From ca92126cf7ed7c4fb707a36ef4b6c85769045d4b Mon Sep 17 00:00:00 2001 From: David Walter Date: Fri, 17 Jul 2026 09:20:25 +0200 Subject: [PATCH 1/5] feat(deployments): add ocis-mcp-server service to ocis_full example Adds an optional ocis-mcp-server service (toggled via OCIS_MCP=:mcp.yml in .env, same pattern as the other optional services in this example) so a user can run the MCP server as part of the docker-compose stack instead of building and running it locally against the deployment by hand. Signed-off-by: David Walter --- deployments/examples/ocis_full/.env | 26 ++++++++++++++++++++++- deployments/examples/ocis_full/mcp.yml | 29 ++++++++++++++++++++++++++ 2 files changed, 54 insertions(+), 1 deletion(-) create mode 100644 deployments/examples/ocis_full/mcp.yml diff --git a/deployments/examples/ocis_full/.env b/deployments/examples/ocis_full/.env index 07966521851..41ba6aa916c 100644 --- a/deployments/examples/ocis_full/.env +++ b/deployments/examples/ocis_full/.env @@ -297,8 +297,32 @@ MAIL_SERVER_DOCKER_TAG=v1.29.3 #MONITORING_COLLABORATION_OO=m_collaboration-oo.yml +### oCIS MCP Server Settings ### +# Exposes ownCloud Infinite Scale as a set of AI-accessible tools via the Model Context +# Protocol (MCP), so AI assistants (e.g. Claude) can manage users, spaces, files and shares +# through natural language, without installing the MCP server locally. +# See: https://github.com/owncloud/ocis-mcp-server +# Note: the leading colon is required to enable the service. +#OCIS_MCP=:mcp.yml +# Set the desired docker image tag or digest. +# Defaults to "latest" +OCIS_MCP_DOCKER_TAG=latest +# Domain of the MCP server, where MCP clients connect over HTTPS. +# Defaults to "mcp.owncloud.test" +OCIS_MCP_DOMAIN= +# Shared secret MCP clients must send as "Authorization: Bearer ". +# REQUIRED when OCIS_MCP is enabled: the container refuses to start without it, since the +# HTTP endpoint executes every tool with the app token's privileges. +# Generate one with: openssl rand -hex 32 +OCIS_MCP_HTTP_SECRET= +# oCIS app token the MCP server uses to call the oCIS APIs. Create one with: +# docker-compose exec ocis ocis auth-app create --user-name="admin" --expiration="8760h" +OCIS_MCP_APP_TOKEN_USER= +OCIS_MCP_APP_TOKEN_VALUE= + + ## IMPORTANT ## # This MUST be the last line as it assembles the supplemental compose files to be used. # ALL supplemental configs must be added here, whether commented or not. # Each var must either be empty or contain :path/file.yml -COMPOSE_FILE=docker-compose.yml${OCIS:-}${TIKA:-}${S3NG:-}${S3NG_MINIO:-}${COLLABORA:-}${IMPORTER:-}${CLAMAV:-}${ONLYOFFICE:-}${EXTENSIONS:-}${UNZIP:-}${DRAWIO:-}${JSONVIEWER:-}${PROGRESSBARS:-}${EXTERNALSITES:-}${PHOTOADDON:-}${ADVANCEDSEARCH:-}${MAIL_SERVER:-}${MONITORING:-}${KEYCLOAK:-}${VAULT_STORAGE:-} +COMPOSE_FILE=docker-compose.yml${OCIS:-}${TIKA:-}${S3NG:-}${S3NG_MINIO:-}${COLLABORA:-}${IMPORTER:-}${CLAMAV:-}${ONLYOFFICE:-}${EXTENSIONS:-}${UNZIP:-}${DRAWIO:-}${JSONVIEWER:-}${PROGRESSBARS:-}${EXTERNALSITES:-}${PHOTOADDON:-}${ADVANCEDSEARCH:-}${MAIL_SERVER:-}${MONITORING:-}${KEYCLOAK:-}${VAULT_STORAGE:-}${OCIS_MCP:-} diff --git a/deployments/examples/ocis_full/mcp.yml b/deployments/examples/ocis_full/mcp.yml new file mode 100644 index 00000000000..0e1b34af68b --- /dev/null +++ b/deployments/examples/ocis_full/mcp.yml @@ -0,0 +1,29 @@ +--- +services: + ocis-mcp-server: + image: owncloud/ocis-mcp-server:${OCIS_MCP_DOCKER_TAG:-latest} + # release notes: https://github.com/owncloud/ocis-mcp-server/releases + networks: + ocis-net: + depends_on: + ocis: + condition: service_started + environment: + OCIS_MCP_OCIS_URL: https://${OCIS_DOMAIN:-ocis.owncloud.test} + OCIS_MCP_TLS_SKIP_VERIFY: "${INSECURE:-true}" + OCIS_MCP_TRANSPORT: http + OCIS_MCP_HTTP_ADDR: 0.0.0.0:8090 + OCIS_MCP_HTTP_SECRET: ${OCIS_MCP_HTTP_SECRET:-} + OCIS_MCP_APP_TOKEN_USER: ${OCIS_MCP_APP_TOKEN_USER:-} + OCIS_MCP_APP_TOKEN_VALUE: ${OCIS_MCP_APP_TOKEN_VALUE:-} + OCIS_MCP_LOG_LEVEL: ${LOG_LEVEL:-info} + labels: + - "traefik.enable=true" + - "traefik.http.routers.ocis-mcp-server.entrypoints=https" + - "traefik.http.routers.ocis-mcp-server.rule=Host(`${OCIS_MCP_DOMAIN:-mcp.owncloud.test}`)" + - "traefik.http.routers.ocis-mcp-server.tls.certresolver=http" + - "traefik.http.routers.ocis-mcp-server.service=ocis-mcp-server" + - "traefik.http.services.ocis-mcp-server.loadbalancer.server.port=8090" + logging: + driver: ${LOG_DRIVER:-local} + restart: always From 4c8b1d115e13db4a1ae4413c5672079939ac1955 Mon Sep 17 00:00:00 2001 From: David Walter Date: Fri, 17 Jul 2026 09:26:37 +0200 Subject: [PATCH 2/5] docs(deployments): document the ocis-mcp-server option in ocis_full Signed-off-by: David Walter --- deployments/examples/ocis_full/README.md | 9 +++++++++ docs/ocis/deployment/ocis_full.md | 21 +++++++++++++++++++++ 2 files changed, 30 insertions(+) diff --git a/deployments/examples/ocis_full/README.md b/deployments/examples/ocis_full/README.md index e2211b871db..84e81736516 100644 --- a/deployments/examples/ocis_full/README.md +++ b/deployments/examples/ocis_full/README.md @@ -23,3 +23,12 @@ Keycloak can be optionally enabled by uncommenting the corresponding variables i - `KEYCLOAK=:keycloak.yml` Note that Keycloak requires the default `ocis` Identity Provider to be disabled, which is automatically handled when the `keycloak.yml` configuration is used. + +### MCP Server + +The [oCIS MCP Server](https://github.com/owncloud/ocis-mcp-server) exposes this deployment as a set of AI-accessible tools over the Model Context Protocol (MCP), so AI assistants such as Claude can manage users, spaces, files and shares through natural language. It can be optionally enabled by uncommenting the corresponding variable in the `.env` file: +- `OCIS_MCP=:mcp.yml` + +It is reachable at `https://${OCIS_MCP_DOMAIN:-mcp.owncloud.test}` once enabled. Two things must be configured in `.env` before it will start: +- `OCIS_MCP_HTTP_SECRET` — a shared secret every MCP client must send as `Authorization: Bearer `. The container refuses to start without it. +- `OCIS_MCP_APP_TOKEN_USER` / `OCIS_MCP_APP_TOKEN_VALUE` — an oCIS app token, created with `docker-compose exec ocis ocis auth-app create --user-name="admin" --expiration="8760h"`. diff --git a/docs/ocis/deployment/ocis_full.md b/docs/ocis/deployment/ocis_full.md index 744c7bb0bac..6f65c195553 100644 --- a/docs/ocis/deployment/ocis_full.md +++ b/docs/ocis/deployment/ocis_full.md @@ -308,6 +308,27 @@ CLAMAV=:clamav.yml After enabling that service, you can add the service to the stack with `docker-compose up -d` again. +### MCP Server + +You can add the [oCIS MCP Server](https://github.com/owncloud/ocis-mcp-server) to the stack. It exposes oCIS as a set of AI-accessible tools over the Model Context Protocol (MCP). The service is disabled by default. To enable it, uncomment the `OCIS_MCP` line in the `.env` file, then set a bearer secret and an oCIS app token: + +```shell {linenos=table,hl_lines=[3,4,5,6]} +### oCIS MCP Server Settings ### +# The leading colon is required to enable the service. +OCIS_MCP=:mcp.yml +OCIS_MCP_HTTP_SECRET=change-me-to-a-long-random-value +OCIS_MCP_APP_TOKEN_USER=admin +OCIS_MCP_APP_TOKEN_VALUE= +``` + +Create the app token with: + +```bash +docker-compose exec ocis ocis auth-app create --user-name="admin" --expiration="8760h" +``` + +If running locally, add `mcp.owncloud.test` to your hosts file alongside the other domains (see Local Setup above), then bring up the stack again with `docker-compose up -d`. Point your MCP client at `https://mcp.owncloud.test/mcp`, sending the configured secret as `Authorization: Bearer `. + ### Traefik Dashboard If you want to use the Traefik dashboard, set TRAEFIK_DASHBOARD to `true` (default is `false` and therefore not active). If you activate it, you must set a domain for the Traefik dashboard in `TRAEFIK_DOMAIN=` e.g. `TRAEFIK_DOMAIN=traefik.owncloud.test`. From 703c4f6eb958d75aa66705fdae44837dd7e3d0c2 Mon Sep 17 00:00:00 2001 From: David Walter Date: Fri, 17 Jul 2026 10:02:51 +0200 Subject: [PATCH 3/5] docs(deployments): note auth-app must be enabled before creating an MCP app token Signed-off-by: David Walter --- deployments/examples/ocis_full/README.md | 1 + docs/ocis/deployment/ocis_full.md | 4 ++++ 2 files changed, 5 insertions(+) diff --git a/deployments/examples/ocis_full/README.md b/deployments/examples/ocis_full/README.md index 84e81736516..4452bd9e905 100644 --- a/deployments/examples/ocis_full/README.md +++ b/deployments/examples/ocis_full/README.md @@ -32,3 +32,4 @@ The [oCIS MCP Server](https://github.com/owncloud/ocis-mcp-server) exposes this It is reachable at `https://${OCIS_MCP_DOMAIN:-mcp.owncloud.test}` once enabled. Two things must be configured in `.env` before it will start: - `OCIS_MCP_HTTP_SECRET` — a shared secret every MCP client must send as `Authorization: Bearer `. The container refuses to start without it. - `OCIS_MCP_APP_TOKEN_USER` / `OCIS_MCP_APP_TOKEN_VALUE` — an oCIS app token, created with `docker-compose exec ocis ocis auth-app create --user-name="admin" --expiration="8760h"`. + **Note:** the `auth-app` service is not started by default — add `auth-app` to `START_ADDITIONAL_SERVICES` in `.env` first, or the command above will silently create an empty token. diff --git a/docs/ocis/deployment/ocis_full.md b/docs/ocis/deployment/ocis_full.md index 6f65c195553..84efdce3dd7 100644 --- a/docs/ocis/deployment/ocis_full.md +++ b/docs/ocis/deployment/ocis_full.md @@ -321,6 +321,10 @@ OCIS_MCP_APP_TOKEN_USER=admin OCIS_MCP_APP_TOKEN_VALUE= ``` +{{< hint type=important >}} +**Note:** the `auth-app` service is not started by default. Add `auth-app` to `START_ADDITIONAL_SERVICES` in `.env` before running the command below, otherwise it will silently succeed with an empty token. +{{< /hint >}} + Create the app token with: ```bash From 08668a1397f2ae52eca283942a22281be0b6f2ac Mon Sep 17 00:00:00 2001 From: David Walter Date: Fri, 17 Jul 2026 10:06:00 +0200 Subject: [PATCH 4/5] docs(changelog): add changelog entry for ocis-mcp-server in ocis_full Signed-off-by: David Walter --- .../unreleased/enhancement-add-ocis-mcp-server-to-full.md | 8 ++++++++ 1 file changed, 8 insertions(+) create mode 100644 changelog/unreleased/enhancement-add-ocis-mcp-server-to-full.md diff --git a/changelog/unreleased/enhancement-add-ocis-mcp-server-to-full.md b/changelog/unreleased/enhancement-add-ocis-mcp-server-to-full.md new file mode 100644 index 00000000000..6e6205bfd0e --- /dev/null +++ b/changelog/unreleased/enhancement-add-ocis-mcp-server-to-full.md @@ -0,0 +1,8 @@ +Enhancement: Add oCIS MCP Server to the ocis_full deployment example + +Added the oCIS MCP Server (https://github.com/owncloud/ocis-mcp-server) as an optional +service to the ocis_full deployment example. It exposes oCIS as a set of AI-accessible +tools over the Model Context Protocol, so AI assistants such as Claude can manage users, +spaces, files and shares through natural language without the user having to build and +run the MCP server locally. It is disabled by default and can be enabled by uncommenting +`OCIS_MCP=:mcp.yml` in `.env`. From f88af6c129d5180e413fbb0abc43d48763ff769f Mon Sep 17 00:00:00 2001 From: David Walter Date: Fri, 17 Jul 2026 10:07:01 +0200 Subject: [PATCH 5/5] docs(changelog): link PR for ocis-mcp-server changelog entry Signed-off-by: David Walter --- changelog/unreleased/enhancement-add-ocis-mcp-server-to-full.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/changelog/unreleased/enhancement-add-ocis-mcp-server-to-full.md b/changelog/unreleased/enhancement-add-ocis-mcp-server-to-full.md index 6e6205bfd0e..83b08107c67 100644 --- a/changelog/unreleased/enhancement-add-ocis-mcp-server-to-full.md +++ b/changelog/unreleased/enhancement-add-ocis-mcp-server-to-full.md @@ -6,3 +6,5 @@ tools over the Model Context Protocol, so AI assistants such as Claude can manag spaces, files and shares through natural language without the user having to build and run the MCP server locally. It is disabled by default and can be enabled by uncommenting `OCIS_MCP=:mcp.yml` in `.env`. + +https://github.com/owncloud/ocis/pull/12603