): 2026-09-17 → 2026-09-19
2026-09-20Verbindungswege (Quellstruktur): {"packages":[{"registryType":"pypi","identifier":"pvliesdonk-paperless-mcp","version":"2.0.0","runtimeHint":"uvx","transport":"stdio","environment":[{"name":"PAPERLESS_MCP_KV_STORE_URL","description":"Persistent-state backend URL shared by every pvl-core subsystem that needs state. `memory://` is in-process and lost on restart; `file:///path` persists on one server; `redis://`, `dynamodb://` and `mongodb://` each need their matching extra. When unset, defaults to `file:///data/state` (the volume family Docker images mount), or to `memory://` (with a warning) on a host where that directory is not usable.","required":false,"secret":false},{"name":"PAPERLESS_MCP_TOOLS_ALLOW","description":"Comma-separated explicit tool names this instance exposes; every other tool is hidden from listings and cannot be invoked. Names matching no registered tool are inert. Mutually exclusive with `tools_deny`. Takes effect through `apply_tool_visibility`.","required":false,"secret":false},{"name":"PAPERLESS_MCP_TOOLS_DENY","description":"Comma-separated explicit tool names hidden from this instance (absent from listings, cannot be invoked). Names matching no registered tool are inert. Mutually exclusive with `tools_allow`. Takes effect through `apply_tool_visibility`.","required":false,"secret":false},{"name":"PAPERLESS_MCP_SERVER_NAME","description":"Rename this server instance; defaults to the project name.","required":false,"secret":false},{"name":"PAPERLESS_MCP_INSTANCE_DESCRIPTION","description":"Concise routing context that distinguishes this deployment's material or responsibility.","required":false,"secret":false},{"name":"PAPERLESS_MCP_INSTRUCTIONS_EXTRA","description":"Deployment-specific behavioral policy added to the generated MCP instructions.","required":false,"secret":false},{"name":"PAPERLESS_MCP_INSTRUCTIONS","description":"Legacy: replaces all generated MCP instructions (deprecated; use _INSTANCE_DESCRIPTION for routing and _INSTRUCTIONS_EXTRA for policy).","required":false,"secret":false},{"name":"FASTMCP_LOG_LEVEL","description":"Log level for FastMCP internals and app loggers (DEBUG / INFO / WARNING / ERROR / CRITICAL). The -v CLI flag overrides to DEBUG.","required":false,"secret":false},{"name":"FASTMCP_ENABLE_RICH_LOGGING","description":"Rich color output for a terminal; false gives one plain or JSON line per record. Off in the container image and the systemd unit, since neither is a terminal and Rich wraps a structured record at its 80-column fallback.","format":"boolean","required":false,"secret":false},{"name":"PAPERLESS_MCP_PAPERLESS_URL","description":"Base URL of the Paperless-NGX REST API, without a trailing slash. The server refuses to start without it.","required":false,"secret":false},{"name":"PAPERLESS_MCP_API_TOKEN","description":"Paperless service-account token used for outbound API requests. The server refuses to start without it.","required":false,"secret":true},{"name":"PAPERLESS_MCP_HTTP_TIMEOUT_SECONDS","description":"Per-request HTTP timeout in seconds.","format":"number","required":false,"secret":false},{"name":"PAPERLESS_MCP_HTTP_RETRIES","description":"Retries for idempotent requests after network errors or 5xx responses.","format":"number","required":false,"secret":false},{"name":"PAPERLESS_MCP_DEFAULT_PAGE_SIZE","description":"Default page size for list tools, from 1 through 100.","format":"number","required":false,"secret":false},{"name":"PAPERLESS_MCP_PAPERLESS_PUBLIC_URL","description":"Public Paperless UI URL for user-visible links; defaults to PAPERLESS_URL.","required":false,"secret":false}],"additional_arguments_declared":false},{"registryType":"oci","identifier":"ghcr.io/pvliesdonk/paperless-mcp:v2.0.0","transport":"streamable-http","environment":[{"name":"PAPERLESS_MCP_BASE_URL","description":"Public base URL of the deployed server, for example `https://mcp.example.com`. Required for OIDC. Also the fallback source of the MCP Apps domain when `app_domain` is unset.","required":false,"secret":false},{"name":"PAPERLESS_MCP_BEARER_TOKEN","description":"Single shared bearer token; enables bearer auth unless `bearer_tokens_file` is set, which takes precedence.","required":false,"secret":true},{"name":"PAPERLESS_MCP_OIDC_CONFIG_URL","description":"OIDC discovery document URL, for example `https://auth.example.com/.well-known/openid-configuration`.","required":false,"secret":false},{"name":"PAPERLESS_MCP_OIDC_CLIENT_ID","description":"OIDC client identifier registered with the provider.","required":false,"secret":false},{"name":"PAPERLESS_MCP_OIDC_CLIENT_SECRET","description":"OIDC client secret registered with the provider.","required":false,"secret":true},{"name":"PAPERLESS_MCP_OIDC_AUDIENCE","description":"Expected `aud` claim; tokens issued for another audience are rejected.","required":false,"secret":false},{"name":"PAPERLESS_MCP_OIDC_REQUIRED_SCOPES","description":"Scopes a caller must present, space- or comma-separated. Defaults to `openid` in oidc-proxy mode.","required":false,"secret":false},{"name":"PAPERLESS_MCP_OIDC_ADVERTISED_SCOPES","description":"Scopes advertised to MCP clients in protected-resource metadata, space- or comma-separated. Overrides the default `openid offline_access`; `oidc_required_scopes` is always added on top. Set this when the registered client is not permitted `offline_access`, or to have clients request extra claim scopes (such as `groups`) without also requiring them in every token.","required":false,"secret":false},{"name":"PAPERLESS_MCP_OIDC_JWT_SIGNING_KEY","description":"Signing key for issued tokens; used in oidc-proxy mode only. When unset, the key is derived deterministically from `oidc_client_secret`, so tokens survive a restart. Rotating that secret then invalidates every issued token. Set this explicitly to decouple token validity from secret rotation. Generate with `openssl rand -hex 32`.","required":false,"secret":true},{"name":"PAPERLESS_MCP_OIDC_VERIFY_ACCESS_TOKEN","description":"Validate the access token instead of the id token.","format":"boolean","required":false,"secret":false},{"name":"PAPERLESS_MCP_KV_STORE_URL","description":"Persistent-state backend URL shared by every pvl-core subsystem that needs state. `memory://` is in-process and lost on restart; `file:///path` persists on one server; `redis://`, `dynamodb://` and `mongodb://` each need their matching extra. When unset, defaults to `file:///data/state` (the volume family Docker images mount), or to `memory://` (with a warning) on a host where that directory is not usable.","required":false,"secret":false},{"name":"PAPERLESS_MCP_APP_DOMAIN","description":"MCP Apps iframe domain, used for CSP sandboxing. Overrides the host derived from `base_url`.","required":false,"secret":false},{"name":"PAPERLESS_MCP_TOOLS_ALLOW","description":"Comma-separated explicit tool names this instance exposes; every other tool is hidden from listings and cannot be invoked. Names matching no registered tool are inert. Mutually exclusive with `tools_deny`. Takes effect through `apply_tool_visibility`.","required":false,"secret":false},{"name":"PAPERLESS_MCP_TOOLS_DENY","description":"Comma-separated explicit tool names hidden from this instance (absent from listings, cannot be invoked). Names matching no registered tool are inert. Mutually exclusive with `tools_allow`. Takes effect through `apply_tool_visibility`.","required":false,"secret":false},{"name":"PAPERLESS_MCP_AUTH_MODE","description":"Explicit auth-mode override, accepting `remote` or `oidc-proxy` (case- and whitespace-insensitive). When unset the mode is auto-detected from which auth variables are set; the override exists because having all four OIDC variables set is ambiguous between those two modes. Other values are ignored with a warning.","required":false,"secret":false},{"name":"PAPERLESS_MCP_BEARER_TOKENS_FILE","description":"Path to a TOML file mapping bearer tokens to subjects; overrides the single-token `bearer_token` mode.","format":"filepath","required":false,"secret":false},{"name":"PAPERLESS_MCP_BEARER_DEFAULT_SUBJECT","description":"Subject assigned to the single-token bearer mode; ignored when `bearer_tokens_file` is set, since mapped mode carries per-token subjects.","required":false,"secret":false},{"name":"PAPERLESS_MCP_SERVER_NAME","description":"Rename this server instance; defaults to the project name.","required":false,"secret":false},{"name":"PAPERLESS_MCP_INSTANCE_DESCRIPTION","description":"Concise routing context that distinguishes this deployment's material or responsibility.","required":false,"secret":false},{"name":"PAPERLESS_MCP_INSTRUCTIONS_EXTRA","description":"Deployment-specific behavioral policy added to the generated MCP instructions.","required":false,"secret":false},{"name":"PAPERLESS_MCP_INSTRUCTIONS","description":"Legacy: replaces all generated MCP instructions (deprecated; use _INSTANCE_DESCRIPTION for routing and _INSTRUCTIONS_EXTRA for policy).","required":false,"secret":false},{"name":"PAPERLESS_MCP_HTTP_PATH","description":"Mount path for the MCP endpoint; the health routes derive their prefix from it.","required":false,"secret":false},{"name":"PAPERLESS_MCP_HEALTH_DETAIL","description":"How much the unauthenticated /health and /health/ready bodies say: status, standard (adds name, version and per-check verdicts), or full (adds redacted reasons; trusted networks only).","required":false,"secret":false},{"name":"PUID","description":"Run the server process as this UID; the container entrypoint reassigns ownership of writable paths to match.","format":"number","required":false,"secret":false},{"name":"PGID","description":"Run the server process as this GID; pair with PUID to match the owner of a mounted volume.","format":"number","required":false,"secret":false},{"name":"FASTMCP_LOG_LEVEL","description":"Log level for FastMCP internals and app loggers (DEBUG / INFO / WARNING / ERROR / CRITICAL). The -v CLI flag overrides to DEBUG.","required":false,"secret":false},{"name":"FASTMCP_ENABLE_RICH_LOGGING","description":"Rich color output for a terminal; false gives one plain or JSON line per record. Off in the container image and the systemd unit, since neither is a terminal and Rich wraps a structured record at its 80-column fallback.","format":"boolean","required":false,"secret":false},{"name":"PAPERLESS_MCP_PAPERLESS_URL","description":"Base URL of the Paperless-NGX REST API, without a trailing slash. The server refuses to start without it.","required":false,"secret":false},{"name":"PAPERLESS_MCP_API_TOKEN","description":"Paperless service-account token used for outbound API requests. The server refuses to start without it.","required":false,"secret":true},{"name":"PAPERLESS_MCP_HTTP_TIMEOUT_SECONDS","description":"Per-request HTTP timeout in seconds.","format":"number","required":false,"secret":false},{"name":"PAPERLESS_MCP_HTTP_RETRIES","description":"Retries for idempotent requests after network errors or 5xx responses.","format":"number","required":false,"secret":false},{"name":"PAPERLESS_MCP_DEFAULT_PAGE_SIZE","description":"Default page size for list tools, from 1 through 100.","format":"number","required":false,"secret":false},{"name":"PAPERLESS_MCP_PAPERLESS_PUBLIC_URL","description":"Public Paperless UI URL for user-visible links; defaults to PAPERLESS_URL.","required":false,"secret":false}],"additional_arguments_declared":true}],"remotes":[]} → {"packages":[{"registryType":"pypi","identifier":"pvliesdonk-paperless-mcp","version":"2.1.0","runtimeHint":"uvx","transport":"stdio","environment":[{"name":"PAPERLESS_MCP_KV_STORE_URL","description":"Persistent-state backend URL shared by every pvl-core subsystem that needs state. `memory://` is in-process and lost on restart; `file:///path` persists on one server; `redis://`, `dynamodb://` and `mongodb://` each need their matching extra. When unset, defaults to `file:///data/state` (the volume family Docker images mount), or to `memory://` (with a warning) on a host where that directory is not usable.","required":false,"secret":false},{"name":"PAPERLESS_MCP_TOOLS_ALLOW","description":"Comma-separated explicit tool names this instance exposes; every other tool is hidden from listings and cannot be invoked. Names matching no registered tool are inert. Mutually exclusive with `tools_deny`. Takes effect through `apply_tool_visibility`.","required":false,"secret":false},{"name":"PAPERLESS_MCP_TOOLS_DENY","description":"Comma-separated explicit tool names hidden from this instance (absent from listings, cannot be invoked). Names matching no registered tool are inert. Mutually exclusive with `tools_allow`. Takes effect through `apply_tool_visibility`.","required":false,"secret":false},{"name":"PAPERLESS_MCP_SERVER_NAME","description":"Rename this server instance; defaults to the project name.","required":false,"secret":false},{"name":"PAPERLESS_MCP_INSTANCE_DESCRIPTION","description":"Concise routing context that distinguishes this deployment's material or responsibility.","required":false,"secret":false},{"name":"PAPERLESS_MCP_INSTRUCTIONS_EXTRA","description":"Deployment-specific behavioral policy added to the generated MCP instructions.","required":false,"secret":false},{"name":"PAPERLESS_MCP_INSTRUCTIONS","description":"Legacy: replaces all generated MCP instructions (deprecated; use _INSTANCE_DESCRIPTION for routing and _INSTRUCTIONS_EXTRA for policy).","required":false,"secret":false},{"name":"FASTMCP_LOG_LEVEL","description":"Log level for FastMCP internals and app loggers (DEBUG / INFO / WARNING / ERROR / CRITICAL). The -v CLI flag overrides to DEBUG.","required":false,"secret":false},{"name":"FASTMCP_ENABLE_RICH_LOGGING","description":"Rich color output for a terminal; false gives one plain or JSON line per record. Off in the container image and the systemd unit, since neither is a terminal and Rich wraps a structured record at its 80-column fallback.","format":"boolean","required":false,"secret":false},{"name":"PAPERLESS_MCP_PAPERLESS_URL","description":"Base URL of the Paperless-NGX REST API, without a trailing slash. The server refuses to start without it.","required":false,"secret":false},{"name":"PAPERLESS_MCP_API_TOKEN","description":"Paperless service-account token used for outbound API requests. The server refuses to start without it.","required":false,"secret":true},{"name":"PAPERLESS_MCP_HTTP_TIMEOUT_SECONDS","description":"Per-request HTTP timeout in seconds.","format":"number","required":false,"secret":false},{"name":"PAPERLESS_MCP_HTTP_RETRIES","description":"Retries for idempotent requests after network errors or 5xx responses.","format":"number","required":false,"secret":false},{"name":"PAPERLESS_MCP_DEFAULT_PAGE_SIZE","description":"Default page size for list tools, from 1 through 100.","format":"number","required":false,"secret":false},{"name":"PAPERLESS_MCP_PAPERLESS_PUBLIC_URL","description":"Public Paperless UI URL for user-visible links; defaults to PAPERLESS_URL.","required":false,"secret":false}],"additional_arguments_declared":false},{"registryType":"oci","identifier":"ghcr.io/pvliesdonk/paperless-mcp:v2.1.0","transport":"streamable-http","environment":[{"name":"PAPERLESS_MCP_BASE_URL","description":"Public base URL of the deployed server, for example `https://mcp.example.com`. Required for OIDC. Also the fallback source of the MCP Apps domain when `app_domain` is unset.","required":false,"secret":false},{"name":"PAPERLESS_MCP_BEARER_TOKEN","description":"Single shared bearer token; enables bearer auth unless `bearer_tokens_file` is set, which takes precedence.","required":false,"secret":true},{"name":"PAPERLESS_MCP_OIDC_CONFIG_URL","description":"OIDC discovery document URL, for example `https://auth.example.com/.well-known/openid-configuration`.","required":false,"secret":false},{"name":"PAPERLESS_MCP_OIDC_CLIENT_ID","description":"OIDC client identifier registered with the provider.","required":false,"secret":false},{"name":"PAPERLESS_MCP_OIDC_CLIENT_SECRET","description":"OIDC client secret registered with the provider.","required":false,"secret":true},{"name":"PAPERLESS_MCP_OIDC_AUDIENCE","description":"Expected `aud` claim; tokens issued for another audience are rejected.","required":false,"secret":false},{"name":"PAPERLESS_MCP_OIDC_REQUIRED_SCOPES","description":"Scopes a caller must present, space- or comma-separated. Defaults to `openid` in oidc-proxy mode.","required":false,"secret":false},{"name":"PAPERLESS_MCP_OIDC_ADVERTISED_SCOPES","description":"Scopes advertised to MCP clients in protected-resource metadata, space- or comma-separated. Overrides the default `openid offline_access`; `oidc_required_scopes` is always added on top. Set this when the registered client is not permitted `offline_access`, or to have clients request extra claim scopes (such as `groups`) without also requiring them in every token.","required":false,"secret":false},{"name":"PAPERLESS_MCP_OIDC_JWT_SIGNING_KEY","description":"Signing key for issued tokens; used in oidc-proxy mode only. When unset, the key is derived deterministically from `oidc_client_secret`, so tokens survive a restart. Rotating that secret then invalidates every issued token. Set this explicitly to decouple token validity from secret rotation. Generate with `openssl rand -hex 32`.","required":false,"secret":true},{"name":"PAPERLESS_MCP_OIDC_VERIFY_ACCESS_TOKEN","description":"Validate the access token instead of the id token.","format":"boolean","required":false,"secret":false},{"name":"PAPERLESS_MCP_KV_STORE_URL","description":"Persistent-state backend URL shared by every pvl-core subsystem that needs state. `memory://` is in-process and lost on restart; `file:///path` persists on one server; `redis://`, `dynamodb://` and `mongodb://` each need their matching extra. When unset, defaults to `file:///data/state` (the volume family Docker images mount), or to `memory://` (with a warning) on a host where that directory is not usable.","required":false,"secret":false},{"name":"PAPERLESS_MCP_APP_DOMAIN","description":"MCP Apps iframe domain, used for CSP sandboxing. Overrides the host derived from `base_url`.","required":false,"secret":false},{"name":"PAPERLESS_MCP_TOOLS_ALLOW","description":"Comma-separated explicit tool names this instance exposes; every other tool is hidden from listings and cannot be invoked. Names matching no registered tool are inert. Mutually exclusive with `tools_deny`. Takes effect through `apply_tool_visibility`.","required":false,"secret":false},{"name":"PAPERLESS_MCP_TOOLS_DENY","description":"Comma-separated explicit tool names hidden from this instance (absent from listings, cannot be invoked). Names matching no registered tool are inert. Mutually exclusive with `tools_allow`. Takes effect through `apply_tool_visibility`.","required":false,"secret":false},{"name":"PAPERLESS_MCP_AUTH_MODE","description":"Explicit auth-mode override, accepting `remote` or `oidc-proxy` (case- and whitespace-insensitive). When unset the mode is auto-detected from which auth variables are set; the override exists because having all four OIDC variables set is ambiguous between those two modes. Other values are ignored with a warning.","required":false,"secret":false},{"name":"PAPERLESS_MCP_BEARER_TOKENS_FILE","description":"Path to a TOML file mapping bearer tokens to subjects; overrides the single-token `bearer_token` mode.","format":"filepath","required":false,"secret":false},{"name":"PAPERLESS_MCP_BEARER_DEFAULT_SUBJECT","description":"Subject assigned to the single-token bearer mode; ignored when `bearer_tokens_file` is set, since mapped mode carries per-token subjects.","required":false,"secret":false},{"name":"PAPERLESS_MCP_SERVER_NAME","description":"Rename this server instance; defaults to the project name.","required":false,"secret":false},{"name":"PAPERLESS_MCP_INSTANCE_DESCRIPTION","description":"Concise routing context that distinguishes this deployment's material or responsibility.","required":false,"secret":false},{"name":"PAPERLESS_MCP_INSTRUCTIONS_EXTRA","description":"Deployment-specific behavioral policy added to the generated MCP instructions.","required":false,"secret":false},{"name":"PAPERLESS_MCP_INSTRUCTIONS","description":"Legacy: replaces all generated MCP instructions (deprecated; use _INSTANCE_DESCRIPTION for routing and _INSTRUCTIONS_EXTRA for policy).","required":false,"secret":false},{"name":"PAPERLESS_MCP_HTTP_PATH","description":"Mount path for the MCP endpoint; the health routes derive their prefix from it.","required":false,"secret":false},{"name":"PAPERLESS_MCP_HEALTH_DETAIL","description":"How much the unauthenticated /health and /health/ready bodies say: status, standard (adds name, version and per-check verdicts), or full (adds redacted reasons; trusted networks only).","required":false,"secret":false},{"name":"PUID","description":"Run the server process as this UID; the container entrypoint reassigns ownership of writable paths to match.","format":"number","required":false,"secret":false},{"name":"PGID","description":"Run the server process as this GID; pair with PUID to match the owner of a mounted volume.","format":"number","required":false,"secret":false},{"name":"FASTMCP_LOG_LEVEL","description":"Log level for FastMCP internals and app loggers (DEBUG / INFO / WARNING / ERROR / CRITICAL). The -v CLI flag overrides to DEBUG.","required":false,"secret":false},{"name":"FASTMCP_ENABLE_RICH_LOGGING","description":"Rich color output for a terminal; false gives one plain or JSON line per record. Off in the container image and the systemd unit, since neither is a terminal and Rich wraps a structured record at its 80-column fallback.","format":"boolean","required":false,"secret":false},{"name":"PAPERLESS_MCP_PAPERLESS_URL","description":"Base URL of the Paperless-NGX REST API, without a trailing slash. The server refuses to start without it.","required":false,"secret":false},{"name":"PAPERLESS_MCP_API_TOKEN","description":"Paperless service-account token used for outbound API requests. The server refuses to start without it.","required":false,"secret":true},{"name":"PAPERLESS_MCP_HTTP_TIMEOUT_SECONDS","description":"Per-request HTTP timeout in seconds.","format":"number","required":false,"secret":false},{"name":"PAPERLESS_MCP_HTTP_RETRIES","description":"Retries for idempotent requests after network errors or 5xx responses.","format":"number","required":false,"secret":false},{"name":"PAPERLESS_MCP_DEFAULT_PAGE_SIZE","description":"Default page size for list tools, from 1 through 100.","format":"number","required":false,"secret":false},{"name":"PAPERLESS_MCP_PAPERLESS_PUBLIC_URL","description":"Public Paperless UI URL for user-visible links; defaults to PAPERLESS_URL.","required":false,"secret":false}],"additional_arguments_declared":true}],"remotes":[]}
2026-09-20Paketversionen (Rohangabe): 2.0.0 → 2.1.0
2026-09-20Paketbezeichner (Rohangabe): ghcr.io/pvliesdonk/paperless-mcp:v2.0.0, pvliesdonk-paperless-mcp → ghcr.io/pvliesdonk/paperless-mcp:v2.1.0, pvliesdonk-paperless-mcp
2026-09-18Deklarierte Version: – → 2.0.0
2026-09-18Einsatzgebiet, aus der Anbieterbeschreibung abgeleitet: – → Dokument
2026-09-18Repository-Adresse geführt: – → ja
2026-09-18Pfadargument vorhanden: – → ja
2026-09-18Ausführungsort: – → lokal
2026-09-18Pflicht-Geheimnisse deklariert: – → nein
2026-09-18Beschreibung (Rohangabe): – → Paperless-NGX over MCP: search, read, upload and tag documents; manage correspondents and types.
2026-09-18Im Register geändert am (Rohangabe): – → 2026-09-17
2026-09-18Im Register eingetragen am (Rohangabe): – → 2026-09-17
2026-09-18Statusmeldung des Registers (Rohangabe): – → –
2026-09-18Schemafassung des Rohsatzes (Rohangabe): – → https://static.modelcontextprotocol.io/schemas/2025-12-11/server.schema.json
2026-09-18Symbolformate (Rohangabe): – → –
2026-09-18Beschreibungen der Umgebungsvariablen (Rohangabe): – → FASTMCP_ENABLE_RICH_LOGGING=Rich color output for a terminal; false gives one plain or JSON line per record. Off in the container image and the systemd unit, since neither is a terminal and Rich wraps a structured record at its 80-column fallback. · FASTMCP_LOG_LEVEL=Log level for FastMCP internals and app loggers (DEBUG / INFO / WARNING / ERROR / CRITICAL). The -v CLI flag overrides to DEBUG. · PAPERLESS_MCP_API_TOKEN=Paperless service-account token used for outbound API requests. The server refuses to start without it. · PAPERLESS_MCP_APP_DOMAIN=MCP Apps iframe domain, used for CSP sandboxing. Overrides the host derived from `base_url`. · PAPERLESS_MCP_AUTH_MODE=Explicit auth-mode override, accepting `remote` or `oidc-proxy` (case- and whitespace-insensitive). When unset the mode is auto-detected from which auth variables are set; the override exists because having all four OIDC variables set is ambiguous between those two modes. Other values are ignored with a warning. · PAPERLESS_MCP_BASE_URL=Public base URL of the deployed server, for example `https://mcp.example.com`. Required for OIDC. Also the fallback source of the MCP Apps domain when `app_domain` is unset. · PAPERLESS_MCP_BEARER_DEFAULT_SUBJECT=Subject assigned to the single-token bearer mode; ignored when `bearer_tokens_file` is set, since mapped mode carries per-token subjects. · PAPERLESS_MCP_BEARER_TOKEN=Single shared bearer token; enables bearer auth unless `bearer_tokens_file` is set, which takes precedence. · PAPERLESS_MCP_BEARER_TOKENS_FILE=Path to a TOML file mapping bearer tokens to subjects; overrides the single-token `bearer_token` mode. · PAPERLESS_MCP_DEFAULT_PAGE_SIZE=Default page size for list tools, from 1 through 100. · PAPERLESS_MCP_HEALTH_DETAIL=How much the unauthenticated /health and /health/ready bodies say: status, standard (adds name, version and per-check verdicts), or full (adds redacted reasons; trusted networks only). · PAPERLESS_MCP_HTTP_PATH=Mount path for the MCP endpoint; the health routes derive their prefix from it. · PAPERLESS_MCP_HTTP_RETRIES=Retries for idempotent requests after network errors or 5xx responses. · PAPERLESS_MCP_HTTP_TIMEOUT_SECONDS=Per-request HTTP timeout in seconds. · PAPERLESS_MCP_INSTANCE_DESCRIPTION=Concise routing context that distinguishes this deployment's material or responsibility. · PAPERLESS_MCP_INSTRUCTIONS=Legacy: replaces all generated MCP instructions (deprecated; use _INSTANCE_DESCRIPTION for routing and _INSTRUCTIONS_EXTRA for policy). · PAPERLESS_MCP_INSTRUCTIONS_EXTRA=Deployment-specific behavioral policy added to the generated MCP instructions. · PAPERLESS_MCP_KV_STORE_URL=Persistent-state backend URL shared by every pvl-core subsystem that needs state. `memory://` is in-process and lost on restart; `file:///path` persists on one server; `redis://`, `dynamodb://` and `mongodb://` each need their matching extra. When unset, defaults to `file:///data/state` (the volume family Docker images mount), or to `memory://` (with a warning) on a host where that directory is not usable. · PAPERLESS_MCP_OIDC_ADVERTISED_SCOPES=Scopes advertised to MCP clients in protected-resource metadata, space- or comma-separated. Overrides the default `openid offline_access`; `oidc_required_scopes` is always added on top. Set this when the registered client is not permitted `offline_access`, or to have clients request extra claim scopes (such as `groups`) without also requiring them in every token. · PAPERLESS_MCP_OIDC_AUDIENCE=Expected `aud` claim; tokens issued for another audience are rejected. · PAPERLESS_MCP_OIDC_CLIENT_ID=OIDC client identifier registered with the provider. · PAPERLESS_MCP_OIDC_CLIENT_SECRET=OIDC client secret registered with the provider. · PAPERLESS_MCP_OIDC_CONFIG_URL=OIDC discovery document URL, for example `https://auth.example.com/.well-known/openid-configuration`. · PAPERLESS_MCP_OIDC_JWT_SIGNING_KEY=Signing key for issued tokens; used in oidc-proxy mode only. When unset, the key is derived deterministically from `oidc_client_secret`, so tokens survive a restart. Rotating that secret then invalidates every issued token. Set this explicitly to decouple token validity from secret rotation. Generate with `openssl rand -hex 32`. · PAPERLESS_MCP_OIDC_REQUIRED_SCOPES=Scopes a caller must present, space- or comma-separated. Defaults to `openid` in oidc-proxy mode. · PAPERLESS_MCP_OIDC_VERIFY_ACCESS_TOKEN=Validate the access token instead of the id token. · PAPERLESS_MCP_PAPERLESS_PUBLIC_URL=Public Paperless UI URL for user-visible links; defaults to PAPERLESS_URL. · PAPERLESS_MCP_PAPERLESS_URL=Base URL of the Paperless-NGX REST API, without a trailing slash. The server refuses to start without it. · PAPERLESS_MCP_SERVER_NAME=Rename this server instance; defaults to the project name. · PAPERLESS_MCP_TOOLS_ALLOW=Comma-separated explicit tool names this instance exposes; every other tool is hidden from listings and cannot be invoked. Names matching no registered tool are inert. Mutually exclusive with `tools_deny`. Takes effect through `apply_tool_visibility`. · PAPERLESS_MCP_TOOLS_DENY=Comma-separated explicit tool names hidden from this instance (absent from listings, cannot be invoked). Names matching no registered tool are inert. Mutually exclusive with `tools_allow`. Takes effect through `apply_tool_visibility`. · PGID=Run the server process as this GID; pair with PUID to match the owner of a mounted volume. · PUID=Run the server process as this UID; the container entrypoint reassigns ownership of writable paths to match.
2026-09-18Formate der Umgebungsvariablen (Rohangabe): – → boolean, filepath, number
2026-09-18Bereitstellungsform (Rohangabe): – → paket
2026-09-18Remote-Hosts (Rohangabe): – → –
2026-09-18Verbindungswege (Quellstruktur): – → {"packages":[{"registryType":"pypi","identifier":"pvliesdonk-paperless-mcp","version":"2.0.0","runtimeHint":"uvx","transport":"stdio","environment":[{"name":"PAPERLESS_MCP_KV_STORE_URL","description":"Persistent-state backend URL shared by every pvl-core subsystem that needs state. `memory://` is in-process and lost on restart; `file:///path` persists on one server; `redis://`, `dynamodb://` and `mongodb://` each need their matching extra. When unset, defaults to `file:///data/state` (the volume family Docker images mount), or to `memory://` (with a warning) on a host where that directory is not usable.","required":false,"secret":false},{"name":"PAPERLESS_MCP_TOOLS_ALLOW","description":"Comma-separated explicit tool names this instance exposes; every other tool is hidden from listings and cannot be invoked. Names matching no registered tool are inert. Mutually exclusive with `tools_deny`. Takes effect through `apply_tool_visibility`.","required":false,"secret":false},{"name":"PAPERLESS_MCP_TOOLS_DENY","description":"Comma-separated explicit tool names hidden from this instance (absent from listings, cannot be invoked). Names matching no registered tool are inert. Mutually exclusive with `tools_allow`. Takes effect through `apply_tool_visibility`.","required":false,"secret":false},{"name":"PAPERLESS_MCP_SERVER_NAME","description":"Rename this server instance; defaults to the project name.","required":false,"secret":false},{"name":"PAPERLESS_MCP_INSTANCE_DESCRIPTION","description":"Concise routing context that distinguishes this deployment's material or responsibility.","required":false,"secret":false},{"name":"PAPERLESS_MCP_INSTRUCTIONS_EXTRA","description":"Deployment-specific behavioral policy added to the generated MCP instructions.","required":false,"secret":false},{"name":"PAPERLESS_MCP_INSTRUCTIONS","description":"Legacy: replaces all generated MCP instructions (deprecated; use _INSTANCE_DESCRIPTION for routing and _INSTRUCTIONS_EXTRA for policy).","required":false,"secret":false},{"name":"FASTMCP_LOG_LEVEL","description":"Log level for FastMCP internals and app loggers (DEBUG / INFO / WARNING / ERROR / CRITICAL). The -v CLI flag overrides to DEBUG.","required":false,"secret":false},{"name":"FASTMCP_ENABLE_RICH_LOGGING","description":"Rich color output for a terminal; false gives one plain or JSON line per record. Off in the container image and the systemd unit, since neither is a terminal and Rich wraps a structured record at its 80-column fallback.","format":"boolean","required":false,"secret":false},{"name":"PAPERLESS_MCP_PAPERLESS_URL","description":"Base URL of the Paperless-NGX REST API, without a trailing slash. The server refuses to start without it.","required":false,"secret":false},{"name":"PAPERLESS_MCP_API_TOKEN","description":"Paperless service-account token used for outbound API requests. The server refuses to start without it.","required":false,"secret":true},{"name":"PAPERLESS_MCP_HTTP_TIMEOUT_SECONDS","description":"Per-request HTTP timeout in seconds.","format":"number","required":false,"secret":false},{"name":"PAPERLESS_MCP_HTTP_RETRIES","description":"Retries for idempotent requests after network errors or 5xx responses.","format":"number","required":false,"secret":false},{"name":"PAPERLESS_MCP_DEFAULT_PAGE_SIZE","description":"Default page size for list tools, from 1 through 100.","format":"number","required":false,"secret":false},{"name":"PAPERLESS_MCP_PAPERLESS_PUBLIC_URL","description":"Public Paperless UI URL for user-visible links; defaults to PAPERLESS_URL.","required":false,"secret":false}],"additional_arguments_declared":false},{"registryType":"oci","identifier":"ghcr.io/pvliesdonk/paperless-mcp:v2.0.0","transport":"streamable-http","environment":[{"name":"PAPERLESS_MCP_BASE_URL","description":"Public base URL of the deployed server, for example `https://mcp.example.com`. Required for OIDC. Also the fallback source of the MCP Apps domain when `app_domain` is unset.","required":false,"secret":false},{"name":"PAPERLESS_MCP_BEARER_TOKEN","description":"Single shared bearer token; enables bearer auth unless `bearer_tokens_file` is set, which takes precedence.","required":false,"secret":true},{"name":"PAPERLESS_MCP_OIDC_CONFIG_URL","description":"OIDC discovery document URL, for example `https://auth.example.com/.well-known/openid-configuration`.","required":false,"secret":false},{"name":"PAPERLESS_MCP_OIDC_CLIENT_ID","description":"OIDC client identifier registered with the provider.","required":false,"secret":false},{"name":"PAPERLESS_MCP_OIDC_CLIENT_SECRET","description":"OIDC client secret registered with the provider.","required":false,"secret":true},{"name":"PAPERLESS_MCP_OIDC_AUDIENCE","description":"Expected `aud` claim; tokens issued for another audience are rejected.","required":false,"secret":false},{"name":"PAPERLESS_MCP_OIDC_REQUIRED_SCOPES","description":"Scopes a caller must present, space- or comma-separated. Defaults to `openid` in oidc-proxy mode.","required":false,"secret":false},{"name":"PAPERLESS_MCP_OIDC_ADVERTISED_SCOPES","description":"Scopes advertised to MCP clients in protected-resource metadata, space- or comma-separated. Overrides the default `openid offline_access`; `oidc_required_scopes` is always added on top. Set this when the registered client is not permitted `offline_access`, or to have clients request extra claim scopes (such as `groups`) without also requiring them in every token.","required":false,"secret":false},{"name":"PAPERLESS_MCP_OIDC_JWT_SIGNING_KEY","description":"Signing key for issued tokens; used in oidc-proxy mode only. When unset, the key is derived deterministically from `oidc_client_secret`, so tokens survive a restart. Rotating that secret then invalidates every issued token. Set this explicitly to decouple token validity from secret rotation. Generate with `openssl rand -hex 32`.","required":false,"secret":true},{"name":"PAPERLESS_MCP_OIDC_VERIFY_ACCESS_TOKEN","description":"Validate the access token instead of the id token.","format":"boolean","required":false,"secret":false},{"name":"PAPERLESS_MCP_KV_STORE_URL","description":"Persistent-state backend URL shared by every pvl-core subsystem that needs state. `memory://` is in-process and lost on restart; `file:///path` persists on one server; `redis://`, `dynamodb://` and `mongodb://` each need their matching extra. When unset, defaults to `file:///data/state` (the volume family Docker images mount), or to `memory://` (with a warning) on a host where that directory is not usable.","required":false,"secret":false},{"name":"PAPERLESS_MCP_APP_DOMAIN","description":"MCP Apps iframe domain, used for CSP sandboxing. Overrides the host derived from `base_url`.","required":false,"secret":false},{"name":"PAPERLESS_MCP_TOOLS_ALLOW","description":"Comma-separated explicit tool names this instance exposes; every other tool is hidden from listings and cannot be invoked. Names matching no registered tool are inert. Mutually exclusive with `tools_deny`. Takes effect through `apply_tool_visibility`.","required":false,"secret":false},{"name":"PAPERLESS_MCP_TOOLS_DENY","description":"Comma-separated explicit tool names hidden from this instance (absent from listings, cannot be invoked). Names matching no registered tool are inert. Mutually exclusive with `tools_allow`. Takes effect through `apply_tool_visibility`.","required":false,"secret":false},{"name":"PAPERLESS_MCP_AUTH_MODE","description":"Explicit auth-mode override, accepting `remote` or `oidc-proxy` (case- and whitespace-insensitive). When unset the mode is auto-detected from which auth variables are set; the override exists because having all four OIDC variables set is ambiguous between those two modes. Other values are ignored with a warning.","required":false,"secret":false},{"name":"PAPERLESS_MCP_BEARER_TOKENS_FILE","description":"Path to a TOML file mapping bearer tokens to subjects; overrides the single-token `bearer_token` mode.","format":"filepath","required":false,"secret":false},{"name":"PAPERLESS_MCP_BEARER_DEFAULT_SUBJECT","description":"Subject assigned to the single-token bearer mode; ignored when `bearer_tokens_file` is set, since mapped mode carries per-token subjects.","required":false,"secret":false},{"name":"PAPERLESS_MCP_SERVER_NAME","description":"Rename this server instance; defaults to the project name.","required":false,"secret":false},{"name":"PAPERLESS_MCP_INSTANCE_DESCRIPTION","description":"Concise routing context that distinguishes this deployment's material or responsibility.","required":false,"secret":false},{"name":"PAPERLESS_MCP_INSTRUCTIONS_EXTRA","description":"Deployment-specific behavioral policy added to the generated MCP instructions.","required":false,"secret":false},{"name":"PAPERLESS_MCP_INSTRUCTIONS","description":"Legacy: replaces all generated MCP instructions (deprecated; use _INSTANCE_DESCRIPTION for routing and _INSTRUCTIONS_EXTRA for policy).","required":false,"secret":false},{"name":"PAPERLESS_MCP_HTTP_PATH","description":"Mount path for the MCP endpoint; the health routes derive their prefix from it.","required":false,"secret":false},{"name":"PAPERLESS_MCP_HEALTH_DETAIL","description":"How much the unauthenticated /health and /health/ready bodies say: status, standard (adds name, version and per-check verdicts), or full (adds redacted reasons; trusted networks only).","required":false,"secret":false},{"name":"PUID","description":"Run the server process as this UID; the container entrypoint reassigns ownership of writable paths to match.","format":"number","required":false,"secret":false},{"name":"PGID","description":"Run the server process as this GID; pair with PUID to match the owner of a mounted volume.","format":"number","required":false,"secret":false},{"name":"FASTMCP_LOG_LEVEL","description":"Log level for FastMCP internals and app loggers (DEBUG / INFO / WARNING / ERROR / CRITICAL). The -v CLI flag overrides to DEBUG.","required":false,"secret":false},{"name":"FASTMCP_ENABLE_RICH_LOGGING","description":"Rich color output for a terminal; false gives one plain or JSON line per record. Off in the container image and the systemd unit, since neither is a terminal and Rich wraps a structured record at its 80-column fallback.","format":"boolean","required":false,"secret":false},{"name":"PAPERLESS_MCP_PAPERLESS_URL","description":"Base URL of the Paperless-NGX REST API, without a trailing slash. The server refuses to start without it.","required":false,"secret":false},{"name":"PAPERLESS_MCP_API_TOKEN","description":"Paperless service-account token used for outbound API requests. The server refuses to start without it.","required":false,"secret":true},{"name":"PAPERLESS_MCP_HTTP_TIMEOUT_SECONDS","description":"Per-request HTTP timeout in seconds.","format":"number","required":false,"secret":false},{"name":"PAPERLESS_MCP_HTTP_RETRIES","description":"Retries for idempotent requests after network errors or 5xx responses.","format":"number","required":false,"secret":false},{"name":"PAPERLESS_MCP_DEFAULT_PAGE_SIZE","description":"Default page size for list tools, from 1 through 100.","format":"number","required":false,"secret":false},{"name":"PAPERLESS_MCP_PAPERLESS_PUBLIC_URL","description":"Public Paperless UI URL for user-visible links; defaults to PAPERLESS_URL.","required":false,"secret":false}],"additional_arguments_declared":true}],"remotes":[]}
2026-09-18Remote-Adressen (Rohangabe): – → –
2026-09-18Laufzeithinweise (Rohangabe): – → uvx
2026-09-18Paketversionen (Rohangabe): – → 2.0.0
2026-09-18Paketbezeichner (Rohangabe): – → ghcr.io/pvliesdonk/paperless-mcp:v2.0.0, pvliesdonk-paperless-mcp
2026-09-18Paketquellen (Rohangabe): – → oci, pypi
2026-09-18Repository-Unterordner (Rohangabe): – → –
2026-09-18Repository-Plattform (Rohangabe): – → github
2026-09-18Repository (Rohangabe): – → https://github.com/pvliesdonk/paperless-mcp
2026-09-18Pfad-Umgebungsvariablen (Rohangabe): – → PAPERLESS_MCP_BEARER_TOKENS_FILE
2026-09-18Pfadargumente (Rohangabe): – → –
2026-09-18Transportarten (Rohangabe): – → stdio, streamable-http
2026-09-18Geheime Pflichtkopfzeilen (Rohangabe): – → –
2026-09-18Geheime Pflichtvariablen (Rohangabe): – → –
2026-09-18Umgebungsvariablen (Rohangabe): – → PAPERLESS_MCP_KV_STORE_URL, PAPERLESS_MCP_TOOLS_ALLOW, PAPERLESS_MCP_TOOLS_DENY, PAPERLESS_MCP_SERVER_NAME, PAPERLESS_MCP_INSTANCE_DESCRIPTION, PAPERLESS_MCP_INSTRUCTIONS_EXTRA, PAPERLESS_MCP_INSTRUCTIONS, FASTMCP_LOG_LEVEL, FASTMCP_ENABLE_RICH_LOGGING, PAPERLESS_MCP_PAPERLESS_URL, PAPERLESS_MCP_API_TOKEN, PAPERLESS_MCP_HTTP_TIMEOUT_SECONDS, PAPERLESS_MCP_HTTP_RETRIES, PAPERLESS_MCP_DEFAULT_PAGE_SIZE, PAPERLESS_MCP_PAPERLESS_PUBLIC_URL, PAPERLESS_MCP_BASE_URL, PAPERLESS_MCP_BEARER_TOKEN, PAPERLESS_MCP_OIDC_CONFIG_URL, PAPERLESS_MCP_OIDC_CLIENT_ID, PAPERLESS_MCP_OIDC_CLIENT_SECRET, PAPERLESS_MCP_OIDC_AUDIENCE, PAPERLESS_MCP_OIDC_REQUIRED_SCOPES, PAPERLESS_MCP_OIDC_ADVERTISED_SCOPES, PAPERLESS_MCP_OIDC_JWT_SIGNING_KEY, PAPERLESS_MCP_OIDC_VERIFY_ACCESS_TOKEN, PAPERLESS_MCP_KV_STORE_URL, PAPERLESS_MCP_APP_DOMAIN, PAPERLESS_MCP_TOOLS_ALLOW, PAPERLESS_MCP_TOOLS_DENY, PAPERLESS_MCP_AUTH_MODE, PAPERLESS_MCP_BEARER_TOKENS_FILE, PAPERLESS_MCP_BEARER_DEFAULT_SUBJECT, PAPERLESS_MCP_SERVER_NAME, PAPERLESS_MCP_INSTANCE_DESCRIPTION, PAPERLESS_MCP_INSTRUCTIONS_EXTRA, PAPERLESS_MCP_INSTRUCTIONS, PAPERLESS_MCP_HTTP_PATH, PAPERLESS_MCP_HEALTH_DETAIL, PUID, PGID, FASTMCP_LOG_LEVEL, FASTMCP_ENABLE_RICH_LOGGING, PAPERLESS_MCP_PAPERLESS_URL, PAPERLESS_MCP_API_TOKEN, PAPERLESS_MCP_HTTP_TIMEOUT_SECONDS, PAPERLESS_MCP_HTTP_RETRIES, PAPERLESS_MCP_DEFAULT_PAGE_SIZE, PAPERLESS_MCP_PAPERLESS_PUBLIC_URL

tracevero · https://tracevero.de/mcp/io-github-pvliesdonk-paperless-mcp/aenderungen