io.github.ONLYOFFICE/docspace

io.github.ONLYOFFICE/docspace·v3.2.0·Documents & Spreadsheets

A room-based collaborative platform

Trust verdict · v1 advisory · method

NOT YET SCREENEDno verdict on file

Verdict not yet evaluated for this tool. The semantic screen takes adversarial cases first; coverage rolls out as the corpus expands (15/150 labels to graduation). The deterministic conformance probe is built but has not yet run on the public corpus, so a recorded verdict here is REVIEW or UNVERIFIED, never a clearing ALLOW. Until a verdict is recorded, an agent should treat this tool as not-yet-cleared and fall back to its own checks. Method: the eval, four-state verdict, honest limits.

Own this server? Screen its description →

Environment variables

DOCSPACE_BASE_URL

The base URL of the DocSpace instance for API requests.

DOCSPACE_API_KEY

secret

The API key for accessing the API.

DOCSPACE_TRANSPORT

The transport protocol to use for communication with the MCP server.

DOCSPACE_DYNAMIC

The flag that indicates whether the MCP server should use meta tools.

DOCSPACE_TOOLSETS

The list of toolsets to enable for the MCP server.

DOCSPACE_ENABLED_TOOLS

The list of tools to enable for the MCP server.

DOCSPACE_DISABLED_TOOLS

The list of tools to disable for the MCP server.

DOCSPACE_USER_AGENT

The user agent to include in the User-Agent header for API requests.

DOCSPACE_BASE_URL

The base URL of the DocSpace instance for API requests.

DOCSPACE_AUTHORIZATION

secret

The raw value to include in the Authorization header for API requests.

DOCSPACE_API_KEY

secret

The API key for accessing the API.

DOCSPACE_AUTH_TOKEN

secret

The Personal Access Token (PAT) for accessing the API.

DOCSPACE_USERNAME

The username for accessing the API using basic authentication.

DOCSPACE_PASSWORD

secret

The password for accessing the API using basic authentication.

DOCSPACE_TRANSPORT

The transport protocol to use for communication with the MCP server.

DOCSPACE_DYNAMIC

The flag that indicates whether the MCP server should use meta tools.

DOCSPACE_TOOLSETS

The list of toolsets to enable for the MCP server.

DOCSPACE_ENABLED_TOOLS

The list of tools to enable for the MCP server.

DOCSPACE_DISABLED_TOOLS

The list of tools to disable for the MCP server.

DOCSPACE_SESSION_TTL

The time-to-live (TTL) for HTTP sessions in milliseconds.

DOCSPACE_SESSION_INTERVAL

The interval for checking HTTP sessions for expiration in milliseconds.

DOCSPACE_USER_AGENT

The user agent to include in the User-Agent header for API requests.

DOCSPACE_BASE_URL

The base URL of the DocSpace instance for API requests.

DOCSPACE_AUTHORIZATION

secret

The raw value to include in the Authorization header for API requests.

DOCSPACE_API_KEY

secret

The API key for accessing the API.

DOCSPACE_AUTH_TOKEN

secret

The Personal Access Token (PAT) for accessing the API.

DOCSPACE_USERNAME

The username for accessing the API using basic authentication.

DOCSPACE_PASSWORD

secret

The password for accessing the API using basic authentication.

DOCSPACE_OAUTH_BASE_URL

The base URL of the DocSpace OAuth service for OAuth requests.

DOCSPACE_OAUTH_CLIENT_ID

The client ID of the OAuth application.

DOCSPACE_OAUTH_CLIENT_SECRET

secret

The client secret of the OAuth application.

DOCSPACE_OAUTH_AUTH_TOKEN_ALGORITHM

The algorithm to use for signing OAuth access tokens.

DOCSPACE_OAUTH_AUTH_TOKEN_TTL

The time-to-live (TTL) for OAuth access tokens in milliseconds.

DOCSPACE_OAUTH_AUTH_TOKEN_SECRET_KEY

secret

The secret key to use for signing OAuth access tokens.

DOCSPACE_OAUTH_STATE_TOKEN_ALGORITHM

The algorithm to use for signing OAuth state tokens.

DOCSPACE_OAUTH_STATE_TOKEN_TTL

The time-to-live (TTL) for OAuth state tokens in milliseconds.

DOCSPACE_OAUTH_STATE_TOKEN_SECRET_KEY

secret

The secret key to use for signing OAuth state tokens.

DOCSPACE_SERVER_BASE_URL

The base URL of the server.

DOCSPACE_HOST

The host to bind the server to.

DOCSPACE_PORT

The port to bind the server to.

DOCSPACE_SERVER_PROXY_HOPS

The number of proxy servers between the server and the client.

DOCSPACE_SERVER_CORS_MCP_ORIGIN

The list of allowed origins to include in the Access-Control-Allow-Origin header for CORS requests to MCP endpoints.

DOCSPACE_SERVER_CORS_MCP_MAX_AGE

The maximum age in milliseconds to include in the Access-Control-Max-Age header for CORS requests to MCP endpoints.

DOCSPACE_SERVER_CORS_OAUTH_ORIGIN

The list of allowed origins to include in the Access-Control-Allow-Origin header for CORS requests to OAuth endpoints.

DOCSPACE_SERVER_CORS_OAUTH_MAX_AGE

The maximum age in milliseconds to include in the Access-Control-Max-Age header for CORS requests to OAuth endpoints.

DOCSPACE_SERVER_RATE_LIMITS_MCP_CAPACITY

The maximum number of requests allowed per window for the MCP endpoints.

DOCSPACE_SERVER_RATE_LIMITS_MCP_WINDOW

The time window in milliseconds for the rate limit for the MCP endpoints.

DOCSPACE_SERVER_RATE_LIMITS_OAUTH_SERVER_METADATA_CAPACITY

The maximum number of requests allowed per window for the OAuth server metadata endpoint.

DOCSPACE_SERVER_RATE_LIMITS_OAUTH_SERVER_METADATA_WINDOW

The time window in milliseconds for the rate limit for the OAuth server metadata endpoint.

DOCSPACE_SERVER_RATE_LIMITS_OAUTH_RESOURCE_METADATA_CAPACITY

The maximum number of requests allowed per window for the OAuth resource metadata endpoint.

DOCSPACE_SERVER_RATE_LIMITS_OAUTH_RESOURCE_METADATA_WINDOW

The time window in milliseconds for the rate limit for the OAuth resource metadata endpoint.

DOCSPACE_SERVER_RATE_LIMITS_OAUTH_AUTHORIZE_CAPACITY

The maximum number of requests allowed per window for the OAuth authorization endpoint.

DOCSPACE_SERVER_RATE_LIMITS_OAUTH_AUTHORIZE_WINDOW

The time window in milliseconds for the rate limit for the OAuth authorization endpoint.

DOCSPACE_SERVER_RATE_LIMITS_OAUTH_CALLBACK_CAPACITY

The maximum number of requests allowed per window for the OAuth callback endpoint.

DOCSPACE_SERVER_RATE_LIMITS_OAUTH_CALLBACK_WINDOW

The time window in milliseconds for the rate limit for the OAuth callback endpoint.

DOCSPACE_SERVER_RATE_LIMITS_OAUTH_INTROSPECT_CAPACITY

The maximum number of requests allowed per window for the OAuth introspection endpoint.

DOCSPACE_SERVER_RATE_LIMITS_OAUTH_INTROSPECT_WINDOW

The time window in milliseconds for the rate limit for the OAuth introspection endpoint.

DOCSPACE_SERVER_RATE_LIMITS_OAUTH_REGISTER_CAPACITY

The maximum number of requests allowed per window for the OAuth client registration endpoint.

DOCSPACE_SERVER_RATE_LIMITS_OAUTH_REGISTER_WINDOW

The time window in milliseconds for the rate limit for the OAuth client registration endpoint.

DOCSPACE_SERVER_RATE_LIMITS_OAUTH_REVOKE_CAPACITY

The maximum number of requests allowed per window for the OAuth token revocation endpoint.

DOCSPACE_SERVER_RATE_LIMITS_OAUTH_REVOKE_WINDOW

The time window in milliseconds for the rate limit for the OAuth token revocation endpoint.

DOCSPACE_SERVER_RATE_LIMITS_OAUTH_TOKEN_CAPACITY

The maximum number of requests allowed per window for the OAuth token endpoint.

DOCSPACE_SERVER_RATE_LIMITS_OAUTH_TOKEN_WINDOW

The time window in milliseconds for the rate limit for the OAuth token endpoint.

DOCSPACE_REQUEST_QUERY

The flag that indicates whether the server should accept configuration via query parameters in incoming requests.

DOCSPACE_REQUEST_AUTHORIZATION_HEADER

The flag that indicates whether the server should check for the Authorization header in incoming requests.

DOCSPACE_REQUEST_HEADER_PREFIX

The prefix to use with custom configuration headers.

DOCSPACE_TRANSPORT

The transport protocol to use for communication with the MCP server.

DOCSPACE_DYNAMIC

The flag that indicates whether the MCP server should use meta tools.

DOCSPACE_TOOLSETS

The list of toolsets to enable for the MCP server.

DOCSPACE_ENABLED_TOOLS

The list of tools to enable for the MCP server.

DOCSPACE_DISABLED_TOOLS

The list of tools to disable for the MCP server.

DOCSPACE_SESSION_TTL

The time-to-live (TTL) for HTTP sessions in milliseconds.

DOCSPACE_SESSION_INTERVAL

The interval for checking HTTP sessions for expiration in milliseconds.

DOCSPACE_USER_AGENT

The user agent to include in the User-Agent header for API requests.

DOCSPACE_BASE_URL

The base URL of the DocSpace instance for API requests.

DOCSPACE_AUTHORIZATION

secret

The raw value to include in the Authorization header for API requests.

DOCSPACE_API_KEY

secret

The API key for accessing the API.

DOCSPACE_AUTH_TOKEN

secret

The Personal Access Token (PAT) for accessing the API.

DOCSPACE_USERNAME

The username for accessing the API using basic authentication.

DOCSPACE_PASSWORD

secret

The password for accessing the API using basic authentication.

DOCSPACE_OAUTH_BASE_URL

The base URL of the DocSpace OAuth service for OAuth requests.

DOCSPACE_OAUTH_CLIENT_ID

The client ID of the OAuth application.

DOCSPACE_OAUTH_CLIENT_SECRET

secret

The client secret of the OAuth application.

DOCSPACE_OAUTH_AUTH_TOKEN_ALGORITHM

The algorithm to use for signing OAuth access tokens.

DOCSPACE_OAUTH_AUTH_TOKEN_TTL

The time-to-live (TTL) for OAuth access tokens in milliseconds.

DOCSPACE_OAUTH_AUTH_TOKEN_SECRET_KEY

secret

The secret key to use for signing OAuth access tokens.

DOCSPACE_OAUTH_STATE_TOKEN_ALGORITHM

The algorithm to use for signing OAuth state tokens.

DOCSPACE_OAUTH_STATE_TOKEN_TTL

The time-to-live (TTL) for OAuth state tokens in milliseconds.

DOCSPACE_OAUTH_STATE_TOKEN_SECRET_KEY

secret

The secret key to use for signing OAuth state tokens.

DOCSPACE_SERVER_BASE_URL

The base URL of the server.

DOCSPACE_HOST

The host to bind the server to.

DOCSPACE_PORT

The port to bind the server to.

DOCSPACE_SERVER_PROXY_HOPS

The number of proxy servers between the server and the client.

DOCSPACE_SERVER_CORS_MCP_ORIGIN

The list of allowed origins to include in the Access-Control-Allow-Origin header for CORS requests to MCP endpoints.

DOCSPACE_SERVER_CORS_MCP_MAX_AGE

The maximum age in milliseconds to include in the Access-Control-Max-Age header for CORS requests to MCP endpoints.

DOCSPACE_SERVER_CORS_OAUTH_ORIGIN

The list of allowed origins to include in the Access-Control-Allow-Origin header for CORS requests to OAuth endpoints.

DOCSPACE_SERVER_CORS_OAUTH_MAX_AGE

The maximum age in milliseconds to include in the Access-Control-Max-Age header for CORS requests to OAuth endpoints.

DOCSPACE_SERVER_RATE_LIMITS_MCP_CAPACITY

The maximum number of requests allowed per window for the MCP endpoints.

DOCSPACE_SERVER_RATE_LIMITS_MCP_WINDOW

The time window in milliseconds for the rate limit for the MCP endpoints.

DOCSPACE_SERVER_RATE_LIMITS_OAUTH_SERVER_METADATA_CAPACITY

The maximum number of requests allowed per window for the OAuth server metadata endpoint.

DOCSPACE_SERVER_RATE_LIMITS_OAUTH_SERVER_METADATA_WINDOW

The time window in milliseconds for the rate limit for the OAuth server metadata endpoint.

DOCSPACE_SERVER_RATE_LIMITS_OAUTH_RESOURCE_METADATA_CAPACITY

The maximum number of requests allowed per window for the OAuth resource metadata endpoint.

DOCSPACE_SERVER_RATE_LIMITS_OAUTH_RESOURCE_METADATA_WINDOW

The time window in milliseconds for the rate limit for the OAuth resource metadata endpoint.

DOCSPACE_SERVER_RATE_LIMITS_OAUTH_AUTHORIZE_CAPACITY

The maximum number of requests allowed per window for the OAuth authorization endpoint.

DOCSPACE_SERVER_RATE_LIMITS_OAUTH_AUTHORIZE_WINDOW

The time window in milliseconds for the rate limit for the OAuth authorization endpoint.

DOCSPACE_SERVER_RATE_LIMITS_OAUTH_CALLBACK_CAPACITY

The maximum number of requests allowed per window for the OAuth callback endpoint.

DOCSPACE_SERVER_RATE_LIMITS_OAUTH_CALLBACK_WINDOW

The time window in milliseconds for the rate limit for the OAuth callback endpoint.

DOCSPACE_SERVER_RATE_LIMITS_OAUTH_INTROSPECT_CAPACITY

The maximum number of requests allowed per window for the OAuth introspection endpoint.

DOCSPACE_SERVER_RATE_LIMITS_OAUTH_INTROSPECT_WINDOW

The time window in milliseconds for the rate limit for the OAuth introspection endpoint.

DOCSPACE_SERVER_RATE_LIMITS_OAUTH_REGISTER_CAPACITY

The maximum number of requests allowed per window for the OAuth client registration endpoint.

DOCSPACE_SERVER_RATE_LIMITS_OAUTH_REGISTER_WINDOW

The time window in milliseconds for the rate limit for the OAuth client registration endpoint.

DOCSPACE_SERVER_RATE_LIMITS_OAUTH_REVOKE_CAPACITY

The maximum number of requests allowed per window for the OAuth token revocation endpoint.

DOCSPACE_SERVER_RATE_LIMITS_OAUTH_REVOKE_WINDOW

The time window in milliseconds for the rate limit for the OAuth token revocation endpoint.

DOCSPACE_SERVER_RATE_LIMITS_OAUTH_TOKEN_CAPACITY

The maximum number of requests allowed per window for the OAuth token endpoint.

DOCSPACE_SERVER_RATE_LIMITS_OAUTH_TOKEN_WINDOW

The time window in milliseconds for the rate limit for the OAuth token endpoint.

DOCSPACE_REQUEST_QUERY

The flag that indicates whether the server should accept configuration via query parameters in incoming requests.

DOCSPACE_REQUEST_AUTHORIZATION_HEADER

The flag that indicates whether the server should check for the Authorization header in incoming requests.

DOCSPACE_REQUEST_HEADER_PREFIX

The prefix to use with custom configuration headers.

DOCSPACE_TRANSPORT

The transport protocol to use for communication with the MCP server.

DOCSPACE_DYNAMIC

The flag that indicates whether the MCP server should use meta tools.

DOCSPACE_TOOLSETS

The list of toolsets to enable for the MCP server.

DOCSPACE_ENABLED_TOOLS

The list of tools to enable for the MCP server.

DOCSPACE_DISABLED_TOOLS

The list of tools to disable for the MCP server.

DOCSPACE_USER_AGENT

The user agent to include in the User-Agent header for API requests.

DOCSPACE_BASE_URL

The base URL of the DocSpace instance for API requests.

DOCSPACE_AUTHORIZATION

secret

The raw value to include in the Authorization header for API requests.

DOCSPACE_API_KEY

secret

The API key for accessing the API.

DOCSPACE_AUTH_TOKEN

secret

The Personal Access Token (PAT) for accessing the API.

DOCSPACE_USERNAME

The username for accessing the API using basic authentication.

DOCSPACE_PASSWORD

secret

The password for accessing the API using basic authentication.

DOCSPACE_TRANSPORT

The transport protocol to use for communication with the MCP server.

DOCSPACE_DYNAMIC

The flag that indicates whether the MCP server should use meta tools.

DOCSPACE_TOOLSETS

The list of toolsets to enable for the MCP server.

DOCSPACE_ENABLED_TOOLS

The list of tools to enable for the MCP server.

DOCSPACE_DISABLED_TOOLS

The list of tools to disable for the MCP server.

DOCSPACE_SESSION_TTL

The time-to-live (TTL) for HTTP sessions in milliseconds.

DOCSPACE_SESSION_INTERVAL

The interval for checking HTTP sessions for expiration in milliseconds.

DOCSPACE_USER_AGENT

The user agent to include in the User-Agent header for API requests.

DOCSPACE_BASE_URL

The base URL of the DocSpace instance for API requests.

DOCSPACE_AUTHORIZATION

secret

The raw value to include in the Authorization header for API requests.

DOCSPACE_API_KEY

secret

The API key for accessing the API.

DOCSPACE_AUTH_TOKEN

secret

The Personal Access Token (PAT) for accessing the API.

DOCSPACE_USERNAME

The username for accessing the API using basic authentication.

DOCSPACE_PASSWORD

secret

The password for accessing the API using basic authentication.

DOCSPACE_OAUTH_BASE_URL

The base URL of the DocSpace OAuth service for OAuth requests.

DOCSPACE_OAUTH_CLIENT_ID

The client ID of the OAuth application.

DOCSPACE_OAUTH_CLIENT_SECRET

secret

The client secret of the OAuth application.

DOCSPACE_OAUTH_AUTH_TOKEN_ALGORITHM

The algorithm to use for signing OAuth access tokens.

DOCSPACE_OAUTH_AUTH_TOKEN_TTL

The time-to-live (TTL) for OAuth access tokens in milliseconds.

DOCSPACE_OAUTH_AUTH_TOKEN_SECRET_KEY

secret

The secret key to use for signing OAuth access tokens.

DOCSPACE_OAUTH_STATE_TOKEN_ALGORITHM

The algorithm to use for signing OAuth state tokens.

DOCSPACE_OAUTH_STATE_TOKEN_TTL

The time-to-live (TTL) for OAuth state tokens in milliseconds.

DOCSPACE_OAUTH_STATE_TOKEN_SECRET_KEY

secret

The secret key to use for signing OAuth state tokens.

DOCSPACE_SERVER_BASE_URL

The base URL of the server.

DOCSPACE_HOST

The host to bind the server to.

DOCSPACE_PORT

The port to bind the server to.

DOCSPACE_SERVER_PROXY_HOPS

The number of proxy servers between the server and the client.

DOCSPACE_SERVER_CORS_MCP_ORIGIN

The list of allowed origins to include in the Access-Control-Allow-Origin header for CORS requests to MCP endpoints.

DOCSPACE_SERVER_CORS_MCP_MAX_AGE

The maximum age in milliseconds to include in the Access-Control-Max-Age header for CORS requests to MCP endpoints.

DOCSPACE_SERVER_CORS_OAUTH_ORIGIN

The list of allowed origins to include in the Access-Control-Allow-Origin header for CORS requests to OAuth endpoints.

DOCSPACE_SERVER_CORS_OAUTH_MAX_AGE

The maximum age in milliseconds to include in the Access-Control-Max-Age header for CORS requests to OAuth endpoints.

DOCSPACE_SERVER_RATE_LIMITS_MCP_CAPACITY

The maximum number of requests allowed per window for the MCP endpoints.

DOCSPACE_SERVER_RATE_LIMITS_MCP_WINDOW

The time window in milliseconds for the rate limit for the MCP endpoints.

DOCSPACE_SERVER_RATE_LIMITS_OAUTH_SERVER_METADATA_CAPACITY

The maximum number of requests allowed per window for the OAuth server metadata endpoint.

DOCSPACE_SERVER_RATE_LIMITS_OAUTH_SERVER_METADATA_WINDOW

The time window in milliseconds for the rate limit for the OAuth server metadata endpoint.

DOCSPACE_SERVER_RATE_LIMITS_OAUTH_RESOURCE_METADATA_CAPACITY

The maximum number of requests allowed per window for the OAuth resource metadata endpoint.

DOCSPACE_SERVER_RATE_LIMITS_OAUTH_RESOURCE_METADATA_WINDOW

The time window in milliseconds for the rate limit for the OAuth resource metadata endpoint.

DOCSPACE_SERVER_RATE_LIMITS_OAUTH_AUTHORIZE_CAPACITY

The maximum number of requests allowed per window for the OAuth authorization endpoint.

DOCSPACE_SERVER_RATE_LIMITS_OAUTH_AUTHORIZE_WINDOW

The time window in milliseconds for the rate limit for the OAuth authorization endpoint.

DOCSPACE_SERVER_RATE_LIMITS_OAUTH_CALLBACK_CAPACITY

The maximum number of requests allowed per window for the OAuth callback endpoint.

DOCSPACE_SERVER_RATE_LIMITS_OAUTH_CALLBACK_WINDOW

The time window in milliseconds for the rate limit for the OAuth callback endpoint.

DOCSPACE_SERVER_RATE_LIMITS_OAUTH_INTROSPECT_CAPACITY

The maximum number of requests allowed per window for the OAuth introspection endpoint.

DOCSPACE_SERVER_RATE_LIMITS_OAUTH_INTROSPECT_WINDOW

The time window in milliseconds for the rate limit for the OAuth introspection endpoint.

DOCSPACE_SERVER_RATE_LIMITS_OAUTH_REGISTER_CAPACITY

The maximum number of requests allowed per window for the OAuth client registration endpoint.

DOCSPACE_SERVER_RATE_LIMITS_OAUTH_REGISTER_WINDOW

The time window in milliseconds for the rate limit for the OAuth client registration endpoint.

DOCSPACE_SERVER_RATE_LIMITS_OAUTH_REVOKE_CAPACITY

The maximum number of requests allowed per window for the OAuth token revocation endpoint.

DOCSPACE_SERVER_RATE_LIMITS_OAUTH_REVOKE_WINDOW

The time window in milliseconds for the rate limit for the OAuth token revocation endpoint.

DOCSPACE_SERVER_RATE_LIMITS_OAUTH_TOKEN_CAPACITY

The maximum number of requests allowed per window for the OAuth token endpoint.

DOCSPACE_SERVER_RATE_LIMITS_OAUTH_TOKEN_WINDOW

The time window in milliseconds for the rate limit for the OAuth token endpoint.

DOCSPACE_REQUEST_QUERY

The flag that indicates whether the server should accept configuration via query parameters in incoming requests.

DOCSPACE_REQUEST_AUTHORIZATION_HEADER

The flag that indicates whether the server should check for the Authorization header in incoming requests.

DOCSPACE_REQUEST_HEADER_PREFIX

The prefix to use with custom configuration headers.

DOCSPACE_TRANSPORT

The transport protocol to use for communication with the MCP server.

DOCSPACE_DYNAMIC

The flag that indicates whether the MCP server should use meta tools.

DOCSPACE_TOOLSETS

The list of toolsets to enable for the MCP server.

DOCSPACE_ENABLED_TOOLS

The list of tools to enable for the MCP server.

DOCSPACE_DISABLED_TOOLS

The list of tools to disable for the MCP server.

DOCSPACE_SESSION_TTL

The time-to-live (TTL) for HTTP sessions in milliseconds.

DOCSPACE_SESSION_INTERVAL

The interval for checking HTTP sessions for expiration in milliseconds.

DOCSPACE_USER_AGENT

The user agent to include in the User-Agent header for API requests.

DOCSPACE_BASE_URL

The base URL of the DocSpace instance for API requests.

DOCSPACE_AUTHORIZATION

secret

The raw value to include in the Authorization header for API requests.

DOCSPACE_API_KEY

secret

The API key for accessing the API.

DOCSPACE_AUTH_TOKEN

secret

The Personal Access Token (PAT) for accessing the API.

DOCSPACE_USERNAME

The username for accessing the API using basic authentication.

DOCSPACE_PASSWORD

secret

The password for accessing the API using basic authentication.

DOCSPACE_OAUTH_BASE_URL

The base URL of the DocSpace OAuth service for OAuth requests.

DOCSPACE_OAUTH_CLIENT_ID

The client ID of the OAuth application.

DOCSPACE_OAUTH_CLIENT_SECRET

secret

The client secret of the OAuth application.

DOCSPACE_OAUTH_AUTH_TOKEN_ALGORITHM

The algorithm to use for signing OAuth access tokens.

DOCSPACE_OAUTH_AUTH_TOKEN_TTL

The time-to-live (TTL) for OAuth access tokens in milliseconds.

DOCSPACE_OAUTH_AUTH_TOKEN_SECRET_KEY

secret

The secret key to use for signing OAuth access tokens.

DOCSPACE_OAUTH_STATE_TOKEN_ALGORITHM

The algorithm to use for signing OAuth state tokens.

DOCSPACE_OAUTH_STATE_TOKEN_TTL

The time-to-live (TTL) for OAuth state tokens in milliseconds.

DOCSPACE_OAUTH_STATE_TOKEN_SECRET_KEY

secret

The secret key to use for signing OAuth state tokens.

DOCSPACE_SERVER_BASE_URL

The base URL of the server.

DOCSPACE_HOST

The host to bind the server to.

DOCSPACE_PORT

The port to bind the server to.

DOCSPACE_SERVER_PROXY_HOPS

The number of proxy servers between the server and the client.

DOCSPACE_SERVER_CORS_MCP_ORIGIN

The list of allowed origins to include in the Access-Control-Allow-Origin header for CORS requests to MCP endpoints.

DOCSPACE_SERVER_CORS_MCP_MAX_AGE

The maximum age in milliseconds to include in the Access-Control-Max-Age header for CORS requests to MCP endpoints.

DOCSPACE_SERVER_CORS_OAUTH_ORIGIN

The list of allowed origins to include in the Access-Control-Allow-Origin header for CORS requests to OAuth endpoints.

DOCSPACE_SERVER_CORS_OAUTH_MAX_AGE

The maximum age in milliseconds to include in the Access-Control-Max-Age header for CORS requests to OAuth endpoints.

DOCSPACE_SERVER_RATE_LIMITS_MCP_CAPACITY

The maximum number of requests allowed per window for the MCP endpoints.

DOCSPACE_SERVER_RATE_LIMITS_MCP_WINDOW

The time window in milliseconds for the rate limit for the MCP endpoints.

DOCSPACE_SERVER_RATE_LIMITS_OAUTH_SERVER_METADATA_CAPACITY

The maximum number of requests allowed per window for the OAuth server metadata endpoint.

DOCSPACE_SERVER_RATE_LIMITS_OAUTH_SERVER_METADATA_WINDOW

The time window in milliseconds for the rate limit for the OAuth server metadata endpoint.

DOCSPACE_SERVER_RATE_LIMITS_OAUTH_RESOURCE_METADATA_CAPACITY

The maximum number of requests allowed per window for the OAuth resource metadata endpoint.

DOCSPACE_SERVER_RATE_LIMITS_OAUTH_RESOURCE_METADATA_WINDOW

The time window in milliseconds for the rate limit for the OAuth resource metadata endpoint.

DOCSPACE_SERVER_RATE_LIMITS_OAUTH_AUTHORIZE_CAPACITY

The maximum number of requests allowed per window for the OAuth authorization endpoint.

DOCSPACE_SERVER_RATE_LIMITS_OAUTH_AUTHORIZE_WINDOW

The time window in milliseconds for the rate limit for the OAuth authorization endpoint.

DOCSPACE_SERVER_RATE_LIMITS_OAUTH_CALLBACK_CAPACITY

The maximum number of requests allowed per window for the OAuth callback endpoint.

DOCSPACE_SERVER_RATE_LIMITS_OAUTH_CALLBACK_WINDOW

The time window in milliseconds for the rate limit for the OAuth callback endpoint.

DOCSPACE_SERVER_RATE_LIMITS_OAUTH_INTROSPECT_CAPACITY

The maximum number of requests allowed per window for the OAuth introspection endpoint.

DOCSPACE_SERVER_RATE_LIMITS_OAUTH_INTROSPECT_WINDOW

The time window in milliseconds for the rate limit for the OAuth introspection endpoint.

DOCSPACE_SERVER_RATE_LIMITS_OAUTH_REGISTER_CAPACITY

The maximum number of requests allowed per window for the OAuth client registration endpoint.

DOCSPACE_SERVER_RATE_LIMITS_OAUTH_REGISTER_WINDOW

The time window in milliseconds for the rate limit for the OAuth client registration endpoint.

DOCSPACE_SERVER_RATE_LIMITS_OAUTH_REVOKE_CAPACITY

The maximum number of requests allowed per window for the OAuth token revocation endpoint.

DOCSPACE_SERVER_RATE_LIMITS_OAUTH_REVOKE_WINDOW

The time window in milliseconds for the rate limit for the OAuth token revocation endpoint.

DOCSPACE_SERVER_RATE_LIMITS_OAUTH_TOKEN_CAPACITY

The maximum number of requests allowed per window for the OAuth token endpoint.

DOCSPACE_SERVER_RATE_LIMITS_OAUTH_TOKEN_WINDOW

The time window in milliseconds for the rate limit for the OAuth token endpoint.

DOCSPACE_REQUEST_QUERY

The flag that indicates whether the server should accept configuration via query parameters in incoming requests.

DOCSPACE_REQUEST_AUTHORIZATION_HEADER

The flag that indicates whether the server should check for the Authorization header in incoming requests.

DOCSPACE_REQUEST_HEADER_PREFIX

The prefix to use with custom configuration headers.

MCP quality score · maturity, not trust · methodology

freshness

completeness

installability

documentation

stability

Alternatives in Documents & Spreadsheets

ac.tandem/docs-mcp

Remote MCP server for Tandem docs, install guides, SDKs, workflows, and agent setup help.

ai.adramp/google-ads

Google Ads MCP server — manage campaigns, keywords, and metrics.

AutEng MCP - Markdown Publishing & Document Share Links

ai.auteng/docs

Publish markdown documents as public share links with mermaid diagram support. Built by AutEng.ai

Install

Remote endpoint

Streamable HTTP / SSE endpoint. Add to any MCP client that supports remote servers.

https://mcp.onlyoffice.com/sse

Claude Desktop (claude_desktop_config.json)

{
  "mcpServers": {
    "docspace": {
      "command": "npx",
      "args": [
        "-y",
        "@onlyoffice/docspace-mcp"
      ],
      "env": {
        "DOCSPACE_BASE_URL": "<docspace_base_url>",
        "DOCSPACE_API_KEY": "<your-docspace_api_key>",
        "DOCSPACE_TRANSPORT": "stdio",
        "DOCSPACE_DYNAMIC": "false",
        "DOCSPACE_TOOLSETS": "all",
        "DOCSPACE_ENABLED_TOOLS": "<docspace_enabled_tools>",
        "DOCSPACE_DISABLED_TOOLS": "<docspace_disabled_tools>",
        "DOCSPACE_USER_AGENT": "@onlyoffice/docspace-mcp v3.2.0",
        "DOCSPACE_AUTHORIZATION": "<your-docspace_authorization>",
        "DOCSPACE_AUTH_TOKEN": "<your-docspace_auth_token>",
        "DOCSPACE_USERNAME": "<docspace_username>",
        "DOCSPACE_PASSWORD": "<your-docspace_password>",
        "DOCSPACE_SESSION_TTL": "28800000",
        "DOCSPACE_SESSION_INTERVAL": "240000",
        "DOCSPACE_OAUTH_BASE_URL": "<docspace_oauth_base_url>",
        "DOCSPACE_OAUTH_CLIENT_ID": "<docspace_oauth_client_id>",
        "DOCSPACE_OAUTH_CLIENT_SECRET": "<your-docspace_oauth_client_secret>",
        "DOCSPACE_OAUTH_AUTH_TOKEN_ALGORITHM": "HS256",
        "DOCSPACE_OAUTH_AUTH_TOKEN_TTL": "3600000",
        "DOCSPACE_OAUTH_AUTH_TOKEN_SECRET_KEY": "<your-docspace_oauth_auth_token_secret_key>",
        "DOCSPACE_OAUTH_STATE_TOKEN_ALGORITHM": "HS256",
        "DOCSPACE_OAUTH_STATE_TOKEN_TTL": "3600000",
        "DOCSPACE_OAUTH_STATE_TOKEN_SECRET_KEY": "<your-docspace_oauth_state_token_secret_key>",
        "DOCSPACE_SERVER_BASE_URL": "<docspace_server_base_url>",
        "DOCSPACE_HOST": "127.0.0.1",
        "DOCSPACE_PORT": "8080",
        "DOCSPACE_SERVER_PROXY_HOPS": "0",
        "DOCSPACE_SERVER_CORS_MCP_ORIGIN": "*",
        "DOCSPACE_SERVER_CORS_MCP_MAX_AGE": "86400000",
        "DOCSPACE_SERVER_CORS_OAUTH_ORIGIN": "*",
        "DOCSPACE_SERVER_CORS_OAUTH_MAX_AGE": "86400000",
        "DOCSPACE_SERVER_RATE_LIMITS_MCP_CAPACITY": "1000",
        "DOCSPACE_SERVER_RATE_LIMITS_MCP_WINDOW": "1000",
        "DOCSPACE_SERVER_RATE_LIMITS_OAUTH_SERVER_METADATA_CAPACITY": "200",
        "DOCSPACE_SERVER_RATE_LIMITS_OAUTH_SERVER_METADATA_WINDOW": "60000",
        "DOCSPACE_SERVER_RATE_LIMITS_OAUTH_RESOURCE_METADATA_CAPACITY": "200",
        "DOCSPACE_SERVER_RATE_LIMITS_OAUTH_RESOURCE_METADATA_WINDOW": "60000",
        "DOCSPACE_SERVER_RATE_LIMITS_OAUTH_AUTHORIZE_CAPACITY": "200",
        "DOCSPACE_SERVER_RATE_LIMITS_OAUTH_AUTHORIZE_WINDOW": "60000",
        "DOCSPACE_SERVER_RATE_LIMITS_OAUTH_CALLBACK_CAPACITY": "200",
        "DOCSPACE_SERVER_RATE_LIMITS_OAUTH_CALLBACK_WINDOW": "60000",
        "DOCSPACE_SERVER_RATE_LIMITS_OAUTH_INTROSPECT_CAPACITY": "10",
        "DOCSPACE_SERVER_RATE_LIMITS_OAUTH_INTROSPECT_WINDOW": "60000",
        "DOCSPACE_SERVER_RATE_LIMITS_OAUTH_REGISTER_CAPACITY": "10",
        "DOCSPACE_SERVER_RATE_LIMITS_OAUTH_REGISTER_WINDOW": "60000",
        "DOCSPACE_SERVER_RATE_LIMITS_OAUTH_REVOKE_CAPACITY": "10",
        "DOCSPACE_SERVER_RATE_LIMITS_OAUTH_REVOKE_WINDOW": "60000",
        "DOCSPACE_SERVER_RATE_LIMITS_OAUTH_TOKEN_CAPACITY": "10",
        "DOCSPACE_SERVER_RATE_LIMITS_OAUTH_TOKEN_WINDOW": "60000",
        "DOCSPACE_REQUEST_QUERY": "true",
        "DOCSPACE_REQUEST_AUTHORIZATION_HEADER": "true",
        "DOCSPACE_REQUEST_HEADER_PREFIX": "x-mcp-"
      }
    }
  }
}

Cursor (.cursor/mcp.json)

{
  "mcpServers": {
    "docspace": {
      "command": "npx",
      "args": [
        "-y",
        "@onlyoffice/docspace-mcp"
      ],
      "env": {
        "DOCSPACE_BASE_URL": "<docspace_base_url>",
        "DOCSPACE_API_KEY": "<your-docspace_api_key>",
        "DOCSPACE_TRANSPORT": "stdio",
        "DOCSPACE_DYNAMIC": "false",
        "DOCSPACE_TOOLSETS": "all",
        "DOCSPACE_ENABLED_TOOLS": "<docspace_enabled_tools>",
        "DOCSPACE_DISABLED_TOOLS": "<docspace_disabled_tools>",
        "DOCSPACE_USER_AGENT": "@onlyoffice/docspace-mcp v3.2.0",
        "DOCSPACE_AUTHORIZATION": "<your-docspace_authorization>",
        "DOCSPACE_AUTH_TOKEN": "<your-docspace_auth_token>",
        "DOCSPACE_USERNAME": "<docspace_username>",
        "DOCSPACE_PASSWORD": "<your-docspace_password>",
        "DOCSPACE_SESSION_TTL": "28800000",
        "DOCSPACE_SESSION_INTERVAL": "240000",
        "DOCSPACE_OAUTH_BASE_URL": "<docspace_oauth_base_url>",
        "DOCSPACE_OAUTH_CLIENT_ID": "<docspace_oauth_client_id>",
        "DOCSPACE_OAUTH_CLIENT_SECRET": "<your-docspace_oauth_client_secret>",
        "DOCSPACE_OAUTH_AUTH_TOKEN_ALGORITHM": "HS256",
        "DOCSPACE_OAUTH_AUTH_TOKEN_TTL": "3600000",
        "DOCSPACE_OAUTH_AUTH_TOKEN_SECRET_KEY": "<your-docspace_oauth_auth_token_secret_key>",
        "DOCSPACE_OAUTH_STATE_TOKEN_ALGORITHM": "HS256",
        "DOCSPACE_OAUTH_STATE_TOKEN_TTL": "3600000",
        "DOCSPACE_OAUTH_STATE_TOKEN_SECRET_KEY": "<your-docspace_oauth_state_token_secret_key>",
        "DOCSPACE_SERVER_BASE_URL": "<docspace_server_base_url>",
        "DOCSPACE_HOST": "127.0.0.1",
        "DOCSPACE_PORT": "8080",
        "DOCSPACE_SERVER_PROXY_HOPS": "0",
        "DOCSPACE_SERVER_CORS_MCP_ORIGIN": "*",
        "DOCSPACE_SERVER_CORS_MCP_MAX_AGE": "86400000",
        "DOCSPACE_SERVER_CORS_OAUTH_ORIGIN": "*",
        "DOCSPACE_SERVER_CORS_OAUTH_MAX_AGE": "86400000",
        "DOCSPACE_SERVER_RATE_LIMITS_MCP_CAPACITY": "1000",
        "DOCSPACE_SERVER_RATE_LIMITS_MCP_WINDOW": "1000",
        "DOCSPACE_SERVER_RATE_LIMITS_OAUTH_SERVER_METADATA_CAPACITY": "200",
        "DOCSPACE_SERVER_RATE_LIMITS_OAUTH_SERVER_METADATA_WINDOW": "60000",
        "DOCSPACE_SERVER_RATE_LIMITS_OAUTH_RESOURCE_METADATA_CAPACITY": "200",
        "DOCSPACE_SERVER_RATE_LIMITS_OAUTH_RESOURCE_METADATA_WINDOW": "60000",
        "DOCSPACE_SERVER_RATE_LIMITS_OAUTH_AUTHORIZE_CAPACITY": "200",
        "DOCSPACE_SERVER_RATE_LIMITS_OAUTH_AUTHORIZE_WINDOW": "60000",
        "DOCSPACE_SERVER_RATE_LIMITS_OAUTH_CALLBACK_CAPACITY": "200",
        "DOCSPACE_SERVER_RATE_LIMITS_OAUTH_CALLBACK_WINDOW": "60000",
        "DOCSPACE_SERVER_RATE_LIMITS_OAUTH_INTROSPECT_CAPACITY": "10",
        "DOCSPACE_SERVER_RATE_LIMITS_OAUTH_INTROSPECT_WINDOW": "60000",
        "DOCSPACE_SERVER_RATE_LIMITS_OAUTH_REGISTER_CAPACITY": "10",
        "DOCSPACE_SERVER_RATE_LIMITS_OAUTH_REGISTER_WINDOW": "60000",
        "DOCSPACE_SERVER_RATE_LIMITS_OAUTH_REVOKE_CAPACITY": "10",
        "DOCSPACE_SERVER_RATE_LIMITS_OAUTH_REVOKE_WINDOW": "60000",
        "DOCSPACE_SERVER_RATE_LIMITS_OAUTH_TOKEN_CAPACITY": "10",
        "DOCSPACE_SERVER_RATE_LIMITS_OAUTH_TOKEN_WINDOW": "60000",
        "DOCSPACE_REQUEST_QUERY": "true",
        "DOCSPACE_REQUEST_AUTHORIZATION_HEADER": "true",
        "DOCSPACE_REQUEST_HEADER_PREFIX": "x-mcp-"
      }
    }
  }
}

Cline (cline_mcp_settings.json)

npx -y @onlyoffice/docspace-mcp

Claude Desktop (Docker)

{
  "mcpServers": {
    "docspace": {
      "command": "docker",
      "args": [
        "run",
        "--rm",
        "-i",
        "docker.io/onlyoffice/docspace-mcp:3.2.0"
      ],
      "env": {
        "DOCSPACE_BASE_URL": "<docspace_base_url>",
        "DOCSPACE_API_KEY": "<your-docspace_api_key>",
        "DOCSPACE_TRANSPORT": "stdio",
        "DOCSPACE_DYNAMIC": "false",
        "DOCSPACE_TOOLSETS": "all",
        "DOCSPACE_ENABLED_TOOLS": "<docspace_enabled_tools>",
        "DOCSPACE_DISABLED_TOOLS": "<docspace_disabled_tools>",
        "DOCSPACE_USER_AGENT": "@onlyoffice/docspace-mcp v3.2.0",
        "DOCSPACE_AUTHORIZATION": "<your-docspace_authorization>",
        "DOCSPACE_AUTH_TOKEN": "<your-docspace_auth_token>",
        "DOCSPACE_USERNAME": "<docspace_username>",
        "DOCSPACE_PASSWORD": "<your-docspace_password>",
        "DOCSPACE_SESSION_TTL": "28800000",
        "DOCSPACE_SESSION_INTERVAL": "240000",
        "DOCSPACE_OAUTH_BASE_URL": "<docspace_oauth_base_url>",
        "DOCSPACE_OAUTH_CLIENT_ID": "<docspace_oauth_client_id>",
        "DOCSPACE_OAUTH_CLIENT_SECRET": "<your-docspace_oauth_client_secret>",
        "DOCSPACE_OAUTH_AUTH_TOKEN_ALGORITHM": "HS256",
        "DOCSPACE_OAUTH_AUTH_TOKEN_TTL": "3600000",
        "DOCSPACE_OAUTH_AUTH_TOKEN_SECRET_KEY": "<your-docspace_oauth_auth_token_secret_key>",
        "DOCSPACE_OAUTH_STATE_TOKEN_ALGORITHM": "HS256",
        "DOCSPACE_OAUTH_STATE_TOKEN_TTL": "3600000",
        "DOCSPACE_OAUTH_STATE_TOKEN_SECRET_KEY": "<your-docspace_oauth_state_token_secret_key>",
        "DOCSPACE_SERVER_BASE_URL": "<docspace_server_base_url>",
        "DOCSPACE_HOST": "127.0.0.1",
        "DOCSPACE_PORT": "8080",
        "DOCSPACE_SERVER_PROXY_HOPS": "0",
        "DOCSPACE_SERVER_CORS_MCP_ORIGIN": "*",
        "DOCSPACE_SERVER_CORS_MCP_MAX_AGE": "86400000",
        "DOCSPACE_SERVER_CORS_OAUTH_ORIGIN": "*",
        "DOCSPACE_SERVER_CORS_OAUTH_MAX_AGE": "86400000",
        "DOCSPACE_SERVER_RATE_LIMITS_MCP_CAPACITY": "1000",
        "DOCSPACE_SERVER_RATE_LIMITS_MCP_WINDOW": "1000",
        "DOCSPACE_SERVER_RATE_LIMITS_OAUTH_SERVER_METADATA_CAPACITY": "200",
        "DOCSPACE_SERVER_RATE_LIMITS_OAUTH_SERVER_METADATA_WINDOW": "60000",
        "DOCSPACE_SERVER_RATE_LIMITS_OAUTH_RESOURCE_METADATA_CAPACITY": "200",
        "DOCSPACE_SERVER_RATE_LIMITS_OAUTH_RESOURCE_METADATA_WINDOW": "60000",
        "DOCSPACE_SERVER_RATE_LIMITS_OAUTH_AUTHORIZE_CAPACITY": "200",
        "DOCSPACE_SERVER_RATE_LIMITS_OAUTH_AUTHORIZE_WINDOW": "60000",
        "DOCSPACE_SERVER_RATE_LIMITS_OAUTH_CALLBACK_CAPACITY": "200",
        "DOCSPACE_SERVER_RATE_LIMITS_OAUTH_CALLBACK_WINDOW": "60000",
        "DOCSPACE_SERVER_RATE_LIMITS_OAUTH_INTROSPECT_CAPACITY": "10",
        "DOCSPACE_SERVER_RATE_LIMITS_OAUTH_INTROSPECT_WINDOW": "60000",
        "DOCSPACE_SERVER_RATE_LIMITS_OAUTH_REGISTER_CAPACITY": "10",
        "DOCSPACE_SERVER_RATE_LIMITS_OAUTH_REGISTER_WINDOW": "60000",
        "DOCSPACE_SERVER_RATE_LIMITS_OAUTH_REVOKE_CAPACITY": "10",
        "DOCSPACE_SERVER_RATE_LIMITS_OAUTH_REVOKE_WINDOW": "60000",
        "DOCSPACE_SERVER_RATE_LIMITS_OAUTH_TOKEN_CAPACITY": "10",
        "DOCSPACE_SERVER_RATE_LIMITS_OAUTH_TOKEN_WINDOW": "60000",
        "DOCSPACE_REQUEST_QUERY": "true",
        "DOCSPACE_REQUEST_AUTHORIZATION_HEADER": "true",
        "DOCSPACE_REQUEST_HEADER_PREFIX": "x-mcp-"
      }
    }
  }
}

Verdict API

curl -s mcpindex.ai/api/v1/trust/server/io-github-onlyoffice-docspace

Free-tier verdict as JSON: decision + dimensions + severity. Call it from your agent before it invokes a tool it just discovered.

Details

version: v3.2.0
category: Documents & Spreadsheets
quality: 81 / 100
operator: ONLYOFFICE

Provenance

Verdict history is anchored to Bitcoin via OpenTimestamps. The free tier returns the current verdict only; the anchored record is served on the authenticated tier.

Links

Repository →Website →Remote endpoint →