MCP Marketplace
Sign inSign up
Back to Browse

Paperless MCP Server

by User
Developer ToolsLow Risk10.0Local
Free

Paperless-NGX over MCP: search, read, upload and tag documents; manage correspondents and types.

About

Paperless-NGX over MCP: search, read, upload and tag documents; manage correspondents and types.

Security Report

10.0
Low Risk10.0Low Risk

Valid MCP server (1 strong, 1 medium validity signals). No known CVEs in dependencies. Package registry verified. Imported from the Official MCP Registry. Trust signals: trusted author (5/5 approved).

4 files analyzed · 1 issue found

Security scores are indicators to help you make informed decisions, not guarantees. Always review permissions before connecting any MCP server.

Permissions Required

This plugin requests these system permissions. Most are normal for its category.

file_system

Check that this permission is expected for this type of plugin.

What You'll Need

Set these up before or after installing:

Persistent-state backend URL shared by every pvl-core subsystem that needs state. `memory://` is in-process and lost on restart; `file:///path` persists on one server; `redis://`, `dynamodb://` and `mongodb://` each need their matching extra. When unset, defaults to `file:///data/state` (the volume family Docker images mount), or to `memory://` (with a warning) on a host where that directory is not usable.Optional

Environment variable: PAPERLESS_MCP_KV_STORE_URL

Comma-separated explicit tool names this instance exposes; every other tool is hidden from listings and cannot be invoked. Names matching no registered tool are inert. Mutually exclusive with `tools_deny`. Takes effect through `apply_tool_visibility`.Optional

Environment variable: PAPERLESS_MCP_TOOLS_ALLOW

Comma-separated explicit tool names hidden from this instance (absent from listings, cannot be invoked). Names matching no registered tool are inert. Mutually exclusive with `tools_allow`. Takes effect through `apply_tool_visibility`.Optional

Environment variable: PAPERLESS_MCP_TOOLS_DENY

Rename this server instance; defaults to the project name.Optional

Environment variable: PAPERLESS_MCP_SERVER_NAME

Concise routing context that distinguishes this deployment's material or responsibility.Optional

Environment variable: PAPERLESS_MCP_INSTANCE_DESCRIPTION

Deployment-specific behavioral policy added to the generated MCP instructions.Optional

Environment variable: PAPERLESS_MCP_INSTRUCTIONS_EXTRA

Legacy: replaces all generated MCP instructions (deprecated; use _INSTANCE_DESCRIPTION for routing and _INSTRUCTIONS_EXTRA for policy).Optional

Environment variable: PAPERLESS_MCP_INSTRUCTIONS

Log level for every logger in the process, FastMCP's included (DEBUG / INFO / WARNING / ERROR / CRITICAL). The -v CLI flag overrides to DEBUG. The unprefixed FASTMCP_LOG_LEVEL still works for one major version and logs a deprecation warning.Optional

Environment variable: PAPERLESS_MCP_LOG_LEVEL

Log rendering. rich is one colour event key=value line per record, for a terminal; json is one JSON object per record, for a collector. Unset picks rich when stderr is a terminal and json everywhere else, so a container or journald gets JSON with no configuration.Optional

Environment variable: PAPERLESS_MCP_LOG_FORMAT

Base URL of the Paperless-NGX REST API, without a trailing slash. The server refuses to start without it.Optional

Environment variable: PAPERLESS_MCP_PAPERLESS_URL

Paperless service-account token used for outbound API requests. The server refuses to start without it.Required

Environment variable: PAPERLESS_MCP_API_TOKEN

Per-request HTTP timeout in seconds.Optional

Environment variable: PAPERLESS_MCP_HTTP_TIMEOUT_SECONDS

Retries for idempotent requests after network errors or 5xx responses.Optional

Environment variable: PAPERLESS_MCP_HTTP_RETRIES

Default page size for list tools, from 1 through 100.Optional

Environment variable: PAPERLESS_MCP_DEFAULT_PAGE_SIZE

Public Paperless UI URL for user-visible links; defaults to PAPERLESS_URL.Optional

Environment variable: PAPERLESS_MCP_PAPERLESS_PUBLIC_URL

Link lifetime in seconds when the caller requests no explicit TTL.Optional

Environment variable: PAPERLESS_MCP_TRANSFER_TTL_DEFAULT_S

Ceiling in seconds a caller-requested link TTL is clamped to.Optional

Environment variable: PAPERLESS_MCP_TRANSFER_TTL_MAX_S

Post-success grace window in seconds: a served token's TTL shrinks to this so a stalled transfer can retry within it.Optional

Environment variable: PAPERLESS_MCP_TRANSFER_GRACE_TTL_S

Crashed-handler reclaim window in seconds for an in-flight reservation.Optional

Environment variable: PAPERLESS_MCP_TRANSFER_LEASE_S

Maximum size in bytes of a single upload.Optional

Environment variable: PAPERLESS_MCP_TRANSFER_MAX_UPLOAD_BYTES

Seconds SIGTERM may spend draining in-flight requests before the HTTP server exits. Keep it at or below the termination grace period the orchestrator allows. `0` drops in-flight requests immediately.Optional

Environment variable: PAPERLESS_MCP_SHUTDOWN_GRACE_S

Public base URL of the deployed server, for example `https://mcp.example.com`. Required for OIDC. Also the fallback source of the MCP Apps domain when `app_domain` is unset.Optional

Environment variable: PAPERLESS_MCP_BASE_URL

Single shared bearer token; enables bearer auth unless `bearer_tokens_file` is set, which takes precedence.Required

Environment variable: PAPERLESS_MCP_BEARER_TOKEN

OIDC discovery document URL, for example `https://auth.example.com/.well-known/openid-configuration`.Optional

Environment variable: PAPERLESS_MCP_OIDC_CONFIG_URL

OIDC client identifier registered with the provider.Optional

Environment variable: PAPERLESS_MCP_OIDC_CLIENT_ID

OIDC client secret registered with the provider.Required

Environment variable: PAPERLESS_MCP_OIDC_CLIENT_SECRET

Expected `aud` claim; tokens issued for another audience are rejected.Optional

Environment variable: PAPERLESS_MCP_OIDC_AUDIENCE

Scopes a caller must present, space- or comma-separated. Defaults to `openid` in oidc-proxy mode.Optional

Environment variable: PAPERLESS_MCP_OIDC_REQUIRED_SCOPES

Scopes advertised to MCP clients in protected-resource metadata, space- or comma-separated. Overrides the default `openid offline_access`; `oidc_required_scopes` is always added on top. Set this when the registered client is not permitted `offline_access`, or to have clients request extra claim scopes (such as `groups`) without also requiring them in every token.Optional

Environment variable: PAPERLESS_MCP_OIDC_ADVERTISED_SCOPES

Signing key for issued tokens; used in oidc-proxy mode only. When unset, the key is derived deterministically from `oidc_client_secret`, so tokens survive a restart. Rotating that secret then invalidates every issued token. Set this explicitly to decouple token validity from secret rotation. Generate with `openssl rand -hex 32`.Required

Environment variable: PAPERLESS_MCP_OIDC_JWT_SIGNING_KEY

Validate the access token instead of the id token.Optional

Environment variable: PAPERLESS_MCP_OIDC_VERIFY_ACCESS_TOKEN

MCP Apps iframe domain, used for CSP sandboxing. Overrides the host derived from `base_url`.Optional

Environment variable: PAPERLESS_MCP_APP_DOMAIN

Explicit auth-mode override, accepting `remote` or `oidc-proxy` (case- and whitespace-insensitive). When unset the mode is auto-detected from which auth variables are set; the override exists because having all four OIDC variables set is ambiguous between those two modes. Other values are ignored with a warning.Optional

Environment variable: PAPERLESS_MCP_AUTH_MODE

Path to a TOML file mapping bearer tokens to subjects; overrides the single-token `bearer_token` mode.Optional

Environment variable: PAPERLESS_MCP_BEARER_TOKENS_FILE

Subject assigned to the single-token bearer mode; ignored when `bearer_tokens_file` is set, since mapped mode carries per-token subjects.Optional

Environment variable: PAPERLESS_MCP_BEARER_DEFAULT_SUBJECT

Mount path for the MCP endpoint; the health routes derive their prefix from it.Optional

Environment variable: PAPERLESS_MCP_HTTP_PATH

How much the unauthenticated /health and /health/ready bodies say: status, standard (adds name, version and per-check verdicts), or full (adds redacted reasons; trusted networks only).Optional

Environment variable: PAPERLESS_MCP_HEALTH_DETAIL

Run the server process as this UID; the container entrypoint reassigns ownership of writable paths to match.Optional

Environment variable: PUID

Run the server process as this GID; pair with PUID to match the owner of a mounted volume.Optional

Environment variable: PGID

How to Install

Add this to your MCP configuration file:

{
  "mcpServers": {
    "io-github-pvliesdonk-paperless-mcp": {
      "env": {
        "PGID": "your-pgid-here",
        "PUID": "your-puid-here",
        "FASTMCP_LOG_LEVEL": "your-fastmcp-log-level-here",
        "PAPERLESS_MCP_BASE_URL": "your-paperless-mcp-base-url-here",
        "PAPERLESS_MCP_API_TOKEN": "your-paperless-mcp-api-token-here",
        "PAPERLESS_MCP_AUTH_MODE": "your-paperless-mcp-auth-mode-here",
        "PAPERLESS_MCP_HTTP_PATH": "your-paperless-mcp-http-path-here",
        "PAPERLESS_MCP_APP_DOMAIN": "your-paperless-mcp-app-domain-here",
        "PAPERLESS_MCP_TOOLS_DENY": "your-paperless-mcp-tools-deny-here",
        "PAPERLESS_MCP_SERVER_NAME": "your-paperless-mcp-server-name-here",
        "PAPERLESS_MCP_TOOLS_ALLOW": "your-paperless-mcp-tools-allow-here",
        "PAPERLESS_MCP_BEARER_TOKEN": "your-paperless-mcp-bearer-token-here",
        "PAPERLESS_MCP_HTTP_RETRIES": "your-paperless-mcp-http-retries-here",
        "PAPERLESS_MCP_INSTRUCTIONS": "your-paperless-mcp-instructions-here",
        "PAPERLESS_MCP_KV_STORE_URL": "your-paperless-mcp-kv-store-url-here",
        "FASTMCP_ENABLE_RICH_LOGGING": "your-fastmcp-enable-rich-logging-here",
        "PAPERLESS_MCP_HEALTH_DETAIL": "your-paperless-mcp-health-detail-here",
        "PAPERLESS_MCP_OIDC_AUDIENCE": "your-paperless-mcp-oidc-audience-here",
        "PAPERLESS_MCP_PAPERLESS_URL": "your-paperless-mcp-paperless-url-here",
        "PAPERLESS_MCP_OIDC_CLIENT_ID": "your-paperless-mcp-oidc-client-id-here",
        "PAPERLESS_MCP_OIDC_CONFIG_URL": "your-paperless-mcp-oidc-config-url-here",
        "PAPERLESS_MCP_DEFAULT_PAGE_SIZE": "your-paperless-mcp-default-page-size-here",
        "PAPERLESS_MCP_BEARER_TOKENS_FILE": "your-paperless-mcp-bearer-tokens-file-here",
        "PAPERLESS_MCP_INSTRUCTIONS_EXTRA": "your-paperless-mcp-instructions-extra-here",
        "PAPERLESS_MCP_OIDC_CLIENT_SECRET": "your-paperless-mcp-oidc-client-secret-here",
        "PAPERLESS_MCP_HTTP_TIMEOUT_SECONDS": "your-paperless-mcp-http-timeout-seconds-here",
        "PAPERLESS_MCP_INSTANCE_DESCRIPTION": "your-paperless-mcp-instance-description-here",
        "PAPERLESS_MCP_OIDC_JWT_SIGNING_KEY": "your-paperless-mcp-oidc-jwt-signing-key-here",
        "PAPERLESS_MCP_OIDC_REQUIRED_SCOPES": "your-paperless-mcp-oidc-required-scopes-here",
        "PAPERLESS_MCP_PAPERLESS_PUBLIC_URL": "your-paperless-mcp-paperless-public-url-here",
        "PAPERLESS_MCP_BEARER_DEFAULT_SUBJECT": "your-paperless-mcp-bearer-default-subject-here",
        "PAPERLESS_MCP_OIDC_ADVERTISED_SCOPES": "your-paperless-mcp-oidc-advertised-scopes-here",
        "PAPERLESS_MCP_OIDC_VERIFY_ACCESS_TOKEN": "your-paperless-mcp-oidc-verify-access-token-here"
      },
      "args": [
        "pvliesdonk-paperless-mcp"
      ],
      "command": "uvx"
    }
  }
}

Reviews

No reviews yet

Be the first to review this server!

More Developer Tools MCP Servers

Git

Free

by Modelcontextprotocol · Developer Tools

Read, search, and manipulate Git repositories programmatically

90.6K
Stars
18
Installs
6.5
Security
No ratings yet
Local

Fetch

Free

by Modelcontextprotocol · Developer Tools

Web content fetching and conversion for efficient LLM usage

90.6K
Stars
18
Installs
5.3
Security
5.0
Local

Paperclip

Free

by Paperclipai · Developer Tools

Trending hip-hop artist momentum scores across four cultural dimensions.

81.1K
Stars
1
Installs
10.0
Security
No ratings yet
Remote

Toleno

Free

by Toleno · Developer Tools

Toleno Network MCP Server — Manage your Toleno mining account with Claude AI using natural language.

223
Stars
782
Installs
8.0
Security
4.8
Local

mcp-creator-python

Free

by mcp-marketplace · Developer Tools

Create, build, and publish Python MCP servers to PyPI — conversationally.

-
Stars
137
Installs
10.0
Security
4.7
Local

MCP Marketplace

Free

by mcp-marketplace · Developer Tools

Search and install MCP servers from inside your AI client.

-
Stars
118
Installs
10.0
Security
5.0
Remote