MCP Connector - Releases

← App details

Nextcloud 34

MCP Connector 0.1.2
Release Details
UpdatedAug. 20, 2026, 8:41 a.m.
Changelog

A maintenance release with no new feature. It opens the app to clients that register a return address of their own scheme, which is what kept Cursor out, and it tightens four places where the app trusted what a request said about itself instead of what it sent.

Changed

  • A client that registers several return addresses at once is no longer refused because one of them is inadmissible. The inadmissible entries are dropped and the registration keeps the allowed ones, and the answer names the addresses that were actually registered. This is what kept Cursor out: it registers a cursor:// scheme next to two acceptable addresses. The rule itself is unchanged, https on any host and http on loopback only, a dropped address is never a redirect target, and a registration whose every address is inadmissible is still refused.
  • An excerpt of a document now reads only what it keeps. The bundling tool keeps two kilobytes per hit and used to fetch up to 512 kilobytes to do it, so one call with three excerpts could move one and a half megabytes through the instance. The answer is the same one as before, the transfer behind it is a fraction of it.
  • A pause that has nothing behind it is cleaned up after 90 days. The switch a user sets for their own account was stored forever, also for accounts that no longer exist, and on setups that reuse account names a new account could inherit the pause of an old one and start switched off without anybody having done that. A pause with a connection behind it is untouched, whatever its age.
  • The app's database does less work per request. The table setup ran on every single open of the file, including the account switch check that sits on every request of a connected assistant, and it now runs when a process opens the file for the first time. A store file that is removed while the app runs is still recreated.
  • The public address is stored in one spelling. An address typed with capital letters in the administration settings became the name this app publishes about itself, and a client that was given the same address in lower case failed a comparison nothing explained. The scheme and the host name are levelled now, which changes nothing about the address itself; a path is left exactly as it was typed, because there capital letters do mean something.
  • The administration form of a fresh installation links to the documentation instead of to a page that cannot exist. Before an address is set, the app does not know where it can be reached, and the link of the form pointed at the administrator's own machine.
  • The log line an administrator gets when no usable public address is set now says which of the two cases it is: none is stored, or one is stored and was refused. The line that reports a refused address names both places it can be corrected, the deploy variable and the form, and which of the two wins. Neither line ever contains the address itself.

Fixed

  • A paused account no longer sees a consent screen it cannot use. If the access switch was pulled in another tab while a consent screen stood open, a reload still showed approve and deny. Nothing could be granted, the click was already refused, but the page said the opposite of the switch. It now shows the same note as everywhere else.

Security

  • The uninstall command reads only as much of a request as it is willing to read. Its size limit trusted the length a request announced, and a request that announces none was read into memory whole. The path is an internal one and needs the app's own credentials, so nothing was reachable from outside; the limit now counts what actually arrives, and the command behaves exactly as before.
  • The connections page has the same limit on the same terms. Its size check also read the length a request announced, so a submission that announced none was read whole and carried out, although the page says it refuses a body larger than its four short fields unread. The check now counts what arrives, both places share one implementation, and an ordinary submission is answered exactly as before.
  • The hidden value that protects the consent screen and the connections page against forged form submissions now expires. It used to be the same value for an account for the whole lifetime of the installation, and the only way to change it would have been to replace the data key, which makes every stored connection unreadable. It is bound to a one hour window now, and the previous window is accepted as well, so a page that was open across a full hour still submits. A page older than that is refused the way a forged one is: it shows itself again, and the action has to be repeated.
  • A document can no longer imitate the note this app writes into a text. When a file is too large to be read at once, or when a document is shortened to a short excerpt, the answer says so in the text itself, so an assistant that reads only the text can tell a whole document from the beginning of one. A document that contained that exact sentence could pretend the excerpt of the server ended there and that what followed was a message of the system, or claim to be complete where it was cut. The sentence is now removed from the content of a document before the app writes its own, so it can only come from the app. What an assistant receives is otherwise unchanged.
Licenses AGPLv3+
Certificate-----BEGIN CERTIFICATE-----
MIIECDCCAvACAhPXMA0GCSqGSIb3DQEBCwUAMHsxCzAJBgNVBAYTAkRFMRswGQYD
VQQIDBJCYWRlbi1XdWVydHRlbWJlcmcxFzAVBgNVBAoMDk5leHRjbG91ZCBHbWJI
MTYwNAYDVQQDDC1OZXh0Y2xvdWQgQ29kZSBTaWduaW5nIEludGVybWVkaWF0ZSBB
dXRob3JpdHkwHhcNMjYwODE5MTA0ODM2WhcNMzYxMTI0MTA0ODM2WjAYMRYwFAYD
VQQDDA1tY3BfY29ubmVjdG9yMIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKC
AgEA3nj2Q3rdiiwwC9UZQ37eAfF+6oejRYhVfZRpKPvq0plpSwXc2Nq070uf5d9H
stl7VzHyJ9wO9d5vGVKBJq1VPNTZyZd3+15zTQU6nwmcCP/aFPjaLe4waHGNMF1G
OnB2pf1OTCGq57QcgiWIOpHW9D8yzr/po8FE9YKLWAQS+S6bGYkpBnPTvf31vgn5
dZqm5kMLqKfxTrTjeKxegOq2/ftM9VvtaZQGMZakhAtfv1GT2rqVkKfl1CTYeNOG
Z9cfaBp6IlI3FQ5Ri2bSuYAGqvAZg1oD6NAkAUIoz9ygDCdlc5heasQgMlwT65eZ
yB0OfDnYmhCYLlQQYjt70h90L+4bNDDjyOolrwXkkmonRVO1pqtTz1Cb12CUCyXn
tAO/3Ly2xC32aQk6/dxd1EimHM6Jjn6mlHuFgSZG9GAW3WVIXHdd5pM4NoacfmZG
QJH/7ri0QnWFuHwQQiW/zfKX6NO3OhHRvzDW7ng8O3Vsf59lUmf25hUJwQUsfuLq
PHs6PaHjoAiEGG53Z/2renh5zB79SFXqYULLnOvhu/KE26C0V46gIilqYJ53CQuU
H1y0k5v8Nm216H8+abn30HAltWB9ays7ySfRdJ0Bgl711i91pMzf9L4FG6DltMyy
j/hvEavkR3igcatoqwvsa+/XMX6veTtU4wI3yNJgAUDT3bUCAwEAATANBgkqhkiG
9w0BAQsFAAOCAQEAaDZFXsBtBW0jTZ/Eys11xsBEFfs6T772HIVG3+l2QuCkiDFp
BBdML6PRFrw+MG974JH6YWThqqhPL/SC18OtUyK1G8M/ICxnzWrSzevYutQRgROn
z1jSkO+thMJ+ef+YM2ZEaf5rPfxVWuR3Um4uDN9XmEn+mNYK+k+tWXoH9RzgNFGB
dWhh7WlnKhklrp0ytvwbblOodfbCnjLPkwUstYYnmpVXdbP6bYyiNCpYOOjt+7Hj
tieQ6U++bQKD3lQBJS02S1sTrv96Bni/GSoaNdkvbjP9khYGA9w/UAbISBOE9d+7
+pLJUdeOVK7P6D1DOKYBQ/gzN8Z5I0M2TWvlxg==
-----END CERTIFICATE-----
Signature2xT69qmMcnbhVh3YOwcP/X2hSqm0/8YPK3itIWAtXIa6Gn4k1xXJDVuj+PV4H3fb7/TEcF7y6hUUQktJqiSVT74vUZAZwTFfxQyqr3X25zJKhz+I/HCgDrlG/l5ubNGTAfe7RPDenP6xgImWBXb4GNtmqFOZ0t8N7/vM7pIqPVTjHrk7AzkyWJeQUgViO3eVCn4Obo6JfABsXsuookMeTiyIWpYjI+/1dpj038wOwIcjHOSi+yvc3ltlJEq507bgI88ZWPNxwQ6Ylvi/eCVDU6Bo5PTCCW9co+wvewjGnNTnNAVQ1JHs7uPma78KtmPcIaoYsct3pLTtS1BvMBalyWtgu1FfpO/wzAKaclbsK2BffO/HAWNgtReAw8qmY6HvLsrdwB/7vt+ftlkw6vyzns41nIlj9x4ePOIlSca9MW0daLtYxqJxe9Gxs9UO6RuPAGWmA/MtX2stXLhhRJDSFn8xynCWD84oYGiKR6vAwcKJgBIMC+2cCRmSZXO1SuOpAd2up4+GlkLesKp6/U/jl/8j0Tg3n61K7Uj0oOWFmguiGHz/gDdM2POfk7806qWpYA2v+sxZKJa1hvglijlEv69ApYk4e12QpC1G/bGwFbyv8cElpOJ15CGynYHavoEb/t5DSFliiGN6b236VgxMlofGWatI8PFE2s333w4aBuE=
Signature digestsha512
Dependencies
Required Nextcloud versions >=32.0.0,<35.0.0
Minimum Integer bits32
Download MCP Connector 0.1.2
MCP Connector 0.1.1
Release Details
UpdatedAug. 19, 2026, 8:45 p.m.
Changelog

A maintenance release that makes the listed version installable with one click, and removable without a leftover. Everything the store listed as 0.1.0 needed an environment variable an administrator had no place to set.

Added

  • Administrator settings in Nextcloud for the public address of this app and for the three OAuth switches (client self registration, allowlist only, allowed clients). Administration settings, Security, MCP Connector, no environment variable and no shell.
  • A new administrator command occ mcp_connector:purge --force ends every MCP connection of the instance: it hands every Nextcloud app password this app created back to Nextcloud, empties its database and deletes its data key. Run it before removing the app, see docs/uninstall.md.
  • Setup guides for Open WebUI and MUCGPT, in docs/client-setup.md.
  • Frequently asked questions, including how a user switches the app off for their own account and how an administrator removes it together with its data, in docs/faq.md.

Changed

  • An installation whose public address is not set yet now starts and reports its setup state instead of stopping with an error. Before this release, a one click install from the store ended in a container that restarted forever, because that address can only be set after the install.
  • The per account switch now also prevents new connections from being created. Before, it stopped requests of existing connections but a paused account could still connect another assistant.
  • The store description now answers, in all three languages, the one question users ask: whether they can switch the app off for themselves without their administrator.
  • The tool count in the readme is now correct: 16 tools, not 15, and a contract test reads it from the live tool registry instead of trusting the text.

Fixed

  • The --force option of the purge command is now accepted by the command wrapper, so the command can actually be run.
  • Deleting the data key now passes its key name in the shape AppAPI expects, so a purge leaves no key behind.
Licenses AGPLv3+
Certificate-----BEGIN CERTIFICATE-----
MIIECDCCAvACAhPXMA0GCSqGSIb3DQEBCwUAMHsxCzAJBgNVBAYTAkRFMRswGQYD
VQQIDBJCYWRlbi1XdWVydHRlbWJlcmcxFzAVBgNVBAoMDk5leHRjbG91ZCBHbWJI
MTYwNAYDVQQDDC1OZXh0Y2xvdWQgQ29kZSBTaWduaW5nIEludGVybWVkaWF0ZSBB
dXRob3JpdHkwHhcNMjYwODE5MTA0ODM2WhcNMzYxMTI0MTA0ODM2WjAYMRYwFAYD
VQQDDA1tY3BfY29ubmVjdG9yMIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKC
AgEA3nj2Q3rdiiwwC9UZQ37eAfF+6oejRYhVfZRpKPvq0plpSwXc2Nq070uf5d9H
stl7VzHyJ9wO9d5vGVKBJq1VPNTZyZd3+15zTQU6nwmcCP/aFPjaLe4waHGNMF1G
OnB2pf1OTCGq57QcgiWIOpHW9D8yzr/po8FE9YKLWAQS+S6bGYkpBnPTvf31vgn5
dZqm5kMLqKfxTrTjeKxegOq2/ftM9VvtaZQGMZakhAtfv1GT2rqVkKfl1CTYeNOG
Z9cfaBp6IlI3FQ5Ri2bSuYAGqvAZg1oD6NAkAUIoz9ygDCdlc5heasQgMlwT65eZ
yB0OfDnYmhCYLlQQYjt70h90L+4bNDDjyOolrwXkkmonRVO1pqtTz1Cb12CUCyXn
tAO/3Ly2xC32aQk6/dxd1EimHM6Jjn6mlHuFgSZG9GAW3WVIXHdd5pM4NoacfmZG
QJH/7ri0QnWFuHwQQiW/zfKX6NO3OhHRvzDW7ng8O3Vsf59lUmf25hUJwQUsfuLq
PHs6PaHjoAiEGG53Z/2renh5zB79SFXqYULLnOvhu/KE26C0V46gIilqYJ53CQuU
H1y0k5v8Nm216H8+abn30HAltWB9ays7ySfRdJ0Bgl711i91pMzf9L4FG6DltMyy
j/hvEavkR3igcatoqwvsa+/XMX6veTtU4wI3yNJgAUDT3bUCAwEAATANBgkqhkiG
9w0BAQsFAAOCAQEAaDZFXsBtBW0jTZ/Eys11xsBEFfs6T772HIVG3+l2QuCkiDFp
BBdML6PRFrw+MG974JH6YWThqqhPL/SC18OtUyK1G8M/ICxnzWrSzevYutQRgROn
z1jSkO+thMJ+ef+YM2ZEaf5rPfxVWuR3Um4uDN9XmEn+mNYK+k+tWXoH9RzgNFGB
dWhh7WlnKhklrp0ytvwbblOodfbCnjLPkwUstYYnmpVXdbP6bYyiNCpYOOjt+7Hj
tieQ6U++bQKD3lQBJS02S1sTrv96Bni/GSoaNdkvbjP9khYGA9w/UAbISBOE9d+7
+pLJUdeOVK7P6D1DOKYBQ/gzN8Z5I0M2TWvlxg==
-----END CERTIFICATE-----
Signaturejmw7qA6esPMi1UZ+WPYCxJ1WVrSY2GECbRywJ0kQgJ07fMAD5GOf7V5JQxO4INWofLN6efODhnSQxgmLcxQzQsRaSnvZlK/A1UMg87l4Wtoyo27x0gRQz72u3nn12y1W3Bi3a9TKNLJmMtKB98v7vG31eYWsByx7qXundTw1ItQuWRNf0NxGpAEDxJgj3EAiQ2yIhu1l22P0Lw80+SrpdUv12rnFiNOnU8e2ZQiPmH+2Jc9lgTkWePF8H1YVprJI9EuJDI2WEY9CS+k085592yf82Ivnh50XvIqbE8wBttA4kA02C0e7utdNMOX82SBgkNsxJQCHAFko9vglBy3wshzw5zof8OrZW5BHTjLqNu9SPN0XgcqMevE1jgWvU+2o3lTxdNQKVWVIOy8mu5nDMSvOdXLO41nRuuVN90OaRUFUGt8uzx9xUrJpU5ff6tW0VqKzqdjweUHjfnvjRnUiRzt9C4ujAc1NiINhtm8uKqNUu8dDd1yi2J/qEJUhVUron9cOd8bOj20BeBcC7zMRMprU3lXN3IQG4H73TlGBtsIDk7r1QAWc6w5Vokv6eqdym86GHLGGWEsOkoCojjjrBEL7SKwGVANa0oAx4jNlDLpWcHOHmfAvuS99a/uuhJbXz2FQaGiP9yR9hO6i8KRhygTZ33CAf8bMX8cv+bFgDwI=
Signature digestsha512
Dependencies
Required Nextcloud versions >=32.0.0,<35.0.0
Minimum Integer bits32
Download MCP Connector 0.1.1
MCP Connector 0.1.0
Release Details
UpdatedAug. 19, 2026, 11:13 a.m.
Changelog

First release, submitted to the Nextcloud App Store.

Added

  • MCP server for Nextcloud, deployed as an AppAPI External App behind HaRP.
  • A curated, read first set of tools for files, calendar, notes, deck and contacts, plus prepare_context, which bundles a search and the coming week into a single call.
  • OAuth 2.1 sign in, so a hosted assistant such as Claude.ai or ChatGPT connects through a Nextcloud browser sign in instead of a pasted app password. Dynamic client registration, PKCE, and an administrator allowlist for clients.
  • App password sign in for clients that cannot do OAuth.
  • A per account switch and a connections page: every user pauses or resumes their own access and disconnects any connected assistant, on the app's own /connections page.
  • Every request runs under the identity of the signed in user, so an assistant never sees more than that user sees in the web interface.
  • A privacy and data flow description, see docs/privacy.md.
Licenses AGPLv3+
Certificate-----BEGIN CERTIFICATE-----
MIIECDCCAvACAhPXMA0GCSqGSIb3DQEBCwUAMHsxCzAJBgNVBAYTAkRFMRswGQYD
VQQIDBJCYWRlbi1XdWVydHRlbWJlcmcxFzAVBgNVBAoMDk5leHRjbG91ZCBHbWJI
MTYwNAYDVQQDDC1OZXh0Y2xvdWQgQ29kZSBTaWduaW5nIEludGVybWVkaWF0ZSBB
dXRob3JpdHkwHhcNMjYwODE5MTA0ODM2WhcNMzYxMTI0MTA0ODM2WjAYMRYwFAYD
VQQDDA1tY3BfY29ubmVjdG9yMIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKC
AgEA3nj2Q3rdiiwwC9UZQ37eAfF+6oejRYhVfZRpKPvq0plpSwXc2Nq070uf5d9H
stl7VzHyJ9wO9d5vGVKBJq1VPNTZyZd3+15zTQU6nwmcCP/aFPjaLe4waHGNMF1G
OnB2pf1OTCGq57QcgiWIOpHW9D8yzr/po8FE9YKLWAQS+S6bGYkpBnPTvf31vgn5
dZqm5kMLqKfxTrTjeKxegOq2/ftM9VvtaZQGMZakhAtfv1GT2rqVkKfl1CTYeNOG
Z9cfaBp6IlI3FQ5Ri2bSuYAGqvAZg1oD6NAkAUIoz9ygDCdlc5heasQgMlwT65eZ
yB0OfDnYmhCYLlQQYjt70h90L+4bNDDjyOolrwXkkmonRVO1pqtTz1Cb12CUCyXn
tAO/3Ly2xC32aQk6/dxd1EimHM6Jjn6mlHuFgSZG9GAW3WVIXHdd5pM4NoacfmZG
QJH/7ri0QnWFuHwQQiW/zfKX6NO3OhHRvzDW7ng8O3Vsf59lUmf25hUJwQUsfuLq
PHs6PaHjoAiEGG53Z/2renh5zB79SFXqYULLnOvhu/KE26C0V46gIilqYJ53CQuU
H1y0k5v8Nm216H8+abn30HAltWB9ays7ySfRdJ0Bgl711i91pMzf9L4FG6DltMyy
j/hvEavkR3igcatoqwvsa+/XMX6veTtU4wI3yNJgAUDT3bUCAwEAATANBgkqhkiG
9w0BAQsFAAOCAQEAaDZFXsBtBW0jTZ/Eys11xsBEFfs6T772HIVG3+l2QuCkiDFp
BBdML6PRFrw+MG974JH6YWThqqhPL/SC18OtUyK1G8M/ICxnzWrSzevYutQRgROn
z1jSkO+thMJ+ef+YM2ZEaf5rPfxVWuR3Um4uDN9XmEn+mNYK+k+tWXoH9RzgNFGB
dWhh7WlnKhklrp0ytvwbblOodfbCnjLPkwUstYYnmpVXdbP6bYyiNCpYOOjt+7Hj
tieQ6U++bQKD3lQBJS02S1sTrv96Bni/GSoaNdkvbjP9khYGA9w/UAbISBOE9d+7
+pLJUdeOVK7P6D1DOKYBQ/gzN8Z5I0M2TWvlxg==
-----END CERTIFICATE-----
SignaturexHLM1fq+xTvzXCILBVdQRFYWjjeDeUklcTWcdUC/vKM7HQ96lh5gm/l+Cb9jmXK/WzM9sHUgpD5RPbriXXBxJ1uJjD6oEXhuWi31V0G6ZNHvAGgxsdFHnQ/cAenKbELkoH7t1yX2lNAERmPDFbBkDst9mqBHDJtaWWYTDBHaFxcMBsNUk9C+VjWsh0wUalpuVLLI0Kx778ZzsyzfZLEzYEvyK2HroPC0zrsxXEc0qGzpz/rJPvvzqIiLakRNCA9UWl3ALu8x10abMr5ibjBhVDgGa30ppbxuTKL0iIcYxz25LbBbUFSzRXAkV0j30mQtnMy7cr+zbtGUX9xTl7E3JkGQPalQIx8ORjaH4FhzBvZ8QxIR0FYKcWThqgZ5A1kKLjUhPVxVPoDul4Ks3c3K1SftZyVsDVFRN8MDC4vIuEYS6Za9RKOVzbAr/qefR4eu8Kf74sJVyFGXSWtZNH9VfrzySYAgPylZiveaA9G6mAYLcjT0+OyNc0i+3G1XtmO4Bcnku/0IrabEUuh4WJQoCUQ3BnWr74pgXJcUscFGXshF/wxR0K/9w08cIoyoIjEa71ND8ZKftIeXjLcmke9SvpNdgZVf/UHak/TmDvlmqoteu+LHGx287w0LtjnVVdd/P6hiu9475+peOJ6SuHhHklNAPy/CdS8yhkFFCCaKyZM=
Signature digestsha512
Dependencies
Required Nextcloud versions >=32.0.0,<35.0.0
Minimum Integer bits32
Download MCP Connector 0.1.0

Nextcloud 33

MCP Connector 0.1.2
Release Details
UpdatedAug. 20, 2026, 8:41 a.m.
Changelog

A maintenance release with no new feature. It opens the app to clients that register a return address of their own scheme, which is what kept Cursor out, and it tightens four places where the app trusted what a request said about itself instead of what it sent.

Changed

  • A client that registers several return addresses at once is no longer refused because one of them is inadmissible. The inadmissible entries are dropped and the registration keeps the allowed ones, and the answer names the addresses that were actually registered. This is what kept Cursor out: it registers a cursor:// scheme next to two acceptable addresses. The rule itself is unchanged, https on any host and http on loopback only, a dropped address is never a redirect target, and a registration whose every address is inadmissible is still refused.
  • An excerpt of a document now reads only what it keeps. The bundling tool keeps two kilobytes per hit and used to fetch up to 512 kilobytes to do it, so one call with three excerpts could move one and a half megabytes through the instance. The answer is the same one as before, the transfer behind it is a fraction of it.
  • A pause that has nothing behind it is cleaned up after 90 days. The switch a user sets for their own account was stored forever, also for accounts that no longer exist, and on setups that reuse account names a new account could inherit the pause of an old one and start switched off without anybody having done that. A pause with a connection behind it is untouched, whatever its age.
  • The app's database does less work per request. The table setup ran on every single open of the file, including the account switch check that sits on every request of a connected assistant, and it now runs when a process opens the file for the first time. A store file that is removed while the app runs is still recreated.
  • The public address is stored in one spelling. An address typed with capital letters in the administration settings became the name this app publishes about itself, and a client that was given the same address in lower case failed a comparison nothing explained. The scheme and the host name are levelled now, which changes nothing about the address itself; a path is left exactly as it was typed, because there capital letters do mean something.
  • The administration form of a fresh installation links to the documentation instead of to a page that cannot exist. Before an address is set, the app does not know where it can be reached, and the link of the form pointed at the administrator's own machine.
  • The log line an administrator gets when no usable public address is set now says which of the two cases it is: none is stored, or one is stored and was refused. The line that reports a refused address names both places it can be corrected, the deploy variable and the form, and which of the two wins. Neither line ever contains the address itself.

Fixed

  • A paused account no longer sees a consent screen it cannot use. If the access switch was pulled in another tab while a consent screen stood open, a reload still showed approve and deny. Nothing could be granted, the click was already refused, but the page said the opposite of the switch. It now shows the same note as everywhere else.

Security

  • The uninstall command reads only as much of a request as it is willing to read. Its size limit trusted the length a request announced, and a request that announces none was read into memory whole. The path is an internal one and needs the app's own credentials, so nothing was reachable from outside; the limit now counts what actually arrives, and the command behaves exactly as before.
  • The connections page has the same limit on the same terms. Its size check also read the length a request announced, so a submission that announced none was read whole and carried out, although the page says it refuses a body larger than its four short fields unread. The check now counts what arrives, both places share one implementation, and an ordinary submission is answered exactly as before.
  • The hidden value that protects the consent screen and the connections page against forged form submissions now expires. It used to be the same value for an account for the whole lifetime of the installation, and the only way to change it would have been to replace the data key, which makes every stored connection unreadable. It is bound to a one hour window now, and the previous window is accepted as well, so a page that was open across a full hour still submits. A page older than that is refused the way a forged one is: it shows itself again, and the action has to be repeated.
  • A document can no longer imitate the note this app writes into a text. When a file is too large to be read at once, or when a document is shortened to a short excerpt, the answer says so in the text itself, so an assistant that reads only the text can tell a whole document from the beginning of one. A document that contained that exact sentence could pretend the excerpt of the server ended there and that what followed was a message of the system, or claim to be complete where it was cut. The sentence is now removed from the content of a document before the app writes its own, so it can only come from the app. What an assistant receives is otherwise unchanged.
Licenses AGPLv3+
Certificate-----BEGIN CERTIFICATE-----
MIIECDCCAvACAhPXMA0GCSqGSIb3DQEBCwUAMHsxCzAJBgNVBAYTAkRFMRswGQYD
VQQIDBJCYWRlbi1XdWVydHRlbWJlcmcxFzAVBgNVBAoMDk5leHRjbG91ZCBHbWJI
MTYwNAYDVQQDDC1OZXh0Y2xvdWQgQ29kZSBTaWduaW5nIEludGVybWVkaWF0ZSBB
dXRob3JpdHkwHhcNMjYwODE5MTA0ODM2WhcNMzYxMTI0MTA0ODM2WjAYMRYwFAYD
VQQDDA1tY3BfY29ubmVjdG9yMIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKC
AgEA3nj2Q3rdiiwwC9UZQ37eAfF+6oejRYhVfZRpKPvq0plpSwXc2Nq070uf5d9H
stl7VzHyJ9wO9d5vGVKBJq1VPNTZyZd3+15zTQU6nwmcCP/aFPjaLe4waHGNMF1G
OnB2pf1OTCGq57QcgiWIOpHW9D8yzr/po8FE9YKLWAQS+S6bGYkpBnPTvf31vgn5
dZqm5kMLqKfxTrTjeKxegOq2/ftM9VvtaZQGMZakhAtfv1GT2rqVkKfl1CTYeNOG
Z9cfaBp6IlI3FQ5Ri2bSuYAGqvAZg1oD6NAkAUIoz9ygDCdlc5heasQgMlwT65eZ
yB0OfDnYmhCYLlQQYjt70h90L+4bNDDjyOolrwXkkmonRVO1pqtTz1Cb12CUCyXn
tAO/3Ly2xC32aQk6/dxd1EimHM6Jjn6mlHuFgSZG9GAW3WVIXHdd5pM4NoacfmZG
QJH/7ri0QnWFuHwQQiW/zfKX6NO3OhHRvzDW7ng8O3Vsf59lUmf25hUJwQUsfuLq
PHs6PaHjoAiEGG53Z/2renh5zB79SFXqYULLnOvhu/KE26C0V46gIilqYJ53CQuU
H1y0k5v8Nm216H8+abn30HAltWB9ays7ySfRdJ0Bgl711i91pMzf9L4FG6DltMyy
j/hvEavkR3igcatoqwvsa+/XMX6veTtU4wI3yNJgAUDT3bUCAwEAATANBgkqhkiG
9w0BAQsFAAOCAQEAaDZFXsBtBW0jTZ/Eys11xsBEFfs6T772HIVG3+l2QuCkiDFp
BBdML6PRFrw+MG974JH6YWThqqhPL/SC18OtUyK1G8M/ICxnzWrSzevYutQRgROn
z1jSkO+thMJ+ef+YM2ZEaf5rPfxVWuR3Um4uDN9XmEn+mNYK+k+tWXoH9RzgNFGB
dWhh7WlnKhklrp0ytvwbblOodfbCnjLPkwUstYYnmpVXdbP6bYyiNCpYOOjt+7Hj
tieQ6U++bQKD3lQBJS02S1sTrv96Bni/GSoaNdkvbjP9khYGA9w/UAbISBOE9d+7
+pLJUdeOVK7P6D1DOKYBQ/gzN8Z5I0M2TWvlxg==
-----END CERTIFICATE-----
Signature2xT69qmMcnbhVh3YOwcP/X2hSqm0/8YPK3itIWAtXIa6Gn4k1xXJDVuj+PV4H3fb7/TEcF7y6hUUQktJqiSVT74vUZAZwTFfxQyqr3X25zJKhz+I/HCgDrlG/l5ubNGTAfe7RPDenP6xgImWBXb4GNtmqFOZ0t8N7/vM7pIqPVTjHrk7AzkyWJeQUgViO3eVCn4Obo6JfABsXsuookMeTiyIWpYjI+/1dpj038wOwIcjHOSi+yvc3ltlJEq507bgI88ZWPNxwQ6Ylvi/eCVDU6Bo5PTCCW9co+wvewjGnNTnNAVQ1JHs7uPma78KtmPcIaoYsct3pLTtS1BvMBalyWtgu1FfpO/wzAKaclbsK2BffO/HAWNgtReAw8qmY6HvLsrdwB/7vt+ftlkw6vyzns41nIlj9x4ePOIlSca9MW0daLtYxqJxe9Gxs9UO6RuPAGWmA/MtX2stXLhhRJDSFn8xynCWD84oYGiKR6vAwcKJgBIMC+2cCRmSZXO1SuOpAd2up4+GlkLesKp6/U/jl/8j0Tg3n61K7Uj0oOWFmguiGHz/gDdM2POfk7806qWpYA2v+sxZKJa1hvglijlEv69ApYk4e12QpC1G/bGwFbyv8cElpOJ15CGynYHavoEb/t5DSFliiGN6b236VgxMlofGWatI8PFE2s333w4aBuE=
Signature digestsha512
Dependencies
Required Nextcloud versions >=32.0.0,<35.0.0
Minimum Integer bits32
Download MCP Connector 0.1.2
MCP Connector 0.1.1
Release Details
UpdatedAug. 19, 2026, 8:45 p.m.
Changelog

A maintenance release that makes the listed version installable with one click, and removable without a leftover. Everything the store listed as 0.1.0 needed an environment variable an administrator had no place to set.

Added

  • Administrator settings in Nextcloud for the public address of this app and for the three OAuth switches (client self registration, allowlist only, allowed clients). Administration settings, Security, MCP Connector, no environment variable and no shell.
  • A new administrator command occ mcp_connector:purge --force ends every MCP connection of the instance: it hands every Nextcloud app password this app created back to Nextcloud, empties its database and deletes its data key. Run it before removing the app, see docs/uninstall.md.
  • Setup guides for Open WebUI and MUCGPT, in docs/client-setup.md.
  • Frequently asked questions, including how a user switches the app off for their own account and how an administrator removes it together with its data, in docs/faq.md.

Changed

  • An installation whose public address is not set yet now starts and reports its setup state instead of stopping with an error. Before this release, a one click install from the store ended in a container that restarted forever, because that address can only be set after the install.
  • The per account switch now also prevents new connections from being created. Before, it stopped requests of existing connections but a paused account could still connect another assistant.
  • The store description now answers, in all three languages, the one question users ask: whether they can switch the app off for themselves without their administrator.
  • The tool count in the readme is now correct: 16 tools, not 15, and a contract test reads it from the live tool registry instead of trusting the text.

Fixed

  • The --force option of the purge command is now accepted by the command wrapper, so the command can actually be run.
  • Deleting the data key now passes its key name in the shape AppAPI expects, so a purge leaves no key behind.
Licenses AGPLv3+
Certificate-----BEGIN CERTIFICATE-----
MIIECDCCAvACAhPXMA0GCSqGSIb3DQEBCwUAMHsxCzAJBgNVBAYTAkRFMRswGQYD
VQQIDBJCYWRlbi1XdWVydHRlbWJlcmcxFzAVBgNVBAoMDk5leHRjbG91ZCBHbWJI
MTYwNAYDVQQDDC1OZXh0Y2xvdWQgQ29kZSBTaWduaW5nIEludGVybWVkaWF0ZSBB
dXRob3JpdHkwHhcNMjYwODE5MTA0ODM2WhcNMzYxMTI0MTA0ODM2WjAYMRYwFAYD
VQQDDA1tY3BfY29ubmVjdG9yMIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKC
AgEA3nj2Q3rdiiwwC9UZQ37eAfF+6oejRYhVfZRpKPvq0plpSwXc2Nq070uf5d9H
stl7VzHyJ9wO9d5vGVKBJq1VPNTZyZd3+15zTQU6nwmcCP/aFPjaLe4waHGNMF1G
OnB2pf1OTCGq57QcgiWIOpHW9D8yzr/po8FE9YKLWAQS+S6bGYkpBnPTvf31vgn5
dZqm5kMLqKfxTrTjeKxegOq2/ftM9VvtaZQGMZakhAtfv1GT2rqVkKfl1CTYeNOG
Z9cfaBp6IlI3FQ5Ri2bSuYAGqvAZg1oD6NAkAUIoz9ygDCdlc5heasQgMlwT65eZ
yB0OfDnYmhCYLlQQYjt70h90L+4bNDDjyOolrwXkkmonRVO1pqtTz1Cb12CUCyXn
tAO/3Ly2xC32aQk6/dxd1EimHM6Jjn6mlHuFgSZG9GAW3WVIXHdd5pM4NoacfmZG
QJH/7ri0QnWFuHwQQiW/zfKX6NO3OhHRvzDW7ng8O3Vsf59lUmf25hUJwQUsfuLq
PHs6PaHjoAiEGG53Z/2renh5zB79SFXqYULLnOvhu/KE26C0V46gIilqYJ53CQuU
H1y0k5v8Nm216H8+abn30HAltWB9ays7ySfRdJ0Bgl711i91pMzf9L4FG6DltMyy
j/hvEavkR3igcatoqwvsa+/XMX6veTtU4wI3yNJgAUDT3bUCAwEAATANBgkqhkiG
9w0BAQsFAAOCAQEAaDZFXsBtBW0jTZ/Eys11xsBEFfs6T772HIVG3+l2QuCkiDFp
BBdML6PRFrw+MG974JH6YWThqqhPL/SC18OtUyK1G8M/ICxnzWrSzevYutQRgROn
z1jSkO+thMJ+ef+YM2ZEaf5rPfxVWuR3Um4uDN9XmEn+mNYK+k+tWXoH9RzgNFGB
dWhh7WlnKhklrp0ytvwbblOodfbCnjLPkwUstYYnmpVXdbP6bYyiNCpYOOjt+7Hj
tieQ6U++bQKD3lQBJS02S1sTrv96Bni/GSoaNdkvbjP9khYGA9w/UAbISBOE9d+7
+pLJUdeOVK7P6D1DOKYBQ/gzN8Z5I0M2TWvlxg==
-----END CERTIFICATE-----
Signaturejmw7qA6esPMi1UZ+WPYCxJ1WVrSY2GECbRywJ0kQgJ07fMAD5GOf7V5JQxO4INWofLN6efODhnSQxgmLcxQzQsRaSnvZlK/A1UMg87l4Wtoyo27x0gRQz72u3nn12y1W3Bi3a9TKNLJmMtKB98v7vG31eYWsByx7qXundTw1ItQuWRNf0NxGpAEDxJgj3EAiQ2yIhu1l22P0Lw80+SrpdUv12rnFiNOnU8e2ZQiPmH+2Jc9lgTkWePF8H1YVprJI9EuJDI2WEY9CS+k085592yf82Ivnh50XvIqbE8wBttA4kA02C0e7utdNMOX82SBgkNsxJQCHAFko9vglBy3wshzw5zof8OrZW5BHTjLqNu9SPN0XgcqMevE1jgWvU+2o3lTxdNQKVWVIOy8mu5nDMSvOdXLO41nRuuVN90OaRUFUGt8uzx9xUrJpU5ff6tW0VqKzqdjweUHjfnvjRnUiRzt9C4ujAc1NiINhtm8uKqNUu8dDd1yi2J/qEJUhVUron9cOd8bOj20BeBcC7zMRMprU3lXN3IQG4H73TlGBtsIDk7r1QAWc6w5Vokv6eqdym86GHLGGWEsOkoCojjjrBEL7SKwGVANa0oAx4jNlDLpWcHOHmfAvuS99a/uuhJbXz2FQaGiP9yR9hO6i8KRhygTZ33CAf8bMX8cv+bFgDwI=
Signature digestsha512
Dependencies
Required Nextcloud versions >=32.0.0,<35.0.0
Minimum Integer bits32
Download MCP Connector 0.1.1
MCP Connector 0.1.0
Release Details
UpdatedAug. 19, 2026, 11:13 a.m.
Changelog

First release, submitted to the Nextcloud App Store.

Added

  • MCP server for Nextcloud, deployed as an AppAPI External App behind HaRP.
  • A curated, read first set of tools for files, calendar, notes, deck and contacts, plus prepare_context, which bundles a search and the coming week into a single call.
  • OAuth 2.1 sign in, so a hosted assistant such as Claude.ai or ChatGPT connects through a Nextcloud browser sign in instead of a pasted app password. Dynamic client registration, PKCE, and an administrator allowlist for clients.
  • App password sign in for clients that cannot do OAuth.
  • A per account switch and a connections page: every user pauses or resumes their own access and disconnects any connected assistant, on the app's own /connections page.
  • Every request runs under the identity of the signed in user, so an assistant never sees more than that user sees in the web interface.
  • A privacy and data flow description, see docs/privacy.md.
Licenses AGPLv3+
Certificate-----BEGIN CERTIFICATE-----
MIIECDCCAvACAhPXMA0GCSqGSIb3DQEBCwUAMHsxCzAJBgNVBAYTAkRFMRswGQYD
VQQIDBJCYWRlbi1XdWVydHRlbWJlcmcxFzAVBgNVBAoMDk5leHRjbG91ZCBHbWJI
MTYwNAYDVQQDDC1OZXh0Y2xvdWQgQ29kZSBTaWduaW5nIEludGVybWVkaWF0ZSBB
dXRob3JpdHkwHhcNMjYwODE5MTA0ODM2WhcNMzYxMTI0MTA0ODM2WjAYMRYwFAYD
VQQDDA1tY3BfY29ubmVjdG9yMIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKC
AgEA3nj2Q3rdiiwwC9UZQ37eAfF+6oejRYhVfZRpKPvq0plpSwXc2Nq070uf5d9H
stl7VzHyJ9wO9d5vGVKBJq1VPNTZyZd3+15zTQU6nwmcCP/aFPjaLe4waHGNMF1G
OnB2pf1OTCGq57QcgiWIOpHW9D8yzr/po8FE9YKLWAQS+S6bGYkpBnPTvf31vgn5
dZqm5kMLqKfxTrTjeKxegOq2/ftM9VvtaZQGMZakhAtfv1GT2rqVkKfl1CTYeNOG
Z9cfaBp6IlI3FQ5Ri2bSuYAGqvAZg1oD6NAkAUIoz9ygDCdlc5heasQgMlwT65eZ
yB0OfDnYmhCYLlQQYjt70h90L+4bNDDjyOolrwXkkmonRVO1pqtTz1Cb12CUCyXn
tAO/3Ly2xC32aQk6/dxd1EimHM6Jjn6mlHuFgSZG9GAW3WVIXHdd5pM4NoacfmZG
QJH/7ri0QnWFuHwQQiW/zfKX6NO3OhHRvzDW7ng8O3Vsf59lUmf25hUJwQUsfuLq
PHs6PaHjoAiEGG53Z/2renh5zB79SFXqYULLnOvhu/KE26C0V46gIilqYJ53CQuU
H1y0k5v8Nm216H8+abn30HAltWB9ays7ySfRdJ0Bgl711i91pMzf9L4FG6DltMyy
j/hvEavkR3igcatoqwvsa+/XMX6veTtU4wI3yNJgAUDT3bUCAwEAATANBgkqhkiG
9w0BAQsFAAOCAQEAaDZFXsBtBW0jTZ/Eys11xsBEFfs6T772HIVG3+l2QuCkiDFp
BBdML6PRFrw+MG974JH6YWThqqhPL/SC18OtUyK1G8M/ICxnzWrSzevYutQRgROn
z1jSkO+thMJ+ef+YM2ZEaf5rPfxVWuR3Um4uDN9XmEn+mNYK+k+tWXoH9RzgNFGB
dWhh7WlnKhklrp0ytvwbblOodfbCnjLPkwUstYYnmpVXdbP6bYyiNCpYOOjt+7Hj
tieQ6U++bQKD3lQBJS02S1sTrv96Bni/GSoaNdkvbjP9khYGA9w/UAbISBOE9d+7
+pLJUdeOVK7P6D1DOKYBQ/gzN8Z5I0M2TWvlxg==
-----END CERTIFICATE-----
SignaturexHLM1fq+xTvzXCILBVdQRFYWjjeDeUklcTWcdUC/vKM7HQ96lh5gm/l+Cb9jmXK/WzM9sHUgpD5RPbriXXBxJ1uJjD6oEXhuWi31V0G6ZNHvAGgxsdFHnQ/cAenKbELkoH7t1yX2lNAERmPDFbBkDst9mqBHDJtaWWYTDBHaFxcMBsNUk9C+VjWsh0wUalpuVLLI0Kx778ZzsyzfZLEzYEvyK2HroPC0zrsxXEc0qGzpz/rJPvvzqIiLakRNCA9UWl3ALu8x10abMr5ibjBhVDgGa30ppbxuTKL0iIcYxz25LbBbUFSzRXAkV0j30mQtnMy7cr+zbtGUX9xTl7E3JkGQPalQIx8ORjaH4FhzBvZ8QxIR0FYKcWThqgZ5A1kKLjUhPVxVPoDul4Ks3c3K1SftZyVsDVFRN8MDC4vIuEYS6Za9RKOVzbAr/qefR4eu8Kf74sJVyFGXSWtZNH9VfrzySYAgPylZiveaA9G6mAYLcjT0+OyNc0i+3G1XtmO4Bcnku/0IrabEUuh4WJQoCUQ3BnWr74pgXJcUscFGXshF/wxR0K/9w08cIoyoIjEa71ND8ZKftIeXjLcmke9SvpNdgZVf/UHak/TmDvlmqoteu+LHGx287w0LtjnVVdd/P6hiu9475+peOJ6SuHhHklNAPy/CdS8yhkFFCCaKyZM=
Signature digestsha512
Dependencies
Required Nextcloud versions >=32.0.0,<35.0.0
Minimum Integer bits32
Download MCP Connector 0.1.0

Nextcloud 32

MCP Connector 0.1.2
Release Details
UpdatedAug. 20, 2026, 8:41 a.m.
Changelog

A maintenance release with no new feature. It opens the app to clients that register a return address of their own scheme, which is what kept Cursor out, and it tightens four places where the app trusted what a request said about itself instead of what it sent.

Changed

  • A client that registers several return addresses at once is no longer refused because one of them is inadmissible. The inadmissible entries are dropped and the registration keeps the allowed ones, and the answer names the addresses that were actually registered. This is what kept Cursor out: it registers a cursor:// scheme next to two acceptable addresses. The rule itself is unchanged, https on any host and http on loopback only, a dropped address is never a redirect target, and a registration whose every address is inadmissible is still refused.
  • An excerpt of a document now reads only what it keeps. The bundling tool keeps two kilobytes per hit and used to fetch up to 512 kilobytes to do it, so one call with three excerpts could move one and a half megabytes through the instance. The answer is the same one as before, the transfer behind it is a fraction of it.
  • A pause that has nothing behind it is cleaned up after 90 days. The switch a user sets for their own account was stored forever, also for accounts that no longer exist, and on setups that reuse account names a new account could inherit the pause of an old one and start switched off without anybody having done that. A pause with a connection behind it is untouched, whatever its age.
  • The app's database does less work per request. The table setup ran on every single open of the file, including the account switch check that sits on every request of a connected assistant, and it now runs when a process opens the file for the first time. A store file that is removed while the app runs is still recreated.
  • The public address is stored in one spelling. An address typed with capital letters in the administration settings became the name this app publishes about itself, and a client that was given the same address in lower case failed a comparison nothing explained. The scheme and the host name are levelled now, which changes nothing about the address itself; a path is left exactly as it was typed, because there capital letters do mean something.
  • The administration form of a fresh installation links to the documentation instead of to a page that cannot exist. Before an address is set, the app does not know where it can be reached, and the link of the form pointed at the administrator's own machine.
  • The log line an administrator gets when no usable public address is set now says which of the two cases it is: none is stored, or one is stored and was refused. The line that reports a refused address names both places it can be corrected, the deploy variable and the form, and which of the two wins. Neither line ever contains the address itself.

Fixed

  • A paused account no longer sees a consent screen it cannot use. If the access switch was pulled in another tab while a consent screen stood open, a reload still showed approve and deny. Nothing could be granted, the click was already refused, but the page said the opposite of the switch. It now shows the same note as everywhere else.

Security

  • The uninstall command reads only as much of a request as it is willing to read. Its size limit trusted the length a request announced, and a request that announces none was read into memory whole. The path is an internal one and needs the app's own credentials, so nothing was reachable from outside; the limit now counts what actually arrives, and the command behaves exactly as before.
  • The connections page has the same limit on the same terms. Its size check also read the length a request announced, so a submission that announced none was read whole and carried out, although the page says it refuses a body larger than its four short fields unread. The check now counts what arrives, both places share one implementation, and an ordinary submission is answered exactly as before.
  • The hidden value that protects the consent screen and the connections page against forged form submissions now expires. It used to be the same value for an account for the whole lifetime of the installation, and the only way to change it would have been to replace the data key, which makes every stored connection unreadable. It is bound to a one hour window now, and the previous window is accepted as well, so a page that was open across a full hour still submits. A page older than that is refused the way a forged one is: it shows itself again, and the action has to be repeated.
  • A document can no longer imitate the note this app writes into a text. When a file is too large to be read at once, or when a document is shortened to a short excerpt, the answer says so in the text itself, so an assistant that reads only the text can tell a whole document from the beginning of one. A document that contained that exact sentence could pretend the excerpt of the server ended there and that what followed was a message of the system, or claim to be complete where it was cut. The sentence is now removed from the content of a document before the app writes its own, so it can only come from the app. What an assistant receives is otherwise unchanged.
Licenses AGPLv3+
Certificate-----BEGIN CERTIFICATE-----
MIIECDCCAvACAhPXMA0GCSqGSIb3DQEBCwUAMHsxCzAJBgNVBAYTAkRFMRswGQYD
VQQIDBJCYWRlbi1XdWVydHRlbWJlcmcxFzAVBgNVBAoMDk5leHRjbG91ZCBHbWJI
MTYwNAYDVQQDDC1OZXh0Y2xvdWQgQ29kZSBTaWduaW5nIEludGVybWVkaWF0ZSBB
dXRob3JpdHkwHhcNMjYwODE5MTA0ODM2WhcNMzYxMTI0MTA0ODM2WjAYMRYwFAYD
VQQDDA1tY3BfY29ubmVjdG9yMIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKC
AgEA3nj2Q3rdiiwwC9UZQ37eAfF+6oejRYhVfZRpKPvq0plpSwXc2Nq070uf5d9H
stl7VzHyJ9wO9d5vGVKBJq1VPNTZyZd3+15zTQU6nwmcCP/aFPjaLe4waHGNMF1G
OnB2pf1OTCGq57QcgiWIOpHW9D8yzr/po8FE9YKLWAQS+S6bGYkpBnPTvf31vgn5
dZqm5kMLqKfxTrTjeKxegOq2/ftM9VvtaZQGMZakhAtfv1GT2rqVkKfl1CTYeNOG
Z9cfaBp6IlI3FQ5Ri2bSuYAGqvAZg1oD6NAkAUIoz9ygDCdlc5heasQgMlwT65eZ
yB0OfDnYmhCYLlQQYjt70h90L+4bNDDjyOolrwXkkmonRVO1pqtTz1Cb12CUCyXn
tAO/3Ly2xC32aQk6/dxd1EimHM6Jjn6mlHuFgSZG9GAW3WVIXHdd5pM4NoacfmZG
QJH/7ri0QnWFuHwQQiW/zfKX6NO3OhHRvzDW7ng8O3Vsf59lUmf25hUJwQUsfuLq
PHs6PaHjoAiEGG53Z/2renh5zB79SFXqYULLnOvhu/KE26C0V46gIilqYJ53CQuU
H1y0k5v8Nm216H8+abn30HAltWB9ays7ySfRdJ0Bgl711i91pMzf9L4FG6DltMyy
j/hvEavkR3igcatoqwvsa+/XMX6veTtU4wI3yNJgAUDT3bUCAwEAATANBgkqhkiG
9w0BAQsFAAOCAQEAaDZFXsBtBW0jTZ/Eys11xsBEFfs6T772HIVG3+l2QuCkiDFp
BBdML6PRFrw+MG974JH6YWThqqhPL/SC18OtUyK1G8M/ICxnzWrSzevYutQRgROn
z1jSkO+thMJ+ef+YM2ZEaf5rPfxVWuR3Um4uDN9XmEn+mNYK+k+tWXoH9RzgNFGB
dWhh7WlnKhklrp0ytvwbblOodfbCnjLPkwUstYYnmpVXdbP6bYyiNCpYOOjt+7Hj
tieQ6U++bQKD3lQBJS02S1sTrv96Bni/GSoaNdkvbjP9khYGA9w/UAbISBOE9d+7
+pLJUdeOVK7P6D1DOKYBQ/gzN8Z5I0M2TWvlxg==
-----END CERTIFICATE-----
Signature2xT69qmMcnbhVh3YOwcP/X2hSqm0/8YPK3itIWAtXIa6Gn4k1xXJDVuj+PV4H3fb7/TEcF7y6hUUQktJqiSVT74vUZAZwTFfxQyqr3X25zJKhz+I/HCgDrlG/l5ubNGTAfe7RPDenP6xgImWBXb4GNtmqFOZ0t8N7/vM7pIqPVTjHrk7AzkyWJeQUgViO3eVCn4Obo6JfABsXsuookMeTiyIWpYjI+/1dpj038wOwIcjHOSi+yvc3ltlJEq507bgI88ZWPNxwQ6Ylvi/eCVDU6Bo5PTCCW9co+wvewjGnNTnNAVQ1JHs7uPma78KtmPcIaoYsct3pLTtS1BvMBalyWtgu1FfpO/wzAKaclbsK2BffO/HAWNgtReAw8qmY6HvLsrdwB/7vt+ftlkw6vyzns41nIlj9x4ePOIlSca9MW0daLtYxqJxe9Gxs9UO6RuPAGWmA/MtX2stXLhhRJDSFn8xynCWD84oYGiKR6vAwcKJgBIMC+2cCRmSZXO1SuOpAd2up4+GlkLesKp6/U/jl/8j0Tg3n61K7Uj0oOWFmguiGHz/gDdM2POfk7806qWpYA2v+sxZKJa1hvglijlEv69ApYk4e12QpC1G/bGwFbyv8cElpOJ15CGynYHavoEb/t5DSFliiGN6b236VgxMlofGWatI8PFE2s333w4aBuE=
Signature digestsha512
Dependencies
Required Nextcloud versions >=32.0.0,<35.0.0
Minimum Integer bits32
Download MCP Connector 0.1.2
MCP Connector 0.1.1
Release Details
UpdatedAug. 19, 2026, 8:45 p.m.
Changelog

A maintenance release that makes the listed version installable with one click, and removable without a leftover. Everything the store listed as 0.1.0 needed an environment variable an administrator had no place to set.

Added

  • Administrator settings in Nextcloud for the public address of this app and for the three OAuth switches (client self registration, allowlist only, allowed clients). Administration settings, Security, MCP Connector, no environment variable and no shell.
  • A new administrator command occ mcp_connector:purge --force ends every MCP connection of the instance: it hands every Nextcloud app password this app created back to Nextcloud, empties its database and deletes its data key. Run it before removing the app, see docs/uninstall.md.
  • Setup guides for Open WebUI and MUCGPT, in docs/client-setup.md.
  • Frequently asked questions, including how a user switches the app off for their own account and how an administrator removes it together with its data, in docs/faq.md.

Changed

  • An installation whose public address is not set yet now starts and reports its setup state instead of stopping with an error. Before this release, a one click install from the store ended in a container that restarted forever, because that address can only be set after the install.
  • The per account switch now also prevents new connections from being created. Before, it stopped requests of existing connections but a paused account could still connect another assistant.
  • The store description now answers, in all three languages, the one question users ask: whether they can switch the app off for themselves without their administrator.
  • The tool count in the readme is now correct: 16 tools, not 15, and a contract test reads it from the live tool registry instead of trusting the text.

Fixed

  • The --force option of the purge command is now accepted by the command wrapper, so the command can actually be run.
  • Deleting the data key now passes its key name in the shape AppAPI expects, so a purge leaves no key behind.
Licenses AGPLv3+
Certificate-----BEGIN CERTIFICATE-----
MIIECDCCAvACAhPXMA0GCSqGSIb3DQEBCwUAMHsxCzAJBgNVBAYTAkRFMRswGQYD
VQQIDBJCYWRlbi1XdWVydHRlbWJlcmcxFzAVBgNVBAoMDk5leHRjbG91ZCBHbWJI
MTYwNAYDVQQDDC1OZXh0Y2xvdWQgQ29kZSBTaWduaW5nIEludGVybWVkaWF0ZSBB
dXRob3JpdHkwHhcNMjYwODE5MTA0ODM2WhcNMzYxMTI0MTA0ODM2WjAYMRYwFAYD
VQQDDA1tY3BfY29ubmVjdG9yMIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKC
AgEA3nj2Q3rdiiwwC9UZQ37eAfF+6oejRYhVfZRpKPvq0plpSwXc2Nq070uf5d9H
stl7VzHyJ9wO9d5vGVKBJq1VPNTZyZd3+15zTQU6nwmcCP/aFPjaLe4waHGNMF1G
OnB2pf1OTCGq57QcgiWIOpHW9D8yzr/po8FE9YKLWAQS+S6bGYkpBnPTvf31vgn5
dZqm5kMLqKfxTrTjeKxegOq2/ftM9VvtaZQGMZakhAtfv1GT2rqVkKfl1CTYeNOG
Z9cfaBp6IlI3FQ5Ri2bSuYAGqvAZg1oD6NAkAUIoz9ygDCdlc5heasQgMlwT65eZ
yB0OfDnYmhCYLlQQYjt70h90L+4bNDDjyOolrwXkkmonRVO1pqtTz1Cb12CUCyXn
tAO/3Ly2xC32aQk6/dxd1EimHM6Jjn6mlHuFgSZG9GAW3WVIXHdd5pM4NoacfmZG
QJH/7ri0QnWFuHwQQiW/zfKX6NO3OhHRvzDW7ng8O3Vsf59lUmf25hUJwQUsfuLq
PHs6PaHjoAiEGG53Z/2renh5zB79SFXqYULLnOvhu/KE26C0V46gIilqYJ53CQuU
H1y0k5v8Nm216H8+abn30HAltWB9ays7ySfRdJ0Bgl711i91pMzf9L4FG6DltMyy
j/hvEavkR3igcatoqwvsa+/XMX6veTtU4wI3yNJgAUDT3bUCAwEAATANBgkqhkiG
9w0BAQsFAAOCAQEAaDZFXsBtBW0jTZ/Eys11xsBEFfs6T772HIVG3+l2QuCkiDFp
BBdML6PRFrw+MG974JH6YWThqqhPL/SC18OtUyK1G8M/ICxnzWrSzevYutQRgROn
z1jSkO+thMJ+ef+YM2ZEaf5rPfxVWuR3Um4uDN9XmEn+mNYK+k+tWXoH9RzgNFGB
dWhh7WlnKhklrp0ytvwbblOodfbCnjLPkwUstYYnmpVXdbP6bYyiNCpYOOjt+7Hj
tieQ6U++bQKD3lQBJS02S1sTrv96Bni/GSoaNdkvbjP9khYGA9w/UAbISBOE9d+7
+pLJUdeOVK7P6D1DOKYBQ/gzN8Z5I0M2TWvlxg==
-----END CERTIFICATE-----
Signaturejmw7qA6esPMi1UZ+WPYCxJ1WVrSY2GECbRywJ0kQgJ07fMAD5GOf7V5JQxO4INWofLN6efODhnSQxgmLcxQzQsRaSnvZlK/A1UMg87l4Wtoyo27x0gRQz72u3nn12y1W3Bi3a9TKNLJmMtKB98v7vG31eYWsByx7qXundTw1ItQuWRNf0NxGpAEDxJgj3EAiQ2yIhu1l22P0Lw80+SrpdUv12rnFiNOnU8e2ZQiPmH+2Jc9lgTkWePF8H1YVprJI9EuJDI2WEY9CS+k085592yf82Ivnh50XvIqbE8wBttA4kA02C0e7utdNMOX82SBgkNsxJQCHAFko9vglBy3wshzw5zof8OrZW5BHTjLqNu9SPN0XgcqMevE1jgWvU+2o3lTxdNQKVWVIOy8mu5nDMSvOdXLO41nRuuVN90OaRUFUGt8uzx9xUrJpU5ff6tW0VqKzqdjweUHjfnvjRnUiRzt9C4ujAc1NiINhtm8uKqNUu8dDd1yi2J/qEJUhVUron9cOd8bOj20BeBcC7zMRMprU3lXN3IQG4H73TlGBtsIDk7r1QAWc6w5Vokv6eqdym86GHLGGWEsOkoCojjjrBEL7SKwGVANa0oAx4jNlDLpWcHOHmfAvuS99a/uuhJbXz2FQaGiP9yR9hO6i8KRhygTZ33CAf8bMX8cv+bFgDwI=
Signature digestsha512
Dependencies
Required Nextcloud versions >=32.0.0,<35.0.0
Minimum Integer bits32
Download MCP Connector 0.1.1
MCP Connector 0.1.0
Release Details
UpdatedAug. 19, 2026, 11:13 a.m.
Changelog

First release, submitted to the Nextcloud App Store.

Added

  • MCP server for Nextcloud, deployed as an AppAPI External App behind HaRP.
  • A curated, read first set of tools for files, calendar, notes, deck and contacts, plus prepare_context, which bundles a search and the coming week into a single call.
  • OAuth 2.1 sign in, so a hosted assistant such as Claude.ai or ChatGPT connects through a Nextcloud browser sign in instead of a pasted app password. Dynamic client registration, PKCE, and an administrator allowlist for clients.
  • App password sign in for clients that cannot do OAuth.
  • A per account switch and a connections page: every user pauses or resumes their own access and disconnects any connected assistant, on the app's own /connections page.
  • Every request runs under the identity of the signed in user, so an assistant never sees more than that user sees in the web interface.
  • A privacy and data flow description, see docs/privacy.md.
Licenses AGPLv3+
Certificate-----BEGIN CERTIFICATE-----
MIIECDCCAvACAhPXMA0GCSqGSIb3DQEBCwUAMHsxCzAJBgNVBAYTAkRFMRswGQYD
VQQIDBJCYWRlbi1XdWVydHRlbWJlcmcxFzAVBgNVBAoMDk5leHRjbG91ZCBHbWJI
MTYwNAYDVQQDDC1OZXh0Y2xvdWQgQ29kZSBTaWduaW5nIEludGVybWVkaWF0ZSBB
dXRob3JpdHkwHhcNMjYwODE5MTA0ODM2WhcNMzYxMTI0MTA0ODM2WjAYMRYwFAYD
VQQDDA1tY3BfY29ubmVjdG9yMIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKC
AgEA3nj2Q3rdiiwwC9UZQ37eAfF+6oejRYhVfZRpKPvq0plpSwXc2Nq070uf5d9H
stl7VzHyJ9wO9d5vGVKBJq1VPNTZyZd3+15zTQU6nwmcCP/aFPjaLe4waHGNMF1G
OnB2pf1OTCGq57QcgiWIOpHW9D8yzr/po8FE9YKLWAQS+S6bGYkpBnPTvf31vgn5
dZqm5kMLqKfxTrTjeKxegOq2/ftM9VvtaZQGMZakhAtfv1GT2rqVkKfl1CTYeNOG
Z9cfaBp6IlI3FQ5Ri2bSuYAGqvAZg1oD6NAkAUIoz9ygDCdlc5heasQgMlwT65eZ
yB0OfDnYmhCYLlQQYjt70h90L+4bNDDjyOolrwXkkmonRVO1pqtTz1Cb12CUCyXn
tAO/3Ly2xC32aQk6/dxd1EimHM6Jjn6mlHuFgSZG9GAW3WVIXHdd5pM4NoacfmZG
QJH/7ri0QnWFuHwQQiW/zfKX6NO3OhHRvzDW7ng8O3Vsf59lUmf25hUJwQUsfuLq
PHs6PaHjoAiEGG53Z/2renh5zB79SFXqYULLnOvhu/KE26C0V46gIilqYJ53CQuU
H1y0k5v8Nm216H8+abn30HAltWB9ays7ySfRdJ0Bgl711i91pMzf9L4FG6DltMyy
j/hvEavkR3igcatoqwvsa+/XMX6veTtU4wI3yNJgAUDT3bUCAwEAATANBgkqhkiG
9w0BAQsFAAOCAQEAaDZFXsBtBW0jTZ/Eys11xsBEFfs6T772HIVG3+l2QuCkiDFp
BBdML6PRFrw+MG974JH6YWThqqhPL/SC18OtUyK1G8M/ICxnzWrSzevYutQRgROn
z1jSkO+thMJ+ef+YM2ZEaf5rPfxVWuR3Um4uDN9XmEn+mNYK+k+tWXoH9RzgNFGB
dWhh7WlnKhklrp0ytvwbblOodfbCnjLPkwUstYYnmpVXdbP6bYyiNCpYOOjt+7Hj
tieQ6U++bQKD3lQBJS02S1sTrv96Bni/GSoaNdkvbjP9khYGA9w/UAbISBOE9d+7
+pLJUdeOVK7P6D1DOKYBQ/gzN8Z5I0M2TWvlxg==
-----END CERTIFICATE-----
SignaturexHLM1fq+xTvzXCILBVdQRFYWjjeDeUklcTWcdUC/vKM7HQ96lh5gm/l+Cb9jmXK/WzM9sHUgpD5RPbriXXBxJ1uJjD6oEXhuWi31V0G6ZNHvAGgxsdFHnQ/cAenKbELkoH7t1yX2lNAERmPDFbBkDst9mqBHDJtaWWYTDBHaFxcMBsNUk9C+VjWsh0wUalpuVLLI0Kx778ZzsyzfZLEzYEvyK2HroPC0zrsxXEc0qGzpz/rJPvvzqIiLakRNCA9UWl3ALu8x10abMr5ibjBhVDgGa30ppbxuTKL0iIcYxz25LbBbUFSzRXAkV0j30mQtnMy7cr+zbtGUX9xTl7E3JkGQPalQIx8ORjaH4FhzBvZ8QxIR0FYKcWThqgZ5A1kKLjUhPVxVPoDul4Ks3c3K1SftZyVsDVFRN8MDC4vIuEYS6Za9RKOVzbAr/qefR4eu8Kf74sJVyFGXSWtZNH9VfrzySYAgPylZiveaA9G6mAYLcjT0+OyNc0i+3G1XtmO4Bcnku/0IrabEUuh4WJQoCUQ3BnWr74pgXJcUscFGXshF/wxR0K/9w08cIoyoIjEa71ND8ZKftIeXjLcmke9SvpNdgZVf/UHak/TmDvlmqoteu+LHGx287w0LtjnVVdd/P6hiu9475+peOJ6SuHhHklNAPy/CdS8yhkFFCCaKyZM=
Signature digestsha512
Dependencies
Required Nextcloud versions >=32.0.0,<35.0.0
Minimum Integer bits32
Download MCP Connector 0.1.0