Files
docs/services/mcp-servers.md
T
fkrebs 14137c32a7 docs(mcp): add gitea, paperless, proxmox MCP servers (2026-05-23)
Wire three new community MCP servers into the gateway on CT104:
- gitea: official Gitea MCP (53 tools), static upstream gitea-mcp:8000
- paperless: @nloui/paperless-mcp via mcp-proxy (12 tools), static upstream
- proxmox: proxmox-mcp-plus PyPI (39 tools), read-only PVEAuditor token

Total: 27 → 30 servers. Skipped: karakeep (API key unset), audiobookshelf
(Go binary only), vaultwarden (master password exposure risk).

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-05-23 15:02:26 +02:00

22 KiB

MCP Servers — nuclide.systems

Complete reference for all 30 MCP servers managed by the gateway at https://mcp.nuclide.systems. Last verified: 2026-05-23.

Architecture doc: mcp-gateway.md · Config file: /opt/stacks/ai/mcp-gateway/config.json on CT 104 · Secrets: /opt/stacks/ai/.env


Overview

# Server Group Kind Gateway URL Status
1 context7 dev catalog https://mcp.nuclide.systems/context7/mcp
2 fetch dev spawn https://mcp.nuclide.systems/fetch/mcp
3 git dev catalog https://mcp.nuclide.systems/git/mcp
4 gitlab dev catalog https://mcp.nuclide.systems/gitlab/mcp
5 kroki dev static https://mcp.nuclide.systems/kroki/mcp
6 markitdown dev catalog https://mcp.nuclide.systems/markitdown/mcp
7 sequential-thinking dev catalog https://mcp.nuclide.systems/sequential-thinking/mcp
8 time dev spawn https://mcp.nuclide.systems/time/mcp
9 docling dev static https://mcp.nuclide.systems/docling/mcp
10 coder dev static https://mcp.nuclide.systems/coder/mcp
11 gitea dev static https://mcp.nuclide.systems/gitea/mcp
12 proxmox dev spawn https://mcp.nuclide.systems/proxmox/mcp
13 shepard dev static https://mcp.nuclide.systems/shepard/mcp
14 crawl4ai research spawn https://mcp.nuclide.systems/crawl4ai/mcp
15 paper-search research catalog https://mcp.nuclide.systems/paper-search/mcp
16 searxng research spawn https://mcp.nuclide.systems/searxng/mcp
17 wikipedia-mcp research catalog https://mcp.nuclide.systems/wikipedia-mcp/mcp
18 youtube-transcript research catalog https://mcp.nuclide.systems/youtube-transcript/mcp
19 bluesky personal static https://mcp.nuclide.systems/bluesky/mcp
20 obsidian personal spawn https://mcp.nuclide.systems/obsidian/mcp
21 gotify personal spawn https://mcp.nuclide.systems/gotify/mcp
22 home-assistant personal static https://mcp.nuclide.systems/home-assistant/mcp
23 immich personal spawn https://mcp.nuclide.systems/immich/mcp
24 memos personal spawn https://mcp.nuclide.systems/memos/mcp
25 n8n personal static https://mcp.nuclide.systems/n8n/mcp
26 nextcloud personal spawn https://mcp.nuclide.systems/nextcloud/mcp
27 paperless personal static https://mcp.nuclide.systems/paperless/mcp
28 unifi personal spawn https://mcp.nuclide.systems/unifi/mcp
29 comfyui image static https://mcp.nuclide.systems/comfyui/mcp
30 upload-artifact storage static https://mcp.nuclide.systems/upload-artifact/mcp

Auth: all gateway URLs require Authorization: Bearer <gateway-token>. Get a config bundle at https://mcp.nuclide.systems/mcp-config?format=claude.

Gateway API key (for /api/* management calls): JxxCqKw32XoN4LOHunDikS6u1RpS7R5ythzaqADPuIA


Group: dev

context7 — Library documentation

Value
Kind catalog (mcp/context7)
Internal upstream http://mcp-context7:8000
Image mcp-catalog-bridge → Docker MCP Catalog mcp/context7
Transport streamable-HTTP
Resources 256 MiB mem limit
Cache TTL 300 s
Credentials none
Notes Fetches live documentation for libraries/frameworks. No env vars.

fetch — HTTP fetch

Value
Kind spawn
Internal upstream http://mcp-fetch:8000
Image ghcr.io/astral-sh/uv:python3.12-trixie-slim
Command uvx --with mcp-server-fetch mcp-proxy --stateless --host 0.0.0.0 --port 8000 -- python -m mcp_server_fetch
Transport streamable-HTTP
Cache TTL 120 s
Credentials none

git — Git operations

Value
Kind catalog (mcp/git)
Internal upstream http://mcp-git:8000
Image mcp-catalog-bridge → Docker MCP Catalog mcp/git
Transport streamable-HTTP
Resources 256 MiB mem limit
Credentials none
Notes DinD child runs in ai-internal network.

gitlab — GitLab (DLR)

Value
Kind catalog (mcp/gitlab)
Internal upstream http://mcp-gitlab:8000
Image mcp-catalog-bridge → Docker MCP Catalog mcp/gitlab
Transport streamable-HTTP
Resources 256 MiB mem limit
Credentials
GITLAB_PERSONAL_ACCESS_TOKEN C8OXPT0J_oY-ha6KAzcn0286MQp1OjEyaAk.01.0z0jn01p4
GITLAB_API_URL https://gitlab.dlr.de/api/v4
Notes Uses --pass-environment in bridge cmd so Docker CLI resolves -e KEY passthrough. Targets DLR GitLab, not gitlab.com.

kroki — Diagram rendering

Value
Kind static
Internal upstream http://kroki-mcp:8000 (own stack, :18007 on host)
Transport streamable-HTTP
Health check every 300 s
Credentials none
Notes Supports Mermaid, Excalidraw, and all Kroki-supported formats.

markitdown — Markdown conversion

Value
Kind catalog (mcp/markitdown)
Internal upstream http://mcp-markitdown:8000
Image mcp-catalog-bridge → Docker MCP Catalog mcp/markitdown
Transport streamable-HTTP
Resources 256 MiB mem limit
Credentials none

sequential-thinking — Chain-of-thought reasoning

Value
Kind catalog (mcp/sequentialthinking)
Internal upstream http://mcp-sequential-thinking:8000
Image mcp-catalog-bridge → Docker MCP Catalog mcp/sequentialthinking
Transport streamable-HTTP
Resources 256 MiB mem limit
Credentials none

time — Time & timezone

Value
Kind spawn
Internal upstream http://mcp-time:8000
Image ghcr.io/astral-sh/uv:python3.12-trixie-slim
Command uvx --with mcp-server-time mcp-proxy --stateless --host 0.0.0.0 --port 8000 -- python -m mcp_server_time --local-timezone Europe/Berlin
Transport streamable-HTTP
Credentials none

docling — PDF → Markdown (SAIA)

Value
Kind static
Internal upstream http://docling-mcp:8000 (own stack, :18005 on host)
Transport streamable-HTTP
Health check every 300 s
Credentials none
Notes SAIA-powered Docling; handles PDF, DOCX, images → Markdown.

coder — Coder workspace management

Value
Kind static
Internal upstream http://coder-mcp:8000 (own stack on ai-internal)
Transport streamable-HTTP
Health check every 300 s
Credentials Coder token baked into coder-mcp container env (see /opt/stacks/ai/coder-mcp/)
Notes Replaced daytona 2026-05-20. Can create/start/stop Coder workspaces on CT 111.

gitea — Gitea (git.nuclide.systems)

Value
Kind static
Internal upstream http://gitea-mcp:8000 (own stack /opt/stacks/ai/gitea-mcp.yml)
Image docker.gitea.com/gitea-mcp-server:latest
Command /app/gitea-mcp -t http --port 8000 --host 0.0.0.0
Transport streamable-HTTP (native)
Health check every 300 s
Tools 53 (repo/issue/PR/file CRUD, releases, users, orgs)
Credentials
GITEA_HOST https://git.nuclide.systems
GITEA_ACCESS_TOKEN ${GITEA_TOKEN}.env
Notes Added 2026-05-23. Targets CT 111 Gitea. Read + write access.

proxmox — Proxmox VE (192.168.1.20)

Value
Kind spawn
Internal upstream http://mcp-proxmox:8000 (own stack /opt/stacks/ai/proxmox-mcp.yml)
Image ghcr.io/astral-sh/uv:python3.12-trixie-slim
Command uvx proxmox-mcp-plus
Package proxmox-mcp-plus (PyPI)
Transport streamable-HTTP (MCP_TRANSPORT=STREAMABLE_HTTP)
Resources 512 MiB mem limit
Cache TTL 30 s
Tools 39 (VMs, LXC, nodes, storage, tasks, firewall, HA — read-only)
Credentials
PROXMOX_HOST 192.168.1.20
PROXMOX_PORT 8006
PROXMOX_USER root@pam
PROXMOX_TOKEN_NAME mcp
PROXMOX_TOKEN_VALUE ${PROXMOX_TOKEN_SECRET}.env
PROXMOX_VERIFY_SSL false
PROXMOX_DEV_MODE true (required to allow self-signed cert with verify_ssl=false)
Notes Added 2026-05-23. Token root@pam!mcp has PVEAuditor role at / (read-only, privsep). Self-signed TLS on PVE host requires DEV_MODE=true.

shepard — Shepard product platform

Value
Kind static (exact upstream)
Upstream https://shepard.nuclide.systems/v2/mcp
Transport streamable-HTTP
Health check disabled
Auth header Authorization: Bearer ${SHEPARD_API_KEY}
SHEPARD_API_KEY eyJhbGciOiJSUzI1NiJ9.eyJzdWIiOiI3ZWVhZDk0Mi02M2E1LTRjZmMtYWVhOS1iMWQwZjBhMjkxZWEiLCJpc3MiOiJodHRwOi8vbG9jYWxob3N0OjgwODAvIiwibmJmIjoxNzc5MzcyODQyLCJpYXQiOjE3NzkzNzI4NDIsImp0aSI6ImY5YzAyYjc3LTNkZGYtNGZjZS1hYzJlLTBlYmM5N2FlYjJhZiJ9.Z9LY9vwLm2l0TmORQ2GriCnkLPzZnSC9q2sE62Ab8Gpi_374Gd5MffDkute0xF2ZwbhH3aRSCpEd93HmFDs-1F3IwoFQpBGiLedTL0N3gC_6J-PFv_i54FHFImEiH_h0yJilzrfgR4Prn_hFZMniE080Kf3Ll-uvYnNK-U-AkPjqb8KfP1BA6dt3HjiOjpicdSh2URpzAKxyVwddGeve3Ha9LboPu-dOb8nmiwiW6E75eakNGGR2mwPxITDxVaqxuSipBwBiDIHzfU4iT7T7b8aipvGd1upfGlx7RcbHdGg9gVNR4jH_--5qLb5124MQxZ486dlH6i7w6AMqtdkzGA
Notes Native MCP endpoint on CT 101 Shepard stack (Keycloak + backend).

Group: research

crawl4ai — Web crawling / scraping

Value
Kind spawn
Internal upstream http://mcp-crawl4ai:11235
Image unclecode/crawl4ai:latest
Transport SSE (/sse)
Resources 2 GiB mem limit; OOM score adj 300
Cache TTL 120 s
Credentials none

Value
Kind catalog (mcp/paper-search)
Internal upstream http://mcp-paper-search:8000
Image mcp-catalog-bridge → Docker MCP Catalog mcp/paper-search
Transport streamable-HTTP
Resources 256 MiB mem limit
Cache TTL 300 s
Credentials
UNPAYWALL_EMAIL fkrebs@nucli.de
Notes --pass-environment passthrough. Optional: CORE_API_KEY, DOAJ_API_KEY (not currently set).

searxng — Web search (self-hosted)

Value
Kind spawn
Internal upstream http://mcp-searxng:8000
Image isokoliuk/mcp-searxng:latest
Transport streamable-HTTP
Credentials
SEARXNG_URL http://searxng:8080 (internal shared_backend network)
Notes Routes to the self-hosted SearXNG instance. No external API keys needed.

Value
Kind catalog (mcp/wikipedia-mcp)
Internal upstream http://mcp-wikipedia-mcp:8000
Image mcp-catalog-bridge → Docker MCP Catalog mcp/wikipedia-mcp
Transport streamable-HTTP
Resources 256 MiB mem limit
Cache TTL 300 s
Credentials none

youtube-transcript — YouTube transcripts

Value
Kind catalog (mcp/youtube-transcript)
Internal upstream http://mcp-youtube-transcript:8000
Image mcp-catalog-bridge → Docker MCP Catalog mcp/youtube-transcript
Transport streamable-HTTP
Resources 256 MiB mem limit
Cache TTL 300 s
Credentials none

Group: personal

bluesky — Bluesky / AT Protocol

Value
Kind static
Internal upstream http://ariel-mcp:8000 (own container on ai-internal)
Transport streamable-HTTP
Health check every 300 s
Credentials (baked into ariel-mcp env)
ATPROTO_IDENTIFIER nucli.de
ATPROTO_PASSWORD blxw-datl-l7zo-qwwq
BLUESKY_IDENTIFIER nucli.de
BLUESKY_APP_PASSWORD 4mrm-go4j-avzg-2yo7
Notes Uses Brian Ellin's ariel-mcp image. Rate-limit handling pending.

obsidian — Obsidian vault (Nextcloud-backed)

Value
Kind spawn
Image mcp-obsidian-bridge + mcpvault
Internal upstream http://mcp-obsidian:8000
Transport streamable-HTTP
Cache TTL 30 s
Vault path Nextcloud fkrebs@nucli.de/files/Notizen (UNAS mount)
Credentials inherits Nextcloud credentials from gateway env
Notes Vault read/write against the Nextcloud-mounted Obsidian vault.

gotify — Push notifications

Value
Kind spawn
Internal upstream http://mcp-gotify:8000
Image kcofoni/gotify-mcp
Transport HTTP (GOTIFY_MCP_TRANSPORT=http)
Cache TTL 0 (real-time)
Credentials
GOTIFY_URL http://192.168.1.40:10003
GOTIFY_CLIENT_TOKEN CwaslnnN-MTNRoC
GOTIFY_APP_TOKEN AO84CFvU4XmoPBJ
Notes Can send and receive push notifications. App token = send; client token = receive.

home-assistant — Home Assistant

Value
Kind static (exact upstream)
Upstream http://192.168.1.60:9583/private_ehnWeRl2G3De6NnbcN7teQ
Transport streamable-HTTP
Health check disabled
Cache TTL 15 s
Credentials Token embedded in path (/private_ehnWeRl2G3De6NnbcN7teQ) — HA MCP add-on authentication
Notes Direct to HA add-on on VM 100. ~2492 entities. exact_upstream: true so the path is forwarded verbatim.

immich — Immich photo library

Value
Kind spawn
Internal upstream http://mcp-immich:8000
Image ghcr.io/astral-sh/uv:python3.12-trixie-slim
Command uvx --with immich-mcp → uvicorn streamable-HTTP app
Transport streamable-HTTP
Credentials
IMMICH_BASE_URL http://192.168.1.40:12000
IMMICH_API_KEY jhtAOjyCU1cXxBoj6gZGLfCjpv8TmcwaXqiex6f5po
Notes DNS rebinding protection disabled (TransportSecuritySettings).

memos — Memos notes

Value
Kind spawn
Internal upstream http://mcp-memos:8000
Image ghcr.io/astral-sh/uv:python3.12-trixie-slim
Command uvx --with mcp-server-memos mcp-proxy --stateless ... -- mcp-server-memos --host 192.168.1.40 --port 17000 --token "$MEMOS_TOKEN"
Transport streamable-HTTP
Cache TTL 0 (real-time)
Credentials
MEMOS_TOKEN memos_pat_sOnvLytuaaVdEiqUSWubgfLut6AnoWb0
Health probe search_memo with keyword __healthcheck__

n8n — n8n workflow automation

Value
Kind static (exact upstream)
Upstream https://n8n.nuclide.systems/mcp-server/http
Transport streamable-HTTP
Health check disabled
TLS insecure_tls: true (self-signed cert workaround)
Auth header Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiI4YWY1YzgxMy1mODljLTRiODMtYmNmOC01ZDU5ODY0YTAzOGEiLCJpc3MiOiJuOG4iLCJhdWQiOiJtY3Atc2VydmVyLWFwaSIsImp0aSI6IjBmNjA1NDBmLTBmZmQtNGEwNS1iNjZlLTA2ZjU2YzZlNjY2MCIsImlhdCI6MTc3OTQ1NjAzN30.hf_Vg45R_hOJSY11H4GVAuvqWv39SitvtIXBXnorlXQ
Notes n8n MCP server; exposes configured workflows as tools. JWT iat: 1779456037.

nextcloud — Nextcloud files & calendar

Value
Kind spawn
Internal upstream http://mcp-nextcloud:8000
Image ghcr.io/cbcoutinho/nextcloud-mcp-server:latest
Transport streamable-HTTP
Mode MCP_DEPLOYMENT_MODE=single_user_basic
Health check disabled
Credentials
NEXTCLOUD_HOST https://nc.nuclide.systems
NEXTCLOUD_USERNAME fkrebs@nucli.de
NEXTCLOUD_PASSWORD iRn4ECFf2dS24B9sFP3fkPosjrPVKZdaJBuwRpP9sVBnL6A7qN6lXNk2iK4yYblksc2ewzkb
NEXTCLOUD_VERIFY_SSL false
Notes App-password generated via occ for fkrebs@nucli.de 2026-05-22. Re-enabled after fix.

paperless — Paperless-NGX

Value
Kind static
Internal upstream http://paperless-mcp:8000 (own stack /opt/stacks/ai/paperless-mcp.yml)
Image custom build ./mcp-servers/paperless/Dockerfile
Base ghcr.io/astral-sh/uv:bookworm-slim + Node 20 + @nloui/paperless-mcp
Transport streamable-HTTP (via mcp-proxy wrapper — package is stdio-only)
Health check every 300 s
Tools 12 (document search, retrieve, tags, correspondents, document types)
Credentials
PAPERLESS_URL http://paperless-ngx-webserver-1:8000 (shared_backend network)
PAPERLESS_API_TOKEN ${PAPERLESS_API_TOKEN}.env
Notes Added 2026-05-23. npm package moved from paperless-mcp to @nloui/paperless-mcp. paperless-ngx webserver has a chown permissions error causing restarts — MCP server starts but tool calls will fail until paperless-ngx is fixed (see separate issue).

unifi — UniFi Network

Value
Kind spawn
Internal upstream http://mcp-unifi:8000
Image ghcr.io/enuno/unifi-mcp-server:latest
Transport HTTP (MCP_SERVER_TRANSPORT=http)
Cache TTL 15 s
Credentials
UNIFI_API_KEY yeBrsK8l6h5LSBc8ocsdLeSkGnc9bsKY
UNIFI_API_TYPE local
UNIFI_LOCAL_HOST 192.168.1.1
UNIFI_LOCAL_PORT 443
UNIFI_LOCAL_VERIFY_SSL false
Notes 197 tools. Network App API key (local API). Site Manager/cloud tools need UNIFI_SITE_MANAGER_ENABLED.

Group: image

comfyui — ComfyUI image generation

Value
Kind static
Internal upstream http://comfyui-mcp:8000 (own stack, :18003 on host)
Transport streamable-HTTP
Health check every 300 s
Credentials none (auth via gateway Bearer)
Notes Intel Arc iGPU; FLUX.1-schnell GGUF. LobeChat can also connect directly to http://comfyui-mcp:8000/mcp on ai-internal. See comfyui.md.

Group: storage

upload-artifact — S3 artifact upload

Value
Kind static
Internal upstream http://upload-artifact-mcp:8000 (own stack, :18011 on host)
Transport streamable-HTTP
Health check every 300 s
Credentials Garage S3 credentials baked into upload-artifact-mcp container env
Notes Uploads chat artifacts (images, files) to Garage S3 at s3.nuclide.systems.

Client configuration

GET https://mcp.nuclide.systems/mcp-config?format=claude   # Claude Code / Claude Desktop
GET https://mcp.nuclide.systems/mcp-config?format=cursor   # Cursor
GET https://mcp.nuclide.systems/mcp-config?format=raw      # raw token + URLs

Requires Pocket-ID session. Downloads a pre-built config with fresh long-lived token. Merge mcpServers block into ~/.claude/settings.json.

Manual (Claude Code)

{
  "mcpServers": {
    "<name>": {
      "type": "http",
      "url": "https://mcp.nuclide.systems/<name>/mcp",
      "headers": {
        "Authorization": "Bearer JxxCqKw32XoN4LOHunDikS6u1RpS7R5ythzaqADPuIA"
      }
    }
  }
}

Gateway management API

All calls require Authorization: Bearer JxxCqKw32XoN4LOHunDikS6u1RpS7R5ythzaqADPuIA.

BASE=https://mcp.nuclide.systems
TOKEN=JxxCqKw32XoN4LOHunDikS6u1RpS7R5ythzaqADPuIA
H="Authorization: Bearer $TOKEN"

# List all servers + status
curl -H "$H" $BASE/api/servers

# Start / stop a server
curl -X POST -H "$H" $BASE/api/servers/memos/start
curl -X POST -H "$H" $BASE/api/servers/memos/stop

# Create new server (persists to config.json)
curl -X POST -H "$H" -H "Content-Type: application/json" \
  -d '{"name":"myserver","static":true,"upstream":"http://host:port","group":"custom"}' \
  $BASE/api/servers

# Delete server (stops container + removes from config.json)
curl -X DELETE -H "$H" $BASE/api/servers/myserver

# Patch server config
curl -X PATCH -H "$H" -H "Content-Type: application/json" \
  -d '{"enabled":false}' \
  $BASE/api/servers/myserver

# Health check
curl $BASE/health

Other credentials in gateway .env

These are available to spawned containers via ${VAR} substitution in config.json:

Variable Value Used by
GATEWAY_API_KEYS JxxCqKw32XoN4LOHunDikS6u1RpS7R5ythzaqADPuIA All API/proxy calls to gateway
LITELLM_MASTER_KEY sk-tapirnase LiteLLM proxy (shared pw — rotate pending)
LITELLM_API_KEY sk-tapirnase same
GITEA_TOKEN c15e3348bf725054131633061002d677685cd4f4 Gitea API access
NEXTCLOUD_MCP_OAUTH_CLIENT_ID 82ca2d53-6df4-4671-875c-fee85b54b76f Pocket-ID client for MCP spawned servers
NEXTCLOUD_MCP_OAUTH_CLIENT_SECRET zOfHItEeKVa6Tf40RpnhihFmgnCDkkfz same
SHEPARD_BASE_URL https://shepard-api.nuclide.systems/shepard/api Shepard API
GOTIFY_TOKEN_ALERTS AtjFdduWArgAe7q Gotify — alert app token (gateway internal)
GOTIFY_TOKEN_AGENTS AB3dzfj5TUPCfYf Gotify — agent app token (gateway internal)