# MCP Servers — nuclide.systems

Complete reference for all 30 MCP servers. MCP is now served by **Bifrost** at `https://ai.nuclide.systems/mcp`.
**Last verified: 2026-05-23. Gateway migrated to Bifrost: 2026-05-26.**

> The old mcp-gateway (FastAPI/DinD, `mcp.nuclide.systems`) was **decommissioned 2026-05-26** — compose renamed `.DECOMMISSIONED-2026-05-26`. Config file was at `/opt/stacks/ai/mcp-gateway/config.json` on CT 104 · Secrets: `/opt/stacks/ai/.env`

---

## Overview

| # | Server | Group | Kind | Gateway URL | Status |
|---|---|---|---|---|---|
| 1 | `context7` | dev | catalog | `https://ai.nuclide.systems/mcp/context7/mcp` | ✓ |
| 2 | `fetch` | dev | spawn | `https://ai.nuclide.systems/mcp/fetch/mcp` | ✓ |
| 3 | `git` | dev | catalog | `https://ai.nuclide.systems/mcp/git/mcp` | ✓ |
| 4 | `gitlab` | dev | catalog | `https://ai.nuclide.systems/mcp/gitlab/mcp` | ✓ |
| 5 | `kroki` | dev | static | `https://ai.nuclide.systems/mcp/kroki/mcp` | ✓ |
| 6 | `markitdown` | dev | catalog | `https://ai.nuclide.systems/mcp/markitdown/mcp` | ✓ |
| 7 | `sequential-thinking` | dev | catalog | `https://ai.nuclide.systems/mcp/sequential-thinking/mcp` | ✓ |
| 8 | `time` | dev | spawn | `https://ai.nuclide.systems/mcp/time/mcp` | ✓ |
| 9 | `docling` | dev | static | `https://ai.nuclide.systems/mcp/docling/mcp` | ✓ |
| 10 | `coder` | dev | static | `https://ai.nuclide.systems/mcp/coder/mcp` | ✓ |
| 11 | `gitea` | dev | static | `https://ai.nuclide.systems/mcp/gitea/mcp` | ✓ |
| 12 | `proxmox` | dev | spawn | `https://ai.nuclide.systems/mcp/proxmox/mcp` | ✓ |
| 13 | `shepard` | dev | static | `https://ai.nuclide.systems/mcp/shepard/mcp` | ✓ |
| 14 | `crawl4ai` | research | spawn | `https://ai.nuclide.systems/mcp/crawl4ai/mcp` | ✓ |
| 15 | `paper-search` | research | catalog | `https://ai.nuclide.systems/mcp/paper-search/mcp` | ✓ |
| 16 | `searxng` | research | spawn | `https://ai.nuclide.systems/mcp/searxng/mcp` | ✓ |
| 17 | `wikipedia-mcp` | research | catalog | `https://ai.nuclide.systems/mcp/wikipedia-mcp/mcp` | ✓ |
| 18 | `youtube-transcript` | research | catalog | `https://ai.nuclide.systems/mcp/youtube-transcript/mcp` | ✓ |
| 19 | `bluesky` | personal | static | `https://ai.nuclide.systems/mcp/bluesky/mcp` | ✓ |
| 20 | `obsidian` | personal | spawn | `https://ai.nuclide.systems/mcp/obsidian/mcp` | ✓ |
| 21 | `gotify` | personal | spawn | `https://ai.nuclide.systems/mcp/gotify/mcp` | ✓ |
| 22 | `home-assistant` | personal | static | `https://ai.nuclide.systems/mcp/home-assistant/mcp` | ✓ |
| 23 | `immich` | personal | spawn | `https://ai.nuclide.systems/mcp/immich/mcp` | ✓ |
| 24 | `memos` | personal | spawn | `https://ai.nuclide.systems/mcp/memos/mcp` | ✓ |
| 25 | `n8n` | personal | static | `https://ai.nuclide.systems/mcp/n8n/mcp` | ✓ |
| 26 | `nextcloud` | personal | spawn | `https://ai.nuclide.systems/mcp/nextcloud/mcp` | ✓ |
| 27 | `paperless` | personal | static | `https://ai.nuclide.systems/mcp/paperless/mcp` | ✓ |
| 28 | `unifi` | personal | spawn | `https://ai.nuclide.systems/mcp/unifi/mcp` | ✓ |
| 29 | `comfyui` | image | static | `https://ai.nuclide.systems/mcp/comfyui/mcp` | ✓ |
| 30 | `upload-artifact` | storage | static | `https://ai.nuclide.systems/mcp/upload-artifact/mcp` | ✓ |

**Auth**: all Bifrost MCP URLs require `Authorization: Bearer sk-bf-<key>`. MCP endpoint: `https://ai.nuclide.systems/mcp`.

---

## Group: `dev`

### `context7` — Library documentation

| | Value |
|---|---|
| **Kind** | catalog (`mcp/context7`) |
| **Internal upstream** | `http://mcp-context7:8000` |
| **Image** | `mcp-catalog-bridge` → Docker MCP Catalog `mcp/context7` |
| **Transport** | streamable-HTTP |
| **Resources** | 256 MiB mem limit |
| **Cache TTL** | 300 s |
| **Credentials** | none |
| **Notes** | Fetches live documentation for libraries/frameworks. No env vars. |

---

### `fetch` — HTTP fetch

| | Value |
|---|---|
| **Kind** | spawn |
| **Internal upstream** | `http://mcp-fetch:8000` |
| **Image** | `ghcr.io/astral-sh/uv:python3.12-trixie-slim` |
| **Command** | `uvx --with mcp-server-fetch mcp-proxy --stateless --host 0.0.0.0 --port 8000 -- python -m mcp_server_fetch` |
| **Transport** | streamable-HTTP |
| **Cache TTL** | 120 s |
| **Credentials** | none |

---

### `git` — Git operations

| | Value |
|---|---|
| **Kind** | catalog (`mcp/git`) |
| **Internal upstream** | `http://mcp-git:8000` |
| **Image** | `mcp-catalog-bridge` → Docker MCP Catalog `mcp/git` |
| **Transport** | streamable-HTTP |
| **Resources** | 256 MiB mem limit |
| **Credentials** | none |
| **Notes** | DinD child runs in `ai-internal` network. |

---

### `gitlab` — GitLab (DLR)

| | Value |
|---|---|
| **Kind** | catalog (`mcp/gitlab`) |
| **Internal upstream** | `http://mcp-gitlab:8000` |
| **Image** | `mcp-catalog-bridge` → Docker MCP Catalog `mcp/gitlab` |
| **Transport** | streamable-HTTP |
| **Resources** | 256 MiB mem limit |
| **Credentials** | |
| `GITLAB_PERSONAL_ACCESS_TOKEN` | `C8OXPT0J_oY-ha6KAzcn0286MQp1OjEyaAk.01.0z0jn01p4` |
| `GITLAB_API_URL` | `https://gitlab.dlr.de/api/v4` |
| **Notes** | Uses `--pass-environment` in bridge cmd so Docker CLI resolves `-e KEY` passthrough. Targets DLR GitLab, not gitlab.com. |

---

### `kroki` — Diagram rendering

| | Value |
|---|---|
| **Kind** | static |
| **Internal upstream** | `http://kroki-mcp:8000` (own stack, `:18007` on host) |
| **Transport** | streamable-HTTP |
| **Health check** | every 300 s |
| **Credentials** | none |
| **Notes** | Supports Mermaid, Excalidraw, and all Kroki-supported formats. |

---

### `markitdown` — Markdown conversion

| | Value |
|---|---|
| **Kind** | catalog (`mcp/markitdown`) |
| **Internal upstream** | `http://mcp-markitdown:8000` |
| **Image** | `mcp-catalog-bridge` → Docker MCP Catalog `mcp/markitdown` |
| **Transport** | streamable-HTTP |
| **Resources** | 256 MiB mem limit |
| **Credentials** | none |

---

### `sequential-thinking` — Chain-of-thought reasoning

| | Value |
|---|---|
| **Kind** | catalog (`mcp/sequentialthinking`) |
| **Internal upstream** | `http://mcp-sequential-thinking:8000` |
| **Image** | `mcp-catalog-bridge` → Docker MCP Catalog `mcp/sequentialthinking` |
| **Transport** | streamable-HTTP |
| **Resources** | 256 MiB mem limit |
| **Credentials** | none |

---

### `time` — Time & timezone

| | Value |
|---|---|
| **Kind** | spawn |
| **Internal upstream** | `http://mcp-time:8000` |
| **Image** | `ghcr.io/astral-sh/uv:python3.12-trixie-slim` |
| **Command** | `uvx --with mcp-server-time mcp-proxy --stateless --host 0.0.0.0 --port 8000 -- python -m mcp_server_time --local-timezone Europe/Berlin` |
| **Transport** | streamable-HTTP |
| **Credentials** | none |

---

### `docling` — PDF → Markdown (SAIA)

| | Value |
|---|---|
| **Kind** | static |
| **Internal upstream** | `http://docling-mcp:8000` (own stack, `:18005` on host) |
| **Transport** | streamable-HTTP |
| **Health check** | every 300 s |
| **Credentials** | none |
| **Notes** | SAIA-powered Docling; handles PDF, DOCX, images → Markdown. |

---

### `coder` — Coder workspace management

| | Value |
|---|---|
| **Kind** | static |
| **Internal upstream** | `http://coder-mcp:8000` (own stack on `ai-internal`) |
| **Transport** | streamable-HTTP |
| **Health check** | every 300 s |
| **Credentials** | Coder token baked into `coder-mcp` container env (see `/opt/stacks/ai/coder-mcp/`) |
| **Notes** | Replaced daytona 2026-05-20. Can create/start/stop Coder workspaces on CT 111. |

---

### `gitea` — Gitea (git.nuclide.systems)

| | Value |
|---|---|
| **Kind** | static |
| **Internal upstream** | `http://gitea-mcp:8000` (own stack `/opt/stacks/ai/gitea-mcp.yml`) |
| **Image** | `docker.gitea.com/gitea-mcp-server:latest` |
| **Command** | `/app/gitea-mcp -t http --port 8000 --host 0.0.0.0` |
| **Transport** | streamable-HTTP (native) |
| **Health check** | every 300 s |
| **Tools** | 53 (repo/issue/PR/file CRUD, releases, users, orgs) |
| **Credentials** | |
| `GITEA_HOST` | `https://git.nuclide.systems` |
| `GITEA_ACCESS_TOKEN` | `${GITEA_TOKEN}` → `.env` |
| **Notes** | Added 2026-05-23. Targets CT 111 Gitea. Read + write access. |

---

### `proxmox` — Proxmox VE (192.168.1.20)

| | Value |
|---|---|
| **Kind** | spawn |
| **Internal upstream** | `http://mcp-proxmox:8000` (own stack `/opt/stacks/ai/proxmox-mcp.yml`) |
| **Image** | `ghcr.io/astral-sh/uv:python3.12-trixie-slim` |
| **Command** | `uvx proxmox-mcp-plus` |
| **Package** | `proxmox-mcp-plus` (PyPI) |
| **Transport** | streamable-HTTP (`MCP_TRANSPORT=STREAMABLE_HTTP`) |
| **Resources** | 512 MiB mem limit |
| **Cache TTL** | 30 s |
| **Tools** | 39 (VMs, LXC, nodes, storage, tasks, firewall, HA — read-only) |
| **Credentials** | |
| `PROXMOX_HOST` | `192.168.1.20` |
| `PROXMOX_PORT` | `8006` |
| `PROXMOX_USER` | `root@pam` |
| `PROXMOX_TOKEN_NAME` | `mcp` |
| `PROXMOX_TOKEN_VALUE` | `${PROXMOX_TOKEN_SECRET}` → `.env` |
| `PROXMOX_VERIFY_SSL` | `false` |
| `PROXMOX_DEV_MODE` | `true` (required to allow self-signed cert with verify_ssl=false) |
| **Notes** | Added 2026-05-23. Token `root@pam!mcp` has `PVEAuditor` role at `/` (read-only, privsep). Self-signed TLS on PVE host requires `DEV_MODE=true`. |

---

### `shepard` — Shepard product platform

| | Value |
|---|---|
| **Kind** | static (exact upstream) |
| **Upstream** | `https://shepard.nuclide.systems/v2/mcp` |
| **Transport** | streamable-HTTP |
| **Health check** | disabled |
| **Auth header** | `Authorization: Bearer ${SHEPARD_API_KEY}` |
| `SHEPARD_API_KEY` | `eyJhbGciOiJSUzI1NiJ9.eyJzdWIiOiI3ZWVhZDk0Mi02M2E1LTRjZmMtYWVhOS1iMWQwZjBhMjkxZWEiLCJpc3MiOiJodHRwOi8vbG9jYWxob3N0OjgwODAvIiwibmJmIjoxNzc5MzcyODQyLCJpYXQiOjE3NzkzNzI4NDIsImp0aSI6ImY5YzAyYjc3LTNkZGYtNGZjZS1hYzJlLTBlYmM5N2FlYjJhZiJ9.Z9LY9vwLm2l0TmORQ2GriCnkLPzZnSC9q2sE62Ab8Gpi_374Gd5MffDkute0xF2ZwbhH3aRSCpEd93HmFDs-1F3IwoFQpBGiLedTL0N3gC_6J-PFv_i54FHFImEiH_h0yJilzrfgR4Prn_hFZMniE080Kf3Ll-uvYnNK-U-AkPjqb8KfP1BA6dt3HjiOjpicdSh2URpzAKxyVwddGeve3Ha9LboPu-dOb8nmiwiW6E75eakNGGR2mwPxITDxVaqxuSipBwBiDIHzfU4iT7T7b8aipvGd1upfGlx7RcbHdGg9gVNR4jH_--5qLb5124MQxZ486dlH6i7w6AMqtdkzGA` |
| **Notes** | Native MCP endpoint on CT 101 Shepard stack (Keycloak + backend). |

---

## Group: `research`

### `crawl4ai` — Web crawling / scraping

| | Value |
|---|---|
| **Kind** | spawn |
| **Internal upstream** | `http://mcp-crawl4ai:11235` |
| **Image** | `unclecode/crawl4ai:latest` |
| **Transport** | SSE (`/sse`) |
| **Resources** | 2 GiB mem limit; OOM score adj 300 |
| **Cache TTL** | 120 s |
| **Credentials** | none |

---

### `paper-search` — Academic paper search

| | Value |
|---|---|
| **Kind** | catalog (`mcp/paper-search`) |
| **Internal upstream** | `http://mcp-paper-search:8000` |
| **Image** | `mcp-catalog-bridge` → Docker MCP Catalog `mcp/paper-search` |
| **Transport** | streamable-HTTP |
| **Resources** | 256 MiB mem limit |
| **Cache TTL** | 300 s |
| **Credentials** | |
| `UNPAYWALL_EMAIL` | `fkrebs@nucli.de` |
| **Notes** | `--pass-environment` passthrough. Optional: `CORE_API_KEY`, `DOAJ_API_KEY` (not currently set). |

---

### `searxng` — Web search (self-hosted)

| | Value |
|---|---|
| **Kind** | spawn |
| **Internal upstream** | `http://mcp-searxng:8000` |
| **Image** | `isokoliuk/mcp-searxng:latest` |
| **Transport** | streamable-HTTP |
| **Credentials** | |
| `SEARXNG_URL` | `http://searxng:8080` (internal `shared_backend` network) |
| **Notes** | Routes to the self-hosted SearXNG instance. No external API keys needed. |

---

### `wikipedia-mcp` — Wikipedia search

| | Value |
|---|---|
| **Kind** | catalog (`mcp/wikipedia-mcp`) |
| **Internal upstream** | `http://mcp-wikipedia-mcp:8000` |
| **Image** | `mcp-catalog-bridge` → Docker MCP Catalog `mcp/wikipedia-mcp` |
| **Transport** | streamable-HTTP |
| **Resources** | 256 MiB mem limit |
| **Cache TTL** | 300 s |
| **Credentials** | none |

---

### `youtube-transcript` — YouTube transcripts

| | Value |
|---|---|
| **Kind** | catalog (`mcp/youtube-transcript`) |
| **Internal upstream** | `http://mcp-youtube-transcript:8000` |
| **Image** | `mcp-catalog-bridge` → Docker MCP Catalog `mcp/youtube-transcript` |
| **Transport** | streamable-HTTP |
| **Resources** | 256 MiB mem limit |
| **Cache TTL** | 300 s |
| **Credentials** | none |

---

## Group: `personal`

### `bluesky` — Bluesky / AT Protocol

| | Value |
|---|---|
| **Kind** | static |
| **Internal upstream** | `http://ariel-mcp:8000` (own container on `ai-internal`) |
| **Transport** | streamable-HTTP |
| **Health check** | every 300 s |
| **Credentials** (baked into `ariel-mcp` env) | |
| `ATPROTO_IDENTIFIER` | `nucli.de` |
| `ATPROTO_PASSWORD` | `blxw-datl-l7zo-qwwq` |
| `BLUESKY_IDENTIFIER` | `nucli.de` |
| `BLUESKY_APP_PASSWORD` | `4mrm-go4j-avzg-2yo7` |
| **Notes** | Uses Brian Ellin's `ariel-mcp` image. Rate-limit handling pending. |

---

### `obsidian` — Obsidian vault (Nextcloud-backed)

| | Value |
|---|---|
| **Kind** | spawn |
| **Image** | `mcp-obsidian-bridge` + mcpvault |
| **Internal upstream** | `http://mcp-obsidian:8000` |
| **Transport** | streamable-HTTP |
| **Cache TTL** | 30 s |
| **Vault path (container)** | `/vault` |
| **Vault path (CT 104 host)** | `/mnt/pve/unas/services/nextcloud/fkrebs@nucli.de/files/Notizen` |
| **Vault path (CT 105 Nextcloud)** | same — both CTs bind-mount UNAS via `/mnt/pve/unas` |
| **Vault path (UNAS NFS)** | `192.168.1.31:/var/nfs/shared/storage/services/nextcloud/fkrebs@nucli.de/files/Notizen` |
| **Nextcloud-visible path** | `fkrebs@nucli.de` user → `Notizen/` folder (sync target for Obsidian desktop/mobile) |
| **Credentials** | filesystem access only; no Nextcloud API needed |
| **Notes** | Vault is the canonical Obsidian store, written by Nextcloud sync from desktop/mobile clients and read/written by the MCP server. Backed up via Backrest media/services plans (UNAS coverage). |

---

### `gotify` — Push notifications

| | Value |
|---|---|
| **Kind** | spawn |
| **Internal upstream** | `http://mcp-gotify:8000` |
| **Image** | `kcofoni/gotify-mcp` |
| **Transport** | HTTP (`GOTIFY_MCP_TRANSPORT=http`) |
| **Cache TTL** | 0 (real-time) |
| **Credentials** | |
| `GOTIFY_URL` | `http://192.168.1.40:10003` |
| `GOTIFY_CLIENT_TOKEN` | `CwaslnnN-MTNRoC` |
| `GOTIFY_APP_TOKEN` | `AO84CFvU4XmoPBJ` |
| **Notes** | Can send and receive push notifications. App token = send; client token = receive. |

---

### `home-assistant` — Home Assistant

| | Value |
|---|---|
| **Kind** | static (exact upstream) |
| **Upstream** | `http://192.168.1.60:9583/private_ehnWeRl2G3De6NnbcN7teQ` |
| **Transport** | streamable-HTTP |
| **Health check** | disabled |
| **Cache TTL** | 15 s |
| **Credentials** | Token embedded in path (`/private_ehnWeRl2G3De6NnbcN7teQ`) — HA MCP add-on authentication |
| **Notes** | Direct to HA add-on on VM 100. ~2492 entities. `exact_upstream: true` so the path is forwarded verbatim. |

---

### `immich` — Immich photo library

| | Value |
|---|---|
| **Kind** | spawn |
| **Internal upstream** | `http://mcp-immich:8000` |
| **Image** | `ghcr.io/astral-sh/uv:python3.12-trixie-slim` |
| **Command** | `uvx --with immich-mcp` → uvicorn streamable-HTTP app |
| **Transport** | streamable-HTTP |
| **Credentials** | |
| `IMMICH_BASE_URL` | `http://192.168.1.40:12000` |
| `IMMICH_API_KEY` | `jhtAOjyCU1cXxBoj6gZGLfCjpv8TmcwaXqiex6f5po` |
| **Notes** | DNS rebinding protection disabled (TransportSecuritySettings). |

---

### `memos` — Memos notes

| | Value |
|---|---|
| **Kind** | spawn |
| **Internal upstream** | `http://mcp-memos:8000` |
| **Image** | `ghcr.io/astral-sh/uv:python3.12-trixie-slim` |
| **Command** | `uvx --with mcp-server-memos mcp-proxy --stateless ... -- mcp-server-memos --host 192.168.1.40 --port 17000 --token "$MEMOS_TOKEN"` |
| **Transport** | streamable-HTTP |
| **Cache TTL** | 0 (real-time) |
| **Credentials** | |
| `MEMOS_TOKEN` | `memos_pat_sOnvLytuaaVdEiqUSWubgfLut6AnoWb0` |
| **Health probe** | `search_memo` with keyword `__healthcheck__` |

---

### `n8n` — n8n workflow automation

| | Value |
|---|---|
| **Kind** | static (exact upstream) |
| **Upstream** | `https://n8n.nuclide.systems/mcp-server/http` |
| **Transport** | streamable-HTTP |
| **Health check** | disabled |
| **TLS** | `insecure_tls: true` (self-signed cert workaround) |
| **Auth header** | `Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiI4YWY1YzgxMy1mODljLTRiODMtYmNmOC01ZDU5ODY0YTAzOGEiLCJpc3MiOiJuOG4iLCJhdWQiOiJtY3Atc2VydmVyLWFwaSIsImp0aSI6IjBmNjA1NDBmLTBmZmQtNGEwNS1iNjZlLTA2ZjU2YzZlNjY2MCIsImlhdCI6MTc3OTQ1NjAzN30.hf_Vg45R_hOJSY11H4GVAuvqWv39SitvtIXBXnorlXQ` |
| **Notes** | n8n MCP server; exposes configured workflows as tools. JWT `iat: 1779456037`. |

---

### `nextcloud` — Nextcloud files & calendar

| | Value |
|---|---|
| **Kind** | spawn |
| **Internal upstream** | `http://mcp-nextcloud:8000` |
| **Image** | `ghcr.io/cbcoutinho/nextcloud-mcp-server:latest` |
| **Transport** | streamable-HTTP |
| **Mode** | `MCP_DEPLOYMENT_MODE=single_user_basic` |
| **Health check** | disabled |
| **Credentials** | |
| `NEXTCLOUD_HOST` | `https://nc.nuclide.systems` |
| `NEXTCLOUD_USERNAME` | `fkrebs@nucli.de` |
| `NEXTCLOUD_PASSWORD` | `iRn4ECFf2dS24B9sFP3fkPosjrPVKZdaJBuwRpP9sVBnL6A7qN6lXNk2iK4yYblksc2ewzkb` |
| `NEXTCLOUD_VERIFY_SSL` | `false` |
| **Notes** | App-password generated via `occ` for `fkrebs@nucli.de` 2026-05-22. Re-enabled after fix. |

---

### `paperless` — Paperless-NGX

| | Value |
|---|---|
| **Kind** | static |
| **Internal upstream** | `http://paperless-mcp:8000` (own stack `/opt/stacks/ai/paperless-mcp.yml`) |
| **Image** | custom build `./mcp-servers/paperless/Dockerfile` |
| **Base** | `ghcr.io/astral-sh/uv:bookworm-slim` + Node 20 + `@nloui/paperless-mcp` |
| **Transport** | streamable-HTTP (via mcp-proxy wrapper — package is stdio-only) |
| **Health check** | every 300 s |
| **Tools** | 12 (document search, retrieve, tags, correspondents, document types) |
| **Credentials** | |
| `PAPERLESS_URL` | `http://paperless-ngx-webserver-1:8000` (`shared_backend` network) |
| `PAPERLESS_API_TOKEN` | `${PAPERLESS_API_TOKEN}` → `.env` |
| **Notes** | Added 2026-05-23. npm package moved from `paperless-mcp` to `@nloui/paperless-mcp`. paperless-ngx webserver has a chown permissions error causing restarts — MCP server starts but tool calls will fail until paperless-ngx is fixed (see separate issue). |

---

### `unifi` — UniFi Network

| | Value |
|---|---|
| **Kind** | spawn |
| **Internal upstream** | `http://mcp-unifi:8000` |
| **Image** | `ghcr.io/enuno/unifi-mcp-server:latest` |
| **Transport** | HTTP (`MCP_SERVER_TRANSPORT=http`) |
| **Cache TTL** | 15 s |
| **Credentials** | |
| `UNIFI_API_KEY` | `yeBrsK8l6h5LSBc8ocsdLeSkGnc9bsKY` |
| `UNIFI_API_TYPE` | `local` |
| `UNIFI_LOCAL_HOST` | `192.168.1.1` |
| `UNIFI_LOCAL_PORT` | `443` |
| `UNIFI_LOCAL_VERIFY_SSL` | `false` |
| **Notes** | 197 tools. Network App API key (local API). Site Manager/cloud tools need `UNIFI_SITE_MANAGER_ENABLED`. |

---

## Group: `image`

### `comfyui` — ComfyUI image generation

| | Value |
|---|---|
| **Kind** | static |
| **Internal upstream** | `http://comfyui-mcp:8000` (own stack, `:18003` on host) |
| **Transport** | streamable-HTTP |
| **Health check** | every 300 s |
| **Credentials** | none (auth via gateway Bearer) |
| **Notes** | Intel Arc iGPU; FLUX.1-schnell GGUF. LobeChat can also connect directly to `http://comfyui-mcp:8000/mcp` on `ai-internal`. See [`comfyui.md`](comfyui.md). |

---

## Group: `storage`

### `upload-artifact` — S3 artifact upload

| | Value |
|---|---|
| **Kind** | static |
| **Internal upstream** | `http://upload-artifact-mcp:8000` (own stack, `:18011` on host) |
| **Transport** | streamable-HTTP |
| **Health check** | every 300 s |
| **Credentials** | Garage S3 credentials baked into `upload-artifact-mcp` container env |
| **Notes** | Uploads chat artifacts (images, files) to Garage S3 at `s3.nuclide.systems`. |

---

## Client configuration

### Auto (recommended)

> **Note**: URLs below use the new Bifrost endpoint. Old `mcp.nuclide.systems` routes are decommissioned.

```
GET https://ai.nuclide.systems/mcp-config?format=claude   # Claude Code / Claude Desktop
GET https://ai.nuclide.systems/mcp-config?format=cursor   # Cursor
GET https://ai.nuclide.systems/mcp-config?format=raw      # raw token + URLs
```

Auth: `Authorization: Bearer sk-bf-<key>`. Merge `mcpServers` block into `~/.claude/settings.json`.

### Manual (Claude Code)

```json
{
  "mcpServers": {
    "<name>": {
      "type": "http",
      "url": "https://ai.nuclide.systems/mcp/<name>/mcp",
      "headers": {
        "Authorization": "Bearer sk-bf-<key>"
      }
    }
  }
}
```

---

## Gateway management API

Bifrost management API (auth: `sk-bf-<key>`).

```bash
BASE=https://ai.nuclide.systems
# List all servers + status
curl -H "Authorization: Bearer sk-bf-..." $BASE/api/servers

# Health check
curl $BASE/health
```

---

## Other credentials in gateway `.env`

These are available to spawned containers via `${VAR}` substitution in `config.json`:

| Variable | Value | Used by |
|---|---|---|
| `GATEWAY_API_KEYS` | `JxxCqKw32XoN4LOHunDikS6u1RpS7R5ythzaqADPuIA` | All API/proxy calls to gateway |
| `LITELLM_MASTER_KEY` | `sk-tapirnase` | LiteLLM proxy (shared pw — rotate pending) |
| `LITELLM_API_KEY` | `sk-tapirnase` | same |
| `GITEA_TOKEN` | `c15e3348bf725054131633061002d677685cd4f4` | Gitea API access |
| `NEXTCLOUD_MCP_OAUTH_CLIENT_ID` | `82ca2d53-6df4-4671-875c-fee85b54b76f` | Pocket-ID client for MCP spawned servers |
| `NEXTCLOUD_MCP_OAUTH_CLIENT_SECRET` | `zOfHItEeKVa6Tf40RpnhihFmgnCDkkfz` | same |
| `SHEPARD_BASE_URL` | `https://shepard-api.nuclide.systems/shepard/api` | Shepard API |
| `GOTIFY_TOKEN_ALERTS` | `AtjFdduWArgAe7q` | Gotify — alert app token (gateway internal) |
| `GOTIFY_TOKEN_AGENTS` | `AB3dzfj5TUPCfYf` | Gotify — agent app token (gateway internal) |