{"name":"io.github.pvliesdonk/paperless-mcp","slug":"pvliesdonk-paperless-mcp","title":"Paperless MCP","description":"Paperless-NGX over MCP: search, read, upload and tag documents; manage correspondents and types.","url":"https://mcp.market/server/pvliesdonk-paperless-mcp","rating":null,"grade":"B","score":83,"certified":false,"status":"active","category":"search","tags":["search"],"presence":{"score":31,"stars":1,"forks":0,"downloads_week":96,"last_push_at":"2026-10-13T01:59:25.000Z","license":"MIT"},"uptime":null,"claimed":false,"transport":"mixed","callable_via_gateway":false,"default_price_micros":0,"repository":"https://github.com/pvliesdonk/paperless-mcp","website":"https://pvliesdonk.github.io/paperless-mcp/","version":"3.0.0","remotes":[],"packages":[{"registryType":"pypi","identifier":"pvliesdonk-paperless-mcp","version":"3.0.0","runtimeHint":"uvx","transport":{"type":"stdio"},"environmentVariables":[{"description":"Persistent-state backend URL shared by every pvl-core subsystem that needs state. `memory://` is in-process and lost on restart; `file:///path` persists on one server; `redis://`, `dynamodb://` and `mongodb://` each need their matching extra. When unset, defaults to `file:///data/state` (the volume family Docker images mount), or to `memory://` (with a warning) on a host where that directory is not usable.","default":"file:///data/state","name":"PAPERLESS_MCP_KV_STORE_URL"},{"description":"Comma-separated explicit tool names this instance exposes; every other tool is hidden from listings and cannot be invoked. Names matching no registered tool are inert. Mutually exclusive with `tools_deny`. Takes effect through `apply_tool_visibility`.","name":"PAPERLESS_MCP_TOOLS_ALLOW"},{"description":"Comma-separated explicit tool names hidden from this instance (absent from listings, cannot be invoked). Names matching no registered tool are inert. Mutually exclusive with `tools_allow`. Takes effect through `apply_tool_visibility`.","name":"PAPERLESS_MCP_TOOLS_DENY"},{"description":"Rename this server instance; defaults to the project name.","name":"PAPERLESS_MCP_SERVER_NAME"},{"description":"Concise routing context that distinguishes this deployment's material or responsibility.","name":"PAPERLESS_MCP_INSTANCE_DESCRIPTION"},{"description":"Deployment-specific behavioral policy added to the generated MCP instructions.","name":"PAPERLESS_MCP_INSTRUCTIONS_EXTRA"},{"description":"Legacy: replaces all generated MCP instructions (deprecated; use _INSTANCE_DESCRIPTION for routing and _INSTRUCTIONS_EXTRA for policy).","name":"PAPERLESS_MCP_INSTRUCTIONS"},{"description":"Log level for every logger in the process, FastMCP's included (DEBUG / INFO / WARNING / ERROR / CRITICAL). The -v CLI flag overrides to DEBUG. The unprefixed FASTMCP_LOG_LEVEL still works for one major version and logs a deprecation warning.","default":"INFO","choices":["DEBUG","INFO","WARNING","ERROR","CRITICAL"],"name":"PAPERLESS_MCP_LOG_LEVEL"},{"description":"Log rendering. rich is one colour event key=value line per record, for a terminal; json is one JSON object per record, for a collector. Unset picks rich when stderr is a terminal and json everywhere else, so a container or journald gets JSON with no configuration.","choices":["rich","json"],"name":"PAPERLESS_MCP_LOG_FORMAT"},{"description":"Base URL of the Paperless-NGX REST API, without a trailing slash. The server refuses to start without it.","name":"PAPERLESS_MCP_PAPERLESS_URL"},{"description":"Paperless service-account token used for outbound API requests. The server refuses to start without it.","isSecret":true,"name":"PAPERLESS_MCP_API_TOKEN"},{"description":"Per-request HTTP timeout in seconds.","format":"number","default":"30.0","name":"PAPERLESS_MCP_HTTP_TIMEOUT_SECONDS"},{"description":"Retries for idempotent requests after network errors or 5xx responses.","format":"number","default":"2","name":"PAPERLESS_MCP_HTTP_RETRIES"},{"description":"Default page size for list tools, from 1 through 100.","format":"number","default":"25","name":"PAPERLESS_MCP_DEFAULT_PAGE_SIZE"},{"description":"Public Paperless UI URL for user-visible links; defaults to PAPERLESS_URL.","name":"PAPERLESS_MCP_PAPERLESS_PUBLIC_URL"},{"description":"Link lifetime in seconds when the caller requests no explicit TTL.","format":"number","default":"3600.0","name":"PAPERLESS_MCP_TRANSFER_TTL_DEFAULT_S"},{"description":"Ceiling in seconds a caller-requested link TTL is clamped to.","format":"number","default":"86400.0","name":"PAPERLESS_MCP_TRANSFER_TTL_MAX_S"},{"description":"Post-success grace window in seconds: a served token's TTL shrinks to this so a stalled transfer can retry within it.","format":"number","default":"60.0","name":"PAPERLESS_MCP_TRANSFER_GRACE_TTL_S"},{"description":"Crashed-handler reclaim window in seconds for an in-flight reservation.","format":"number","default":"60.0","name":"PAPERLESS_MCP_TRANSFER_LEASE_S"},{"description":"Maximum size in bytes of a single upload.","format":"number","default":"104857600","name":"PAPERLESS_MCP_TRANSFER_MAX_UPLOAD_BYTES"}]},{"registryType":"oci","identifier":"ghcr.io/pvliesdonk/paperless-mcp:v3.0.0","transport":{"type":"streamable-http","url":"http://localhost:{--port}/mcp"},"packageArguments":[{"description":"Port for the HTTP transport","default":"8000","type":"named","name":"--port"}],"environmentVariables":[{"description":"Seconds SIGTERM may spend draining in-flight requests before the HTTP server exits. Keep it at or below the termination grace period the orchestrator allows. `0` drops in-flight requests immediately.","format":"number","default":"3","name":"PAPERLESS_MCP_SHUTDOWN_GRACE_S"},{"description":"Public base URL of the deployed server, for example `https://mcp.example.com`. Required for OIDC. Also the fallback source of the MCP Apps domain when `app_domain` is unset.","placeholder":"https://mcp.example.com","name":"PAPERLESS_MCP_BASE_URL"},{"description":"Single shared bearer token; enables bearer auth unless `bearer_tokens_file` is set, which takes precedence.","isSecret":true,"placeholder":"<secret>","name":"PAPERLESS_MCP_BEARER_TOKEN"},{"description":"OIDC discovery document URL, for example `https://auth.example.com/.well-known/openid-configuration`.","placeholder":"https://auth.example.com/.well-known/openid-configuration","name":"PAPERLESS_MCP_OIDC_CONFIG_URL"},{"description":"OIDC client identifier registered with the provider.","placeholder":"mcp-client","name":"PAPERLESS_MCP_OIDC_CLIENT_ID"},{"description":"OIDC client secret registered with the provider.","isSecret":true,"placeholder":"your-client-secret","name":"PAPERLESS_MCP_OIDC_CLIENT_SECRET"},{"description":"Expected `aud` claim; tokens issued for another audience are rejected.","placeholder":"mcp-api","name":"PAPERLESS_MCP_OIDC_AUDIENCE"},{"description":"Scopes a caller must present, space- or comma-separated. Defaults to `openid` in oidc-proxy mode.","default":"openid","name":"PAPERLESS_MCP_OIDC_REQUIRED_SCOPES"},{"description":"Scopes advertised to MCP clients in protected-resource metadata, space- or comma-separated. Overrides the default `openid offline_access`; `oidc_required_scopes` is always added on top. Set this when the registered client is not permitted `offline_access`, or to have clients request extra claim scopes (such as `groups`) without also requiring them in every token.","default":"openid offline_access","name":"PAPERLESS_MCP_OIDC_ADVERTISED_SCOPES"},{"description":"Signing key for issued tokens; used in oidc-proxy mode only. When unset, the key is derived deterministically from `oidc_client_secret`, so tokens survive a restart. Rotating that secret then invalidates every issued token. Set this explicitly to decouple token validity from secret rotation. Generate with `openssl rand -hex 32`.","isSecret":true,"default":"derived","name":"PAPERLESS_MCP_OIDC_JWT_SIGNING_KEY"},{"description":"Validate the access token instead of the id token.","format":"boolean","default":"false","name":"PAPERLESS_MCP_OIDC_VERIFY_ACCESS_TOKEN"},{"description":"Persistent-state backend URL shared by every pvl-core subsystem that needs state. `memory://` is in-process and lost on restart; `file:///path` persists on one server; `redis://`, `dynamodb://` and `mongodb://` each need their matching extra. When unset, defaults to `file:///data/state` (the volume family Docker images mount), or to `memory://` (with a warning) on a host where that directory is not usable.","default":"file:///data/state","name":"PAPERLESS_MCP_KV_STORE_URL"},{"description":"MCP Apps iframe domain, used for CSP sandboxing. Overrides the host derived from `base_url`.","name":"PAPERLESS_MCP_APP_DOMAIN"},{"description":"Comma-separated explicit tool names this instance exposes; every other tool is hidden from listings and cannot be invoked. Names matching no registered tool are inert. Mutually exclusive with `tools_deny`. Takes effect through `apply_tool_visibility`.","name":"PAPERLESS_MCP_TOOLS_ALLOW"},{"description":"Comma-separated explicit tool names hidden from this instance (absent from listings, cannot be invoked). Names matching no registered tool are inert. Mutually exclusive with `tools_allow`. Takes effect through `apply_tool_visibility`.","name":"PAPERLESS_MCP_TOOLS_DENY"},{"description":"Explicit auth-mode override, accepting `remote` or `oidc-proxy` (case- and whitespace-insensitive). When unset the mode is auto-detected from which auth variables are set; the override exists because having all four OIDC variables set is ambiguous between those two modes. Other values are ignored with a warning.","name":"PAPERLESS_MCP_AUTH_MODE"},{"description":"Path to a TOML file mapping bearer tokens to subjects; overrides the single-token `bearer_token` mode.","format":"filepath","placeholder":"/etc/paperless-mcp/tokens.toml","name":"PAPERLESS_MCP_BEARER_TOKENS_FILE"},{"description":"Subject assigned to the single-token bearer mode; ignored when `bearer_tokens_file` is set, since mapped mode carries per-token subjects.","default":"bearer-anon","name":"PAPERLESS_MCP_BEARER_DEFAULT_SUBJECT"},{"description":"Rename this server instance; defaults to the project name.","name":"PAPERLESS_MCP_SERVER_NAME"},{"description":"Concise routing context that distinguishes this deployment's material or responsibility.","name":"PAPERLESS_MCP_INSTANCE_DESCRIPTION"},{"description":"Deployment-specific behavioral policy added to the generated MCP instructions.","name":"PAPERLESS_MCP_INSTRUCTIONS_EXTRA"},{"description":"Legacy: replaces all generated MCP instructions (deprecated; use _INSTANCE_DESCRIPTION for routing and _INSTRUCTIONS_EXTRA for policy).","name":"PAPERLESS_MCP_INSTRUCTIONS"},{"description":"Mount path for the MCP endpoint; the health routes derive their prefix from it.","default":"/mcp","name":"PAPERLESS_MCP_HTTP_PATH"},{"description":"How much the unauthenticated /health and /health/ready bodies say: status, standard (adds name, version and per-check verdicts), or full (adds redacted reasons; trusted networks only).","default":"standard","choices":["status","standard","full"],"name":"PAPERLESS_MCP_HEALTH_DETAIL"},{"description":"Run the server process as this UID; the container entrypoint reassigns ownership of writable paths to match.","format":"number","default":"1000","name":"PUID"},{"description":"Run the server process as this GID; pair with PUID to match the owner of a mounted volume.","format":"number","default":"1000","name":"PGID"},{"description":"Log level for every logger in the process, FastMCP's included (DEBUG / INFO / WARNING / ERROR / CRITICAL). The -v CLI flag overrides to DEBUG. The unprefixed FASTMCP_LOG_LEVEL still works for one major version and logs a deprecation warning.","default":"INFO","choices":["DEBUG","INFO","WARNING","ERROR","CRITICAL"],"name":"PAPERLESS_MCP_LOG_LEVEL"},{"description":"Log rendering. rich is one colour event key=value line per record, for a terminal; json is one JSON object per record, for a collector. Unset picks rich when stderr is a terminal and json everywhere else, so a container or journald gets JSON with no configuration.","choices":["rich","json"],"name":"PAPERLESS_MCP_LOG_FORMAT"},{"description":"Base URL of the Paperless-NGX REST API, without a trailing slash. The server refuses to start without it.","name":"PAPERLESS_MCP_PAPERLESS_URL"},{"description":"Paperless service-account token used for outbound API requests. The server refuses to start without it.","isSecret":true,"name":"PAPERLESS_MCP_API_TOKEN"},{"description":"Per-request HTTP timeout in seconds.","format":"number","default":"30.0","name":"PAPERLESS_MCP_HTTP_TIMEOUT_SECONDS"},{"description":"Retries for idempotent requests after network errors or 5xx responses.","format":"number","default":"2","name":"PAPERLESS_MCP_HTTP_RETRIES"},{"description":"Default page size for list tools, from 1 through 100.","format":"number","default":"25","name":"PAPERLESS_MCP_DEFAULT_PAGE_SIZE"},{"description":"Public Paperless UI URL for user-visible links; defaults to PAPERLESS_URL.","name":"PAPERLESS_MCP_PAPERLESS_PUBLIC_URL"},{"description":"Link lifetime in seconds when the caller requests no explicit TTL.","format":"number","default":"3600.0","name":"PAPERLESS_MCP_TRANSFER_TTL_DEFAULT_S"},{"description":"Ceiling in seconds a caller-requested link TTL is clamped to.","format":"number","default":"86400.0","name":"PAPERLESS_MCP_TRANSFER_TTL_MAX_S"},{"description":"Post-success grace window in seconds: a served token's TTL shrinks to this so a stalled transfer can retry within it.","format":"number","default":"60.0","name":"PAPERLESS_MCP_TRANSFER_GRACE_TTL_S"},{"description":"Crashed-handler reclaim window in seconds for an in-flight reservation.","format":"number","default":"60.0","name":"PAPERLESS_MCP_TRANSFER_LEASE_S"},{"description":"Maximum size in bytes of a single upload.","format":"number","default":"104857600","name":"PAPERLESS_MCP_TRANSFER_MAX_UPLOAD_BYTES"}]}],"tools":[{"name":"add_document_note","description":"Append a note to a document.","write_action":false,"price_micros":0,"input_schema":null},{"name":"bulk_edit_correspondents","description":"Apply a bulk operation to a set of correspondents.","write_action":false,"price_micros":0,"input_schema":null},{"name":"bulk_edit_document_types","description":"Apply a bulk operation to a set of document types.","write_action":false,"price_micros":0,"input_schema":null},{"name":"bulk_edit_documents","description":"Apply a bulk operation to a set of documents.","write_action":false,"price_micros":0,"input_schema":null},{"name":"bulk_edit_tags","description":"Apply a bulk operation to a set of tags.","write_action":false,"price_micros":0,"input_schema":null},{"name":"create_correspondent","description":"Create a new correspondent.","write_action":true,"price_micros":0,"input_schema":null},{"name":"create_custom_field","description":"Create a new custom field.","write_action":true,"price_micros":0,"input_schema":null},{"name":"create_document_type","description":"Create a new document type.","write_action":true,"price_micros":0,"input_schema":null},{"name":"create_tag","description":"Create a new tag.","write_action":true,"price_micros":0,"input_schema":null},{"name":"delete_correspondent","description":"Delete a correspondent.","write_action":true,"price_micros":0,"input_schema":null},{"name":"delete_custom_field","description":"Delete a custom field.","write_action":true,"price_micros":0,"input_schema":null},{"name":"delete_document","description":"Delete a document.","write_action":true,"price_micros":0,"input_schema":null},{"name":"delete_document_note","description":"Remove a note from a document.","write_action":true,"price_micros":0,"input_schema":null},{"name":"delete_document_type","description":"Delete a document type.","write_action":true,"price_micros":0,"input_schema":null},{"name":"delete_tag","description":"Delete a tag.","write_action":true,"price_micros":0,"input_schema":null},{"name":"get_correspondent","description":"Fetch a correspondent by ID.","write_action":false,"price_micros":0,"input_schema":null},{"name":"get_custom_field","description":"Fetch a custom field by ID.","write_action":false,"price_micros":0,"input_schema":null},{"name":"get_document","description":"Fetch one document by ID.","write_action":false,"price_micros":0,"input_schema":null},{"name":"get_document_content","description":"Return the OCR'd text content of a document.","write_action":false,"price_micros":0,"input_schema":null},{"name":"get_document_history","description":"Return the audit history for a document.","write_action":false,"price_micros":0,"input_schema":null},{"name":"get_document_metadata","description":"Return technical metadata for a document (checksums, filenames, etc.).","write_action":false,"price_micros":0,"input_schema":null},{"name":"get_document_notes","description":"Return notes attached to a document.","write_action":false,"price_micros":0,"input_schema":null},{"name":"get_document_suggestions","description":"Return Paperless's classifier suggestions for a document.","write_action":false,"price_micros":0,"input_schema":null},{"name":"get_document_thumbnail","description":"Return the document's thumbnail as inline image content.","write_action":false,"price_micros":0,"input_schema":null},{"name":"get_document_type","description":"Fetch a document type by ID.","write_action":false,"price_micros":0,"input_schema":null},{"name":"get_remote_version","description":"Check whether a newer release of Paperless-NGX exists upstream.","write_action":false,"price_micros":0,"input_schema":null},{"name":"get_saved_view","description":"Fetch a saved view by ID.","write_action":false,"price_micros":0,"input_schema":null},{"name":"get_share_link","description":"Fetch a share link by ID.","write_action":false,"price_micros":0,"input_schema":null},{"name":"get_statistics","description":"Fetch collection-level statistics.","write_action":false,"price_micros":0,"input_schema":null},{"name":"get_storage_path","description":"Fetch a storage path by ID.","write_action":false,"price_micros":0,"input_schema":null},{"name":"get_tag","description":"Fetch a tag by ID.","write_action":false,"price_micros":0,"input_schema":null},{"name":"get_task","description":"Fetch a task by UUID. Returns ``None`` if no such task exists.","write_action":false,"price_micros":0,"input_schema":null},{"name":"list_correspondents","description":"List correspondents.","write_action":false,"price_micros":0,"input_schema":null},{"name":"list_custom_fields","description":"List custom fields.","write_action":false,"price_micros":0,"input_schema":null},{"name":"list_document_types","description":"List document types.","write_action":false,"price_micros":0,"input_schema":null},{"name":"list_documents","description":"List documents with optional filters. Returns one page.","write_action":false,"price_micros":0,"input_schema":null},{"name":"list_saved_views","description":"List saved views.","write_action":false,"price_micros":0,"input_schema":null},{"name":"list_share_links","description":"List share links (optionally filtered by document).","write_action":false,"price_micros":0,"input_schema":null},{"name":"list_storage_paths","description":"List storage paths.","write_action":false,"price_micros":0,"input_schema":null},{"name":"list_tags","description":"List tags.","write_action":false,"price_micros":0,"input_schema":null},{"name":"list_tasks","description":"List Paperless Celery tasks.","write_action":false,"price_micros":0,"input_schema":null},{"name":"search_documents","description":"Full-text search documents.","write_action":false,"price_micros":0,"input_schema":null},{"name":"update_correspondent","description":"Patch selected fields on a correspondent.","write_action":true,"price_micros":0,"input_schema":null},{"name":"update_custom_field","description":"Patch selected fields on a custom field definition.","write_action":true,"price_micros":0,"input_schema":null},{"name":"update_document","description":"Patch selected fields on a document.","write_action":true,"price_micros":0,"input_schema":null},{"name":"update_document_type","description":"Patch selected fields on a document type.","write_action":true,"price_micros":0,"input_schema":null},{"name":"update_tag","description":"Patch selected fields on a tag.","write_action":true,"price_micros":0,"input_schema":null},{"name":"upload_document","description":"Upload a document. Returns the task UUID for polling via `get_task`.","write_action":true,"price_micros":0,"input_schema":null},{"name":"wait_for_task","description":"Poll until the task reaches a terminal state or times out.","write_action":false,"price_micros":0,"input_schema":null}],"scan":{"score":83,"grade":"B","scanned_at":"2026-10-15T11:59:54.844Z","report":{"scannerVersion":"0.1.10","scannedAt":"2026-10-15T11:59:54.843Z","components":{"code":{"score":25,"max":25,"notes":["79 source files scanned"]},"reliability":{"score":-1,"max":20,"notes":["no gateway calls yet and no remote to probe"]},"poisoning":{"score":-1,"max":15,"notes":["tools not inspected (local package is not executed); not counted"]},"auth":{"score":6,"max":15,"notes":["static API keys via environment variables"]},"maintenance":{"score":15,"max":15,"notes":["last push 2 days ago"]},"identity":{"score":8,"max":10,"notes":["registry namespace matches repository owner","GitHub account older than a year"]}},"findings":[],"inputs":{"packages":[{"registryType":"pypi","identifier":"pvliesdonk-paperless-mcp","version":"3.0.0","found":true,"weeklyDownloads":96,"license":"MIT","dependencyCount":5,"publishedAt":"2026-09-21T18:06:09.663289Z","repositoryUrl":"https://github.com/pvliesdonk/paperless-mcp"}],"repo":{"found":true,"owner":"pvliesdonk","repo":"paperless-mcp","archived":false,"pushedAt":"2026-10-13T01:59:25Z","stars":1,"forks":0,"openIssues":13,"ownerType":"User","ownerAvatarUrl":"https://avatars.githubusercontent.com/u/22190282?v=4","ownerCreatedAt":"2016-09-14T07:46:50Z","license":"MIT"},"icon":{"url":"https://avatars.githubusercontent.com/u/22190282?v=4&s=128","source":"registry"},"presence":{"stars":1,"forks":0,"downloadsWeek":96,"license":"MIT","lastPushAt":"2026-10-13T01:59:25.000Z","score":31}}}},"grade_history":[],"reviews":[]}