NextcloudBLOCK
Nextcloud MCP Server: Connect AI assistants to your Nextcloud instance with 34 comprehensive tools for Notes, Calendar, Contacts, Tables, and WebDAV file operations. Full TypeScript implementation with Smithery deployment support.
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
MCP Endpoint: https://mcp.techmavie.digital/nextcloud/mcp
Note: This project is a complete rewrite in TypeScript of the original Python-based cbcoutinho/nextcloud-mcp-server, now with self-hosted VPS deployment and Smithery deployment support. ### Key Differences from the Original Repository: Language: This project is written in TypeScript, while the original is in Python. Smithery Support: Added full support for Smithery deployment and local testing via Smithery playground. Project Structure: The project structure has been adapted for a Node.js/TypeScript environment with MCP SDK integration. Dependencies: This project uses npm for package management, whereas the original uses Python's dependency management tools. Deployment:* Now supports both local development and cloud deployment via Smithery.
The Nextcloud MCP (Model Context Protocol) server allows Large Language Models (LLMs) like OpenAI's GPT, Google's Gemini, or Anthropic's Claude to interact with your Nextcloud instance. This enables automation of various Nextcloud actions across Notes, Calendar, Contacts, Tables, and WebDAV file operations.
The hosted HTTP integration now supports a safer multi-user flow through the MCP Key Service. Instead of embedding raw Nextcloud credentials in the connector URL, hosted clients can use a user-scoped usr_... key and let the server resolve credentials server-side.
Features
The server provides integration with multiple Nextcloud apps, enabling LLMs to interact with your Nextcloud data through a comprehensive set of 30 tools across 5 main categories.
Supported Nextcloud Apps
d36e9a9165baOBSERVED · 2026-10-08Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.
claude mcp add sdk --env KEY_SERVICE_TOKEN=${KEY_SERVICE_TOKEN} --env KEY_SERVICE_URL=${KEY_SERVICE_URL} --env MCP_API_KEY=${MCP_API_KEY} -- npx -y @modelcontextprotocol/[email protected]{
"mcpServers": {
"sdk": {
"command": "npx",
"args": [
"-y",
"@modelcontextprotocol/[email protected]"
],
"env": {
"KEY_SERVICE_TOKEN": "${KEY_SERVICE_TOKEN}",
"KEY_SERVICE_URL": "${KEY_SERVICE_URL}",
"MCP_API_KEY": "${MCP_API_KEY}"
}
}
}
}Exposed tools (28)
12 read · 10 write · 6 destructive. Blast radius: 6 tools can delete or overwrite — an agent that can be talked into calling a tool can be talked into calling this one.
| Tool | Risk | Description |
|---|---|---|
nc_calendar_create_event | write | |
nc_calendar_delete_event | destructive | |
nc_calendar_get_event | read | |
nc_calendar_list_calendars | read | |
nc_calendar_list_events | read | |
nc_calendar_update_event | write | |
nc_contacts_create_addressbook | write | |
nc_contacts_create_contact | write | |
nc_contacts_delete_addressbook | destructive | |
nc_contacts_delete_contact | destructive | |
nc_contacts_list_addressbooks | read | |
nc_contacts_list_contacts | read | |
nc_notes_append_content | read | |
nc_notes_create_note | write | |
nc_notes_delete_note | destructive | |
nc_notes_search_notes | read | |
nc_notes_update_note | write | |
nc_tables_delete_row | destructive | |
nc_tables_get_schema | read | |
nc_tables_insert_row | write | |
nc_tables_list_tables | read | |
nc_tables_read_table | read | |
nc_tables_update_row | write | |
nc_webdav_create_directory | write | |
nc_webdav_delete_resource | destructive | |
nc_webdav_list_directory | read | |
nc_webdav_read_file | read | |
nc_webdav_write_file | write |
Trust audit
BLOCKgrade D · trust 69/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | FAIL |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | WARN |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (1 observation(s))
- Network
- declared (10 observation(s))
- Shell
- declared (1 observation(s))
- Dependencies
- not all pinned
- Secrets in source
- none-found
Findings (12)
exec(`${command} "${url}"`);proxy_pass http://127.0.0.1:8085;
proxy_pass http://127.0.0.1:8085;
proxy_pass http://127.0.0.1:8085;
proxy_pass http://127.0.0.1:8085;
nc_calendar_delete_event, nc_contacts_delete_addressbook, nc_contacts_delete_contact, nc_notes_delete_note, nc_tables_delete_row, nc_webdav_delete_resource
.env.sample
curl http://127.0.0.1:8080/health
@modelcontextprotocol/sdk, axios, cors, dotenv, express, fast-xml-parser, localtunnel, npm-run-all
> **Important:** The HTTP server does NOT use `NEXTCLOUD_*` environment variables. In self-hosted mode, each client must provide Nextcloud credentials via request headers. In key-service mode, clients
.smithery/index.cjs
> **Note:** In CLI mode, credentials are read from environment variables (`NEXTCLOUD_HOST`, `NEXTCLOUD_USERNAME`, `NEXTCLOUD_PASSWORD`). This is safe because CLI mode runs locally for a single user.
Gates applied: no_behavioural_pass.
d36e9a9165bafull audit observations/trust-audit/mcp-server/hithereiamaliff__nextcloud-2.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-08 | d36e9a9165ba | BLOCK | D | 69 | first audit |
Questions
What is the Nextcloud MCP server?
Nextcloud MCP Server: Connect AI assistants to your Nextcloud instance with 34 comprehensive tools for Notes, Calendar, Contacts, Tables, and WebDAV file operations. Full TypeScript implementation with Smithery deployment support.
What tools does Nextcloud expose?
28 in total: 12 read-only, 10 that write, and 6 that can delete or overwrite (nc_calendar_delete_event, nc_contacts_delete_addressbook, nc_contacts_delete_contact, nc_notes_delete_note, nc_tables_delete_row). Every one is listed on this page with its risk.
Is Nextcloud safe to connect to an agent?
No — not without reading the findings first. The audit graded it D (69/100) and found 1 critical or high issue in the source. Each one is listed on this page with the file and line it is on. Separately from the audit: 6 of its tools can destroy data, so scope the token you give it to what you actually need.
What credentials does Nextcloud need?
It reads KEY_SERVICE_TOKEN, KEY_SERVICE_URL and MCP_API_KEY from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How does Nextcloud run?
It speaks stdio and streamable-http, so it runs as a local process your client starts. It is published on npm as @modelcontextprotocol/sdk at 1.17.4.
How current is this page?
The grade is for one exact copy of the source (d36e9a9165ba), read on 2026-10-08. The repository is watched and re-audited when it changes.