nick/bookstack-mcp
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

update

Browse Source
This commit is contained in:
nick
2026-08-16 22:21:19 -07:00
parent 4ad9a62f0f
commit b3212235db
5 changed files with 474 additions and 43 deletions
Download Patch File Download Diff File Expand all files Collapse all files
example.env
+43 -9
View File
@@ -41,23 +41,57 @@ MCP_PATH=/mcp
# Auth: how Claude authenticates TO this server
# none no auth (local testing only)
# token static bearer tokens (Claude Code / CLI only)
# github GitHub OAuth (works with claude.ai AND Claude Code)
# github+token both at once <-- recommended
# oidc your own IdP -- Authentik, Keycloak, Authelia, Zitadel, ...
# github GitHub OAuth (use if you have no IdP)
# oidc+token OIDC for claude.ai + static token for Claude Code <-- recommended
# github+token same, with GitHub as the IdP
# ---------------------------------------------------------------------------
MCP_AUTH_MODE=github+token
MCP_AUTH_MODE=oidc+token
# Public HTTPS URL of THIS server. Required for GitHub OAuth.
# Public HTTPS URL of THIS server. Required for any OAuth mode.
MCP_PUBLIC_URL=https://mcp.example.com
# Comma-separated. Generate with: openssl rand -hex 32
MCP_STATIC_TOKENS=
# GitHub OAuth App (https://github.com/settings/developers)
# Authorization callback URL must be exactly:
# --- Option A: your own OIDC provider -------------------------------------
# The discovery document URL. Examples:
# Authentik https://auth.example.com/application/o/bookstack-mcp/.well-known/openid-configuration
# Keycloak https://auth.example.com/realms/main/.well-known/openid-configuration
# Authelia https://auth.example.com/.well-known/openid-configuration
# Zitadel https://auth.example.com/.well-known/openid-configuration
OIDC_CONFIG_URL=
# Register a NEW confidential client in your IdP for this server -- do not
# reuse the BookStack client. Redirect URI must be exactly:
# https://mcp.example.com/auth/callback
OIDC_CLIENT_ID=
OIDC_CLIENT_SECRET=
# Set true if your IdP issues opaque (non-JWT) access tokens; the ID token is
# then verified instead. Authelia and Okta commonly need this. Keycloak and
# Authentik issue JWTs, so leave it false.
OIDC_VERIFY_ID_TOKEN=false
# Claim holding the user's groups. Supports dot-notation for nested claims,
# e.g. Keycloak's resource_access.bookstack-mcp.roles
OIDC_GROUPS_CLAIM=groups
# Override the requested scopes entirely, if your provider needs something
# specific. Default: openid, profile, email, offline_access (+ groups claim
# when MCP_REQUIRED_GROUPS is set).
OIDC_SCOPES=
# --- Option B: GitHub instead of your own IdP -----------------------------
# https://github.com/settings/developers
# Callback URL: https://mcp.example.com/auth/callback
GITHUB_CLIENT_ID=
GITHUB_CLIENT_SECRET=
# Only these GitHub usernames may use the server. Leave empty to allow anyone
# who can complete the GitHub login (almost never what you want).
GITHUB_ALLOWED_USERS=your-github-username
# --- Who may use the server (applies to whichever provider you chose) ------
# Matched against login / preferred_username / email / sub. Case-insensitive.
MCP_ALLOWED_USERS=
# And/or require membership of at least one of these groups.
# Leave BOTH empty and anyone who can log in to your IdP gets in.
MCP_REQUIRED_GROUPS=wiki-users