MCP Server

1 min readStableAdvanced

OwnDocs ships a Model Context Protocol server at /api/mcp exposing search_docs and fetch_page tools to MCP clients.

Quick Start

The endpoint speaks JSON-RPC 2.0 over stateless HTTP and is always enabled in public mode (ACCESS_MODE=public).

Adding Options

In private mode, the route is disabled unless both variables are set.

Bash

MCP_ENABLED=true
MCP_BEARER_TOKEN=your-secret-token

Clients send Authorization: Bearer <token> on every request. When the route is disabled it returns 404.

Advanced

The route implements server/discover, tools/list, and tools/call. Requests must send an MCP-Protocol-Version header matching a supported version (2026-07-28); tools/call must also send matching MCP-Method and MCP-Name headers. Token comparison is constant-time. fetch_page decodes the URL and rejects path traversal segment-by-segment with JSON-RPC error -32602. Requests are rate-limited to 60 per minute per token or client IP.

Options

MCP_ENABLEDenvDefault: false

Enables the route in private mode. Ignored in public mode, where the route is always enabled.

MCP_BEARER_TOKENenv

Required in private mode when MCP_ENABLED=true. Optional in public mode, but enforced there when set.

toolsstring[]

search_docs, fetch_page.

Smart 404

Was this page helpful?