{"name":"io.github.pvliesdonk/paperless-mcp","slug":"pvliesdonk-paperless-mcp","title":"Paperless MCP","description":"Paperless-NGX over MCP: search, read, upload and tag documents; manage correspondents and types.","url":"https://mcp.market/server/pvliesdonk-paperless-mcp","rating":null,"grade":"B","score":83,"certified":false,"status":"active","category":"search","tags":["search"],"presence":{"score":34,"stars":1,"forks":0,"downloads_week":334,"last_push_at":"2026-09-19T20:02:00.000Z","license":"NOASSERTION"},"uptime":null,"claimed":false,"transport":"mixed","callable_via_gateway":false,"default_price_micros":0,"repository":"https://github.com/pvliesdonk/paperless-mcp","website":"https://pvliesdonk.github.io/paperless-mcp/","version":"2.1.0","remotes":[],"packages":[{"registryType":"pypi","identifier":"pvliesdonk-paperless-mcp","version":"2.1.0","runtimeHint":"uvx","transport":{"type":"stdio"},"environmentVariables":[{"description":"Persistent-state backend URL shared by every pvl-core subsystem that needs state. `memory://` is in-process and lost on restart; `file:///path` persists on one server; `redis://`, `dynamodb://` and `mongodb://` each need their matching extra. When unset, defaults to `file:///data/state` (the volume family Docker images mount), or to `memory://` (with a warning) on a host where that directory is not usable.","default":"file:///data/state","name":"PAPERLESS_MCP_KV_STORE_URL"},{"description":"Comma-separated explicit tool names this instance exposes; every other tool is hidden from listings and cannot be invoked. Names matching no registered tool are inert. Mutually exclusive with `tools_deny`. Takes effect through `apply_tool_visibility`.","name":"PAPERLESS_MCP_TOOLS_ALLOW"},{"description":"Comma-separated explicit tool names hidden from this instance (absent from listings, cannot be invoked). Names matching no registered tool are inert. Mutually exclusive with `tools_allow`. Takes effect through `apply_tool_visibility`.","name":"PAPERLESS_MCP_TOOLS_DENY"},{"description":"Rename this server instance; defaults to the project name.","name":"PAPERLESS_MCP_SERVER_NAME"},{"description":"Concise routing context that distinguishes this deployment's material or responsibility.","name":"PAPERLESS_MCP_INSTANCE_DESCRIPTION"},{"description":"Deployment-specific behavioral policy added to the generated MCP instructions.","name":"PAPERLESS_MCP_INSTRUCTIONS_EXTRA"},{"description":"Legacy: replaces all generated MCP instructions (deprecated; use _INSTANCE_DESCRIPTION for routing and _INSTRUCTIONS_EXTRA for policy).","name":"PAPERLESS_MCP_INSTRUCTIONS"},{"description":"Log level for FastMCP internals and app loggers (DEBUG / INFO / WARNING / ERROR / CRITICAL). The -v CLI flag overrides to DEBUG.","default":"INFO","choices":["DEBUG","INFO","WARNING","ERROR","CRITICAL"],"name":"FASTMCP_LOG_LEVEL"},{"description":"Rich color output for a terminal; false gives one plain or JSON line per record. Off in the container image and the systemd unit, since neither is a terminal and Rich wraps a structured record at its 80-column fallback.","format":"boolean","default":"true","name":"FASTMCP_ENABLE_RICH_LOGGING"},{"description":"Base URL of the Paperless-NGX REST API, without a trailing slash. The server refuses to start without it.","name":"PAPERLESS_MCP_PAPERLESS_URL"},{"description":"Paperless service-account token used for outbound API requests. The server refuses to start without it.","isSecret":true,"name":"PAPERLESS_MCP_API_TOKEN"},{"description":"Per-request HTTP timeout in seconds.","format":"number","default":"30.0","name":"PAPERLESS_MCP_HTTP_TIMEOUT_SECONDS"},{"description":"Retries for idempotent requests after network errors or 5xx responses.","format":"number","default":"2","name":"PAPERLESS_MCP_HTTP_RETRIES"},{"description":"Default page size for list tools, from 1 through 100.","format":"number","default":"25","name":"PAPERLESS_MCP_DEFAULT_PAGE_SIZE"},{"description":"Public Paperless UI URL for user-visible links; defaults to PAPERLESS_URL.","name":"PAPERLESS_MCP_PAPERLESS_PUBLIC_URL"}]},{"registryType":"oci","identifier":"ghcr.io/pvliesdonk/paperless-mcp:v2.1.0","transport":{"type":"streamable-http","url":"http://localhost:{--port}/mcp"},"packageArguments":[{"description":"Port for the HTTP transport","default":"8000","type":"named","name":"--port"}],"environmentVariables":[{"description":"Public base URL of the deployed server, for example `https://mcp.example.com`. Required for OIDC. Also the fallback source of the MCP Apps domain when `app_domain` is unset.","placeholder":"https://mcp.example.com","name":"PAPERLESS_MCP_BASE_URL"},{"description":"Single shared bearer token; enables bearer auth unless `bearer_tokens_file` is set, which takes precedence.","isSecret":true,"placeholder":"<secret>","name":"PAPERLESS_MCP_BEARER_TOKEN"},{"description":"OIDC discovery document URL, for example `https://auth.example.com/.well-known/openid-configuration`.","placeholder":"https://auth.example.com/.well-known/openid-configuration","name":"PAPERLESS_MCP_OIDC_CONFIG_URL"},{"description":"OIDC client identifier registered with the provider.","placeholder":"mcp-client","name":"PAPERLESS_MCP_OIDC_CLIENT_ID"},{"description":"OIDC client secret registered with the provider.","isSecret":true,"placeholder":"your-client-secret","name":"PAPERLESS_MCP_OIDC_CLIENT_SECRET"},{"description":"Expected `aud` claim; tokens issued for another audience are rejected.","placeholder":"mcp-api","name":"PAPERLESS_MCP_OIDC_AUDIENCE"},{"description":"Scopes a caller must present, space- or comma-separated. Defaults to `openid` in oidc-proxy mode.","default":"openid","name":"PAPERLESS_MCP_OIDC_REQUIRED_SCOPES"},{"description":"Scopes advertised to MCP clients in protected-resource metadata, space- or comma-separated. Overrides the default `openid offline_access`; `oidc_required_scopes` is always added on top. Set this when the registered client is not permitted `offline_access`, or to have clients request extra claim scopes (such as `groups`) without also requiring them in every token.","default":"openid offline_access","name":"PAPERLESS_MCP_OIDC_ADVERTISED_SCOPES"},{"description":"Signing key for issued tokens; used in oidc-proxy mode only. When unset, the key is derived deterministically from `oidc_client_secret`, so tokens survive a restart. Rotating that secret then invalidates every issued token. Set this explicitly to decouple token validity from secret rotation. Generate with `openssl rand -hex 32`.","isSecret":true,"default":"derived","name":"PAPERLESS_MCP_OIDC_JWT_SIGNING_KEY"},{"description":"Validate the access token instead of the id token.","format":"boolean","default":"false","name":"PAPERLESS_MCP_OIDC_VERIFY_ACCESS_TOKEN"},{"description":"Persistent-state backend URL shared by every pvl-core subsystem that needs state. `memory://` is in-process and lost on restart; `file:///path` persists on one server; `redis://`, `dynamodb://` and `mongodb://` each need their matching extra. When unset, defaults to `file:///data/state` (the volume family Docker images mount), or to `memory://` (with a warning) on a host where that directory is not usable.","default":"file:///data/state","name":"PAPERLESS_MCP_KV_STORE_URL"},{"description":"MCP Apps iframe domain, used for CSP sandboxing. Overrides the host derived from `base_url`.","name":"PAPERLESS_MCP_APP_DOMAIN"},{"description":"Comma-separated explicit tool names this instance exposes; every other tool is hidden from listings and cannot be invoked. Names matching no registered tool are inert. Mutually exclusive with `tools_deny`. Takes effect through `apply_tool_visibility`.","name":"PAPERLESS_MCP_TOOLS_ALLOW"},{"description":"Comma-separated explicit tool names hidden from this instance (absent from listings, cannot be invoked). Names matching no registered tool are inert. Mutually exclusive with `tools_allow`. Takes effect through `apply_tool_visibility`.","name":"PAPERLESS_MCP_TOOLS_DENY"},{"description":"Explicit auth-mode override, accepting `remote` or `oidc-proxy` (case- and whitespace-insensitive). When unset the mode is auto-detected from which auth variables are set; the override exists because having all four OIDC variables set is ambiguous between those two modes. Other values are ignored with a warning.","name":"PAPERLESS_MCP_AUTH_MODE"},{"description":"Path to a TOML file mapping bearer tokens to subjects; overrides the single-token `bearer_token` mode.","format":"filepath","placeholder":"/etc/paperless-mcp/tokens.toml","name":"PAPERLESS_MCP_BEARER_TOKENS_FILE"},{"description":"Subject assigned to the single-token bearer mode; ignored when `bearer_tokens_file` is set, since mapped mode carries per-token subjects.","default":"bearer-anon","name":"PAPERLESS_MCP_BEARER_DEFAULT_SUBJECT"},{"description":"Rename this server instance; defaults to the project name.","name":"PAPERLESS_MCP_SERVER_NAME"},{"description":"Concise routing context that distinguishes this deployment's material or responsibility.","name":"PAPERLESS_MCP_INSTANCE_DESCRIPTION"},{"description":"Deployment-specific behavioral policy added to the generated MCP instructions.","name":"PAPERLESS_MCP_INSTRUCTIONS_EXTRA"},{"description":"Legacy: replaces all generated MCP instructions (deprecated; use _INSTANCE_DESCRIPTION for routing and _INSTRUCTIONS_EXTRA for policy).","name":"PAPERLESS_MCP_INSTRUCTIONS"},{"description":"Mount path for the MCP endpoint; the health routes derive their prefix from it.","default":"/mcp","name":"PAPERLESS_MCP_HTTP_PATH"},{"description":"How much the unauthenticated /health and /health/ready bodies say: status, standard (adds name, version and per-check verdicts), or full (adds redacted reasons; trusted networks only).","default":"standard","choices":["status","standard","full"],"name":"PAPERLESS_MCP_HEALTH_DETAIL"},{"description":"Run the server process as this UID; the container entrypoint reassigns ownership of writable paths to match.","format":"number","default":"1000","name":"PUID"},{"description":"Run the server process as this GID; pair with PUID to match the owner of a mounted volume.","format":"number","default":"1000","name":"PGID"},{"description":"Log level for FastMCP internals and app loggers (DEBUG / INFO / WARNING / ERROR / CRITICAL). The -v CLI flag overrides to DEBUG.","default":"INFO","choices":["DEBUG","INFO","WARNING","ERROR","CRITICAL"],"name":"FASTMCP_LOG_LEVEL"},{"description":"Rich color output for a terminal; false gives one plain or JSON line per record. Off in the container image and the systemd unit, since neither is a terminal and Rich wraps a structured record at its 80-column fallback.","format":"boolean","default":"true","name":"FASTMCP_ENABLE_RICH_LOGGING"},{"description":"Base URL of the Paperless-NGX REST API, without a trailing slash. The server refuses to start without it.","name":"PAPERLESS_MCP_PAPERLESS_URL"},{"description":"Paperless service-account token used for outbound API requests. The server refuses to start without it.","isSecret":true,"name":"PAPERLESS_MCP_API_TOKEN"},{"description":"Per-request HTTP timeout in seconds.","format":"number","default":"30.0","name":"PAPERLESS_MCP_HTTP_TIMEOUT_SECONDS"},{"description":"Retries for idempotent requests after network errors or 5xx responses.","format":"number","default":"2","name":"PAPERLESS_MCP_HTTP_RETRIES"},{"description":"Default page size for list tools, from 1 through 100.","format":"number","default":"25","name":"PAPERLESS_MCP_DEFAULT_PAGE_SIZE"},{"description":"Public Paperless UI URL for user-visible links; defaults to PAPERLESS_URL.","name":"PAPERLESS_MCP_PAPERLESS_PUBLIC_URL"}]}],"tools":[{"name":"share_document","description":"","write_action":false,"price_micros":0,"input_schema":null}],"scan":{"score":83,"grade":"B","scanned_at":"2026-09-19T21:08:34.528Z","report":{"scannerVersion":"0.1.8","scannedAt":"2026-09-19T21:08:34.503Z","components":{"code":{"score":25,"max":25,"notes":["72 source files scanned"]},"reliability":{"score":-1,"max":20,"notes":["no gateway calls yet and no remote to probe"]},"poisoning":{"score":-1,"max":15,"notes":["tools not inspected (local package is not executed); not counted"]},"auth":{"score":6,"max":15,"notes":["static API keys via environment variables"]},"maintenance":{"score":15,"max":15,"notes":["last push 0 days ago"]},"identity":{"score":8,"max":10,"notes":["registry namespace matches repository owner","GitHub account older than a year"]}},"findings":[],"inputs":{"packages":[{"registryType":"pypi","identifier":"pvliesdonk-paperless-mcp","version":"2.1.0","found":true,"weeklyDownloads":334,"license":"LicenseRef-Proprietary","dependencyCount":5,"publishedAt":"2026-09-19T18:53:16.036396Z","repositoryUrl":"https://github.com/pvliesdonk/paperless-mcp"}],"repo":{"found":true,"owner":"pvliesdonk","repo":"paperless-mcp","archived":false,"pushedAt":"2026-09-19T20:02:00Z","stars":1,"forks":0,"openIssues":12,"ownerType":"User","ownerAvatarUrl":"https://avatars.githubusercontent.com/u/22190282?v=4","ownerCreatedAt":"2016-09-14T07:46:50Z","license":"NOASSERTION"},"icon":{"url":"https://avatars.githubusercontent.com/u/22190282?v=4&s=128","source":"registry"},"presence":{"stars":1,"forks":0,"downloadsWeek":334,"license":"NOASSERTION","lastPushAt":"2026-09-19T20:02:00.000Z","score":34}}}},"grade_history":[],"reviews":[]}