98 lines
4.0 KiB
Bash
98 lines
4.0 KiB
Bash
# ---------------------------------------------------------------------------
|
|
# BookStack connection
|
|
# ---------------------------------------------------------------------------
|
|
# Root URL of your BookStack instance, no trailing slash and no /api suffix.
|
|
BOOKSTACK_URL=https://wiki.example.com
|
|
|
|
# From BookStack: profile menu > Edit Profile > API Tokens > Create Token.
|
|
# The token user's roles decide exactly what this MCP server can see and do.
|
|
# Create a dedicated user with only the access you want to expose.
|
|
BOOKSTACK_TOKEN_ID=
|
|
BOOKSTACK_TOKEN_SECRET=
|
|
|
|
# Set to false only if BookStack uses a self-signed certificate.
|
|
BOOKSTACK_VERIFY_TLS=true
|
|
BOOKSTACK_TIMEOUT=30
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# Behaviour
|
|
# ---------------------------------------------------------------------------
|
|
# true = search/read tools only (recommended to start)
|
|
# false = also expose create_page, update_page, create_book, create_chapter
|
|
BOOKSTACK_READ_ONLY=true
|
|
|
|
# Only relevant when BOOKSTACK_READ_ONLY=false. Adds delete_page (recycle bin).
|
|
BOOKSTACK_ALLOW_DELETE=false
|
|
|
|
# Page bodies longer than this are truncated before being sent to Claude.
|
|
MCP_MAX_CONTENT_CHARS=40000
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# Transport
|
|
# ---------------------------------------------------------------------------
|
|
MCP_HOST=0.0.0.0
|
|
MCP_PORT=8080
|
|
MCP_PATH=/mcp
|
|
|
|
# Optional DNS-rebinding protection. Set to your public hostname(s).
|
|
# MCP_ALLOWED_HOSTS=mcp.example.com
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# Auth: how Claude authenticates TO this server
|
|
# none no auth (local testing only)
|
|
# token static bearer tokens (Claude Code / CLI only)
|
|
# oidc your own IdP -- Authentik, Keycloak, Authelia, Zitadel, ...
|
|
# github GitHub OAuth (use if you have no IdP)
|
|
# oidc+token OIDC for claude.ai + static token for Claude Code <-- recommended
|
|
# github+token same, with GitHub as the IdP
|
|
# ---------------------------------------------------------------------------
|
|
MCP_AUTH_MODE=oidc+token
|
|
|
|
# Public HTTPS URL of THIS server. Required for any OAuth mode.
|
|
MCP_PUBLIC_URL=https://mcp.example.com
|
|
|
|
# Comma-separated. Generate with: openssl rand -hex 32
|
|
MCP_STATIC_TOKENS=
|
|
|
|
# --- Option A: your own OIDC provider -------------------------------------
|
|
# The discovery document URL. Examples:
|
|
# Authentik https://auth.example.com/application/o/bookstack-mcp/.well-known/openid-configuration
|
|
# Keycloak https://auth.example.com/realms/main/.well-known/openid-configuration
|
|
# Authelia https://auth.example.com/.well-known/openid-configuration
|
|
# Zitadel https://auth.example.com/.well-known/openid-configuration
|
|
OIDC_CONFIG_URL=
|
|
|
|
# Register a NEW confidential client in your IdP for this server -- do not
|
|
# reuse the BookStack client. Redirect URI must be exactly:
|
|
# https://mcp.example.com/auth/callback
|
|
OIDC_CLIENT_ID=
|
|
OIDC_CLIENT_SECRET=
|
|
|
|
# Set true if your IdP issues opaque (non-JWT) access tokens; the ID token is
|
|
# then verified instead. Authelia and Okta commonly need this. Keycloak and
|
|
# Authentik issue JWTs, so leave it false.
|
|
OIDC_VERIFY_ID_TOKEN=false
|
|
|
|
# Claim holding the user's groups. Supports dot-notation for nested claims,
|
|
# e.g. Keycloak's resource_access.bookstack-mcp.roles
|
|
OIDC_GROUPS_CLAIM=groups
|
|
|
|
# Override the requested scopes entirely, if your provider needs something
|
|
# specific. Default: openid, profile, email, offline_access (+ groups claim
|
|
# when MCP_REQUIRED_GROUPS is set).
|
|
OIDC_SCOPES=
|
|
|
|
# --- Option B: GitHub instead of your own IdP -----------------------------
|
|
# https://github.com/settings/developers
|
|
# Callback URL: https://mcp.example.com/auth/callback
|
|
GITHUB_CLIENT_ID=
|
|
GITHUB_CLIENT_SECRET=
|
|
|
|
# --- Who may use the server (applies to whichever provider you chose) ------
|
|
# Matched against login / preferred_username / email / sub. Case-insensitive.
|
|
MCP_ALLOWED_USERS=
|
|
|
|
# And/or require membership of at least one of these groups.
|
|
# Leave BOTH empty and anyone who can log in to your IdP gets in.
|
|
MCP_REQUIRED_GROUPS=wiki-users
|