Skip to content

# MCP Servers — nuclide.systems

Complete reference for all 30 MCP servers. MCP is now served by Bifrost at `https://ai.nuclide.systems/mcp`. Last verified: 2026-05-23. Gateway migrated to Bifrost: 2026-05-26.

> The old mcp-gateway (FastAPI/DinD, `mcp.nuclide.systems`) was decommissioned 2026-05-26 — compose renamed `.DECOMMISSIONED-2026-05-26`. Config file was at `/opt/stacks/ai/mcp-gateway/config.json` on CT 104 · Secrets: `/opt/stacks/ai/.env`

## Overview

# | Server | Group | Kind | Gateway URL | Status
--- | --- | --- | --- | --- | ---
1 | `context7` | dev | catalog | `https://ai.nuclide.systems/mcp/context7/mcp` | ✓
2 | `fetch` | dev | spawn | `https://ai.nuclide.systems/mcp/fetch/mcp` | ✓
3 | `git` | dev | catalog | `https://ai.nuclide.systems/mcp/git/mcp` | ✓
4 | `gitlab` | dev | catalog | `https://ai.nuclide.systems/mcp/gitlab/mcp` | ✓
5 | `kroki` | dev | static | `https://ai.nuclide.systems/mcp/kroki/mcp` | ✓
6 | `markitdown` | dev | catalog | `https://ai.nuclide.systems/mcp/markitdown/mcp` | ✓
7 | `sequential-thinking` | dev | catalog | `https://ai.nuclide.systems/mcp/sequential-thinking/mcp` | ✓
8 | `time` | dev | spawn | `https://ai.nuclide.systems/mcp/time/mcp` | ✓
9 | `docling` | dev | static | `https://ai.nuclide.systems/mcp/docling/mcp` | ✓
10 | `coder` | dev | static | `https://ai.nuclide.systems/mcp/coder/mcp` | ✓
11 | `gitea` | dev | static | `https://ai.nuclide.systems/mcp/gitea/mcp` | ✓
12 | `proxmox` | dev | spawn | `https://ai.nuclide.systems/mcp/proxmox/mcp` | ✓
13 | `shepard` | dev | static | `https://ai.nuclide.systems/mcp/shepard/mcp` | ✓
14 | `crawl4ai` | research | spawn | `https://ai.nuclide.systems/mcp/crawl4ai/mcp` | ✓
15 | `paper-search` | research | catalog | `https://ai.nuclide.systems/mcp/paper-search/mcp` | ✓
16 | `searxng` | research | spawn | `https://ai.nuclide.systems/mcp/searxng/mcp` | ✓
17 | `wikipedia-mcp` | research | catalog | `https://ai.nuclide.systems/mcp/wikipedia-mcp/mcp` | ✓
18 | `youtube-transcript` | research | catalog | `https://ai.nuclide.systems/mcp/youtube-transcript/mcp` | ✓
19 | `bluesky` | personal | static | `https://ai.nuclide.systems/mcp/bluesky/mcp` | ✓
20 | `obsidian` | personal | spawn | `https://ai.nuclide.systems/mcp/obsidian/mcp` | ✓
21 | `gotify` | personal | spawn | `https://ai.nuclide.systems/mcp/gotify/mcp` | ✓
22 | `home-assistant` | personal | static | `https://ai.nuclide.systems/mcp/home-assistant/mcp` | ✓
23 | `immich` | personal | spawn | `https://ai.nuclide.systems/mcp/immich/mcp` | ✓
24 | `memos` | personal | spawn | `https://ai.nuclide.systems/mcp/memos/mcp` | ✓
25 | `n8n` | personal | static | `https://ai.nuclide.systems/mcp/n8n/mcp` | ✓
26 | `nextcloud` | personal | spawn | `https://ai.nuclide.systems/mcp/nextcloud/mcp` | ✓
27 | `paperless` | personal | static | `https://ai.nuclide.systems/mcp/paperless/mcp` | ✓
28 | `unifi` | personal | spawn | `https://ai.nuclide.systems/mcp/unifi/mcp` | ✓
29 | `comfyui` | image | static | `https://ai.nuclide.systems/mcp/comfyui/mcp` | ✓
30 | `upload-artifact` | storage | static | `https://ai.nuclide.systems/mcp/upload-artifact/mcp` | ✓

Auth: all Bifrost MCP URLs require `Authorization: Bearer sk-bf-<key>`. MCP endpoint: `https://ai.nuclide.systems/mcp`.

## Group: `dev`

### `context7` — Library documentation

| Value
--- | ---
Kind | catalog (`mcp/context7`)
Internal upstream | `http://mcp-context7:8000`
Image | `mcp-catalog-bridge` → Docker MCP Catalog `mcp/context7`
Transport | streamable-HTTP
Resources | 256 MiB mem limit
Cache TTL | 300 s
Credentials | none
Notes | Fetches live documentation for libraries/frameworks. No env vars.

### `fetch` — HTTP fetch

| Value
--- | ---
Kind | spawn
Internal upstream | `http://mcp-fetch:8000`
Image | `ghcr.io/astral-sh/uv:python3.12-trixie-slim`
Command | `uvx --with mcp-server-fetch mcp-proxy --stateless --host 0.0.0.0 --port 8000 -- python -m mcp_server_fetch`
Transport | streamable-HTTP
Cache TTL | 120 s
Credentials | none

### `git` — Git operations

| Value
--- | ---
Kind | catalog (`mcp/git`)
Internal upstream | `http://mcp-git:8000`
Image | `mcp-catalog-bridge` → Docker MCP Catalog `mcp/git`
Transport | streamable-HTTP
Resources | 256 MiB mem limit
Credentials | none
Notes | DinD child runs in `ai-internal` network.

### `gitlab` — GitLab (DLR)

| Value
--- | ---
Kind | catalog (`mcp/gitlab`)
Internal upstream | `http://mcp-gitlab:8000`
Image | `mcp-catalog-bridge` → Docker MCP Catalog `mcp/gitlab`
Transport | streamable-HTTP
Resources | 256 MiB mem limit
Credentials |
`GITLAB_PERSONAL_ACCESS_TOKEN` | `C8OXPT0J_oY-ha6KAzcn0286MQp1OjEyaAk.01.0z0jn01p4`
`GITLAB_API_URL` | `https://gitlab.dlr.de/api/v4`
Notes | Uses `--pass-environment` in bridge cmd so Docker CLI resolves `-e KEY` passthrough. Targets DLR GitLab, not gitlab.com.

### `kroki` — Diagram rendering

| Value
--- | ---
Kind | static
Internal upstream | `http://kroki-mcp:8000` (own stack, `:18007` on host)
Transport | streamable-HTTP
Health check | every 300 s
Credentials | none
Notes | Supports Mermaid, Excalidraw, and all Kroki-supported formats.

### `markitdown` — Markdown conversion

| Value
--- | ---
Kind | catalog (`mcp/markitdown`)
Internal upstream | `http://mcp-markitdown:8000`
Image | `mcp-catalog-bridge` → Docker MCP Catalog `mcp/markitdown`
Transport | streamable-HTTP
Resources | 256 MiB mem limit
Credentials | none

### `sequential-thinking` — Chain-of-thought reasoning

| Value
--- | ---
Kind | catalog (`mcp/sequentialthinking`)
Internal upstream | `http://mcp-sequential-thinking:8000`
Image | `mcp-catalog-bridge` → Docker MCP Catalog `mcp/sequentialthinking`
Transport | streamable-HTTP
Resources | 256 MiB mem limit
Credentials | none

### `time` — Time & timezone

| Value
--- | ---
Kind | spawn
Internal upstream | `http://mcp-time:8000`
Image | `ghcr.io/astral-sh/uv:python3.12-trixie-slim`
Command | `uvx --with mcp-server-time mcp-proxy --stateless --host 0.0.0.0 --port 8000 -- python -m mcp_server_time --local-timezone Europe/Berlin`
Transport | streamable-HTTP
Credentials | none

### `docling` — PDF → Markdown (SAIA)

| Value
--- | ---
Kind | static
Internal upstream | `http://docling-mcp:8000` (own stack, `:18005` on host)
Transport | streamable-HTTP
Health check | every 300 s
Credentials | none
Notes | SAIA-powered Docling; handles PDF, DOCX, images → Markdown.

### `coder` — Coder workspace management

| Value
--- | ---
Kind | static
Internal upstream | `http://coder-mcp:8000` (own stack on `ai-internal`)
Transport | streamable-HTTP
Health check | every 300 s
Credentials | Coder token baked into `coder-mcp` container env (see `/opt/stacks/ai/coder-mcp/`)
Notes | Replaced daytona 2026-05-20. Can create/start/stop Coder workspaces on CT 111.

### `gitea` — Gitea (git.nuclide.systems)

| Value
--- | ---
Kind | static
Internal upstream | `http://gitea-mcp:8000` (own stack `/opt/stacks/ai/gitea-mcp.yml`)
Image | `docker.gitea.com/gitea-mcp-server:latest`
Command | `/app/gitea-mcp -t http --port 8000 --host 0.0.0.0`
Transport | streamable-HTTP (native)
Health check | every 300 s
Tools | 53 (repo/issue/PR/file CRUD, releases, users, orgs)
Credentials |
`GITEA_HOST` | `https://git.nuclide.systems`
`GITEA_ACCESS_TOKEN` | `${GITEA_TOKEN}` → `.env`
Notes | Added 2026-05-23. Targets CT 111 Gitea. Read + write access.

### `proxmox` — Proxmox VE (192.168.1.20)

| Value
--- | ---
Kind | spawn
Internal upstream | `http://mcp-proxmox:8000` (own stack `/opt/stacks/ai/proxmox-mcp.yml`)
Image | `ghcr.io/astral-sh/uv:python3.12-trixie-slim`
Command | `uvx proxmox-mcp-plus`
Package | `proxmox-mcp-plus` (PyPI)
Transport | streamable-HTTP (`MCP_TRANSPORT=STREAMABLE_HTTP`)
Resources | 512 MiB mem limit
Cache TTL | 30 s
Tools | 39 (VMs, LXC, nodes, storage, tasks, firewall, HA — read-only)
Credentials |
`PROXMOX_HOST` | `192.168.1.20`
`PROXMOX_PORT` | `8006`
`PROXMOX_USER` | `root@pam`
`PROXMOX_TOKEN_NAME` | `mcp`
`PROXMOX_TOKEN_VALUE` | `${PROXMOX_TOKEN_SECRET}` → `.env`
`PROXMOX_VERIFY_SSL` | `false`
`PROXMOX_DEV_MODE` | `true` (required to allow self-signed cert with verify_ssl=false)
Notes | Added 2026-05-23. Token `root@pam!mcp` has `PVEAuditor` role at `/` (read-only, privsep). Self-signed TLS on PVE host requires `DEV_MODE=true`.

### `shepard` — Shepard product platform

| Value
--- | ---
Kind | static (exact upstream)
Upstream | `https://shepard.nuclide.systems/v2/mcp`
Transport | streamable-HTTP
Health check | disabled
Auth header | `Authorization: Bearer ${SHEPARD_API_KEY}`

`SHEPARD_API_KEY`

`eyJhbGciOiJSUzI1NiJ9.eyJzdWIiOiI3ZWVhZDk0Mi02M2E1LTRjZmMtYWVhOS1iMWQwZjBhMjkxZWEiLCJpc3MiOiJodHRwOi8vbG9jYWxob3N0OjgwODAvIiwibmJmIjoxNzc5MzcyODQyLCJpYXQiOjE3NzkzNzI4NDIsImp0aSI6ImY5YzAyYjc3LTNkZGYtNGZjZS1hYzJlLTBlYmM5N2FlYjJhZiJ9.Z9LY9vwLm2l0TmORQ2GriCnkLPzZnSC9q2sE62Ab8Gpi_374Gd5MffDkute0xF2ZwbhH3aRSCpEd93HmFDs-1F3IwoFQpBGiLedTL0N3gC_6J-PFv_i54FHFImEiH_h0yJilzrfgR4Prn_hFZMniE080Kf3Ll-uvYnNK-U-AkPjqb8KfP1BA6dt3HjiOjpicdSh2URpzAKxyVwddGeve3Ha9LboPu-dOb8nmiwiW6E75eakNGGR2mwPxITDxVaqxuSipBwBiDIHzfU4iT7T7b8aipvGd1upfGlx7RcbHdGg9gVNR4jH_--5qLb5124MQxZ486dlH6i7w6AMqtdkzGA`

Notes | Native MCP endpoint on CT 101 Shepard stack (Keycloak + backend).

## Group: `research`

### `crawl4ai` — Web crawling / scraping

| Value
--- | ---
Kind | spawn
Internal upstream | `http://mcp-crawl4ai:11235`
Image | `unclecode/crawl4ai:latest`
Transport | SSE (`/sse`)
Resources | 2 GiB mem limit; OOM score adj 300
Cache TTL | 120 s
Credentials | none

### `paper-search` — Academic paper search

| Value
--- | ---
Kind | catalog (`mcp/paper-search`)
Internal upstream | `http://mcp-paper-search:8000`
Image | `mcp-catalog-bridge` → Docker MCP Catalog `mcp/paper-search`
Transport | streamable-HTTP
Resources | 256 MiB mem limit
Cache TTL | 300 s
Credentials |
`UNPAYWALL_EMAIL` | `fkrebs@nucli.de`
Notes | `--pass-environment` passthrough. Optional: `CORE_API_KEY`, `DOAJ_API_KEY` (not currently set).

### `searxng` — Web search (self-hosted)

| Value
--- | ---
Kind | spawn
Internal upstream | `http://mcp-searxng:8000`
Image | `isokoliuk/mcp-searxng:latest`
Transport | streamable-HTTP
Credentials |
`SEARXNG_URL` | `http://searxng:8080` (internal `shared_backend` network)
Notes | Routes to the self-hosted SearXNG instance. No external API keys needed.

### `wikipedia-mcp` — Wikipedia search

| Value
--- | ---
Kind | catalog (`mcp/wikipedia-mcp`)
Internal upstream | `http://mcp-wikipedia-mcp:8000`
Image | `mcp-catalog-bridge` → Docker MCP Catalog `mcp/wikipedia-mcp`
Transport | streamable-HTTP
Resources | 256 MiB mem limit
Cache TTL | 300 s
Credentials | none

### `youtube-transcript` — YouTube transcripts

| Value
--- | ---
Kind | catalog (`mcp/youtube-transcript`)
Internal upstream | `http://mcp-youtube-transcript:8000`
Image | `mcp-catalog-bridge` → Docker MCP Catalog `mcp/youtube-transcript`
Transport | streamable-HTTP
Resources | 256 MiB mem limit
Cache TTL | 300 s
Credentials | none

## Group: `personal`

### `bluesky` — Bluesky / AT Protocol

| Value
--- | ---
Kind | static
Internal upstream | `http://ariel-mcp:8000` (own container on `ai-internal`)
Transport | streamable-HTTP
Health check | every 300 s
Credentials (baked into `ariel-mcp` env) |
`ATPROTO_IDENTIFIER` | `nucli.de`
`ATPROTO_PASSWORD` | `blxw-datl-l7zo-qwwq`
`BLUESKY_IDENTIFIER` | `nucli.de`
`BLUESKY_APP_PASSWORD` | `4mrm-go4j-avzg-2yo7`
Notes | Uses Brian Ellin's `ariel-mcp` image. Rate-limit handling pending.

### `obsidian` — Obsidian vault (Nextcloud-backed)

| Value
--- | ---
Kind | spawn
Image | `mcp-obsidian-bridge` + mcpvault
Internal upstream | `http://mcp-obsidian:8000`
Transport | streamable-HTTP
Cache TTL | 30 s
Vault path (container) | `/vault`
Vault path (CT 104 host) | `/mnt/pve/unas/services/nextcloud/fkrebs@nucli.de/files/Notizen`
Vault path (CT 105 Nextcloud) | same — both CTs bind-mount UNAS via `/mnt/pve/unas`
Vault path (UNAS NFS) | `192.168.1.31:/var/nfs/shared/storage/services/nextcloud/fkrebs@nucli.de/files/Notizen`
Nextcloud-visible path | `fkrebs@nucli.de` user → `Notizen/` folder (sync target for Obsidian desktop/mobile)
Credentials | filesystem access only; no Nextcloud API needed
Notes | Vault is the canonical Obsidian store, written by Nextcloud sync from desktop/mobile clients and read/written by the MCP server. Backed up via Backrest media/services plans (UNAS coverage).

### `gotify` — Push notifications

| Value
--- | ---
Kind | spawn
Internal upstream | `http://mcp-gotify:8000`
Image | `kcofoni/gotify-mcp`
Transport | HTTP (`GOTIFY_MCP_TRANSPORT=http`)
Cache TTL | 0 (real-time)
Credentials |
`GOTIFY_URL` | `http://192.168.1.40:10003`
`GOTIFY_CLIENT_TOKEN` | `CwaslnnN-MTNRoC`
`GOTIFY_APP_TOKEN` | `AO84CFvU4XmoPBJ`
Notes | Can send and receive push notifications. App token = send; client token = receive.

### `home-assistant` — Home Assistant

| Value
--- | ---
Kind | static (exact upstream)
Upstream | `http://192.168.1.60:9583/private_ehnWeRl2G3De6NnbcN7teQ`
Transport | streamable-HTTP
Health check | disabled
Cache TTL | 15 s
Credentials | Token embedded in path (`/private_ehnWeRl2G3De6NnbcN7teQ`) — HA MCP add-on authentication
Notes | Direct to HA add-on on VM 100. ~2492 entities. `exact_upstream: true` so the path is forwarded verbatim.

### `immich` — Immich photo library

| Value
--- | ---
Kind | spawn
Internal upstream | `http://mcp-immich:8000`
Image | `ghcr.io/astral-sh/uv:python3.12-trixie-slim`
Command | `uvx --with immich-mcp` → uvicorn streamable-HTTP app
Transport | streamable-HTTP
Credentials |
`IMMICH_BASE_URL` | `http://192.168.1.40:12000`
`IMMICH_API_KEY` | `jhtAOjyCU1cXxBoj6gZGLfCjpv8TmcwaXqiex6f5po`
Notes | DNS rebinding protection disabled (TransportSecuritySettings).

### `memos` — Memos notes

| Value
--- | ---
Kind | spawn
Internal upstream | `http://mcp-memos:8000`
Image | `ghcr.io/astral-sh/uv:python3.12-trixie-slim`
Command | `uvx --with mcp-server-memos mcp-proxy --stateless ... -- mcp-server-memos --host 192.168.1.40 --port 17000 --token "$MEMOS_TOKEN"`
Transport | streamable-HTTP
Cache TTL | 0 (real-time)
Credentials |
`MEMOS_TOKEN` | `memos_pat_sOnvLytuaaVdEiqUSWubgfLut6AnoWb0`
Health probe | `search_memo` with keyword `__healthcheck__`

### `n8n` — n8n workflow automation

| Value
--- | ---
Kind | static (exact upstream)
Upstream | `https://n8n.nuclide.systems/mcp-server/http`
Transport | streamable-HTTP
Health check | disabled
TLS | `insecure_tls: true` (self-signed cert workaround)
Auth header | `Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiI4YWY1YzgxMy1mODljLTRiODMtYmNmOC01ZDU5ODY0YTAzOGEiLCJpc3MiOiJuOG4iLCJhdWQiOiJtY3Atc2VydmVyLWFwaSIsImp0aSI6IjBmNjA1NDBmLTBmZmQtNGEwNS1iNjZlLTA2ZjU2YzZlNjY2MCIsImlhdCI6MTc3OTQ1NjAzN30.hf_Vg45R_hOJSY11H4GVAuvqWv39SitvtIXBXnorlXQ`
Notes | n8n MCP server; exposes configured workflows as tools. JWT `iat: 1779456037`.

### `nextcloud` — Nextcloud files & calendar

| Value
--- | ---
Kind | spawn
Internal upstream | `http://mcp-nextcloud:8000`
Image | `ghcr.io/cbcoutinho/nextcloud-mcp-server:latest`
Transport | streamable-HTTP
Mode | `MCP_DEPLOYMENT_MODE=single_user_basic`
Health check | disabled
Credentials |
`NEXTCLOUD_HOST` | `https://nc.nuclide.systems`
`NEXTCLOUD_USERNAME` | `fkrebs@nucli.de`
`NEXTCLOUD_PASSWORD` | `iRn4ECFf2dS24B9sFP3fkPosjrPVKZdaJBuwRpP9sVBnL6A7qN6lXNk2iK4yYblksc2ewzkb`
`NEXTCLOUD_VERIFY_SSL` | `false`
Notes | App-password generated via `occ` for `fkrebs@nucli.de` 2026-05-22. Re-enabled after fix.

### `paperless` — Paperless-NGX

| Value
--- | ---
Kind | static
Internal upstream | `http://paperless-mcp:8000` (own stack `/opt/stacks/ai/paperless-mcp.yml`)
Image | custom build `./mcp-servers/paperless/Dockerfile`
Base | `ghcr.io/astral-sh/uv:bookworm-slim` + Node 20 + `@nloui/paperless-mcp`
Transport | streamable-HTTP (via mcp-proxy wrapper — package is stdio-only)
Health check | every 300 s
Tools | 12 (document search, retrieve, tags, correspondents, document types)
Credentials |
`PAPERLESS_URL` | `http://paperless-ngx-webserver-1:8000` (`shared_backend` network)
`PAPERLESS_API_TOKEN` | `${PAPERLESS_API_TOKEN}` → `.env`
Notes | Added 2026-05-23. npm package moved from `paperless-mcp` to `@nloui/paperless-mcp`. paperless-ngx webserver has a chown permissions error causing restarts — MCP server starts but tool calls will fail until paperless-ngx is fixed (see separate issue).

### `unifi` — UniFi Network

| Value
--- | ---
Kind | spawn
Internal upstream | `http://mcp-unifi:8000`
Image | `ghcr.io/enuno/unifi-mcp-server:latest`
Transport | HTTP (`MCP_SERVER_TRANSPORT=http`)
Cache TTL | 15 s
Credentials |
`UNIFI_API_KEY` | `yeBrsK8l6h5LSBc8ocsdLeSkGnc9bsKY`
`UNIFI_API_TYPE` | `local`
`UNIFI_LOCAL_HOST` | `192.168.1.1`
`UNIFI_LOCAL_PORT` | `443`
`UNIFI_LOCAL_VERIFY_SSL` | `false`
Notes | 197 tools. Network App API key (local API). Site Manager/cloud tools need `UNIFI_SITE_MANAGER_ENABLED`.

## Group: `image`

### `comfyui` — ComfyUI image generation

| Value
--- | ---
Kind | static
Internal upstream | `http://comfyui-mcp:8000` (own stack, `:18003` on host)
Transport | streamable-HTTP
Health check | every 300 s
Credentials | none (auth via gateway Bearer)
Notes | Intel Arc iGPU; FLUX.1-schnell GGUF. LobeChat can also connect directly to `http://comfyui-mcp:8000/mcp` on `ai-internal`. See `comfyui.md`.

## Group: `storage`

### `upload-artifact` — S3 artifact upload

| Value
--- | ---
Kind | static
Internal upstream | `http://upload-artifact-mcp:8000` (own stack, `:18011` on host)
Transport | streamable-HTTP
Health check | every 300 s
Credentials | Garage S3 credentials baked into `upload-artifact-mcp` container env
Notes | Uploads chat artifacts (images, files) to Garage S3 at `s3.nuclide.systems`.

## Client configuration

### Auto (recommended)

> Note: URLs below use the new Bifrost endpoint. Old `mcp.nuclide.systems` routes are decommissioned.

    GET https://ai.nuclide.systems/mcp-config?format=claude   # Claude Code / Claude Desktop
    GET https://ai.nuclide.systems/mcp-config?format=cursor   # Cursor
    GET https://ai.nuclide.systems/mcp-config?format=raw      # raw token + URLs

Auth: `Authorization: Bearer sk-bf-<key>`. Merge `mcpServers` block into `~/.claude/settings.json`.

### Manual (Claude Code)

    {
      "mcpServers": {
        "<name>": {
          "type": "http",
          "url": "https://ai.nuclide.systems/mcp/<name>/mcp",
          "headers": {
            "Authorization": "Bearer sk-bf-<key>"
          }
        }
      }
    }

## Gateway management API

Bifrost management API (auth: `sk-bf-<key>`).

    BASE=https://ai.nuclide.systems
    # List all servers + status
    curl -H "Authorization: Bearer sk-bf-..." $BASE/api/servers

    # Health check
    curl $BASE/health

## Other credentials in gateway `.env`

These are available to spawned containers via `${VAR}` substitution in `config.json`:

Variable | Value | Used by
--- | --- | ---
`GATEWAY_API_KEYS` | `JxxCqKw32XoN4LOHunDikS6u1RpS7R5ythzaqADPuIA` | All API/proxy calls to gateway
`LITELLM_MASTER_KEY` | `sk-tapirnase` | LiteLLM proxy (shared pw — rotate pending)
`LITELLM_API_KEY` | `sk-tapirnase` | same
`GITEA_TOKEN` | `c15e3348bf725054131633061002d677685cd4f4` | Gitea API access
`NEXTCLOUD_MCP_OAUTH_CLIENT_ID` | `82ca2d53-6df4-4671-875c-fee85b54b76f` | Pocket-ID client for MCP spawned servers
`NEXTCLOUD_MCP_OAUTH_CLIENT_SECRET` | `zOfHItEeKVa6Tf40RpnhihFmgnCDkkfz` | same
`SHEPARD_BASE_URL` | `https://shepard-api.nuclide.systems/shepard/api` | Shepard API
`GOTIFY_TOKEN_ALERTS` | `AtjFdduWArgAe7q` | Gotify — alert app token (gateway internal)
`GOTIFY_TOKEN_AGENTS` | `AB3dzfj5TUPCfYf` | Gotify — agent app token (gateway internal)