Global configuration

All available configuration options for the DocSpace MCP server provided through environment variables, organized by their functional area.

MCP Options

The following options are used to configure the behavior of the MCP server.

DOCSPACE_TRANSPORT

Transport protocol for MCP server communication. The http variant is a composite of sse and streamable-http.

备注

sse is deprecated since MCP 2025-03-26 but remains supported for backward compatibility.

Type	string (union)
Default	stdio
Variants	stdio sse streamable-http http
Attributes	trimmable, case-insensitive

DOCSPACE_DYNAMIC

Enables meta tools for dynamic tool selection. Complementary to DOCSPACE_TOOLSETS, DOCSPACE_ENABLED_TOOLS, and DOCSPACE_DISABLED_TOOLS.

Type	boolean
Default	0 (false)
True	yes y true 1
False	no n false 0
Attributes	trimmable, case-insensitive
Transports	all

DOCSPACE_TOOLSETS

Comma-separated list of toolsets to enable. Use all to include every available tool.

Type	comma-separated list
Default	all
Example	files,people
Attributes	trimmable, case-insensitive
Transports	all

DOCSPACE_ENABLED_TOOLS

Comma-separated list of tools to explicitly enable.

Type	comma-separated list
Example	get_file_info,get_all_people
Attributes	trimmable, case-insensitive
Transports	all

DOCSPACE_DISABLED_TOOLS

Comma-separated list of tools to explicitly disable.

Type	comma-separated list
Example	get_file_info,get_all_people
Attributes	trimmable, case-insensitive
Transports	all

DOCSPACE_SESSION_TTL

TTL for HTTP sessions in milliseconds. Set to 0 to disable session expiration.

Type	number
Default	28800000 (8 hours)
Minimum	0
Attributes	trimmable
Transports	sse streamable-http http

DOCSPACE_SESSION_INTERVAL

Interval for checking HTTP sessions for expiration in milliseconds. Set to 0 to disable session cleanup entirely.

Type	number
Default	240000 (4 minutes)
Minimum	0
Attributes	trimmable
Transports	sse streamable-http http

API Options

The following options are used to configure the behavior for API requests.

DOCSPACE_USER_AGENT

User agent sent in the User-Agent header for API requests.

Type	string
Default	@onlyoffice/docspace-mcp v3.1.0
Attributes	trimmable
Transports	all

DOCSPACE_BASE_URL

Base URL of the DocSpace instance for API requests. Must use HTTP or HTTPS with no search parameters or hash fragments. Required if any authentication option is set.

Type	url
Example	https://your-instance.onlyoffice.com/
Attributes	trimmable
Transports	all

DOCSPACE_AUTHORIZATION

Raw value sent in the Authorization header for API requests. Required for stdio if no other authentication option is set. Mutually exclusive with all other authentication options on HTTP transports.

Type	string
Example	Bearer sk-a499e...
Attributes	sensitive, trimmable
Transports	all

DOCSPACE_API_KEY

Raw value sent in the Authorization header for API requests.

This option is required if DOCSPACE_TRANSPORT is set to stdio and neither DOCSPACE_AUTHORIZATION, DOCSPACE_AUTH_TOKEN, nor the DOCSPACE_USERNAME/DOCSPACE_PASSWORD pair is set.

This option is mutually exclusive with DOCSPACE_AUTHORIZATION, DOCSPACE_AUTH_TOKEN, the DOCSPACE_USERNAME/DOCSPACE_PASSWORD pair, and the DOCSPACE_OAUTH_CLIENT_ID/DOCSPACE_OAUTH_CLIENT_SECRET pair if DOCSPACE_TRANSPORT is set to sse, streamable-http, or http.

Type	string
Example	Bearer sk-a499e...
Attributes	sensitive, trimmable
Transports	all

DOCSPACE_AUTH_TOKEN

Personal Access Token (PAT) for accessing the API. Required for stdio if no other authentication option is set. Mutually exclusive with all other authentication options on HTTP transports.

Type	string
Example	Fe4Hrgl6...
Attributes	sensitive, trimmable
Transports	all

DOCSPACE_USERNAME

Username for basic authentication. Used together with DOCSPACE_PASSWORD. Required for stdio if no other authentication option is set. Mutually exclusive with all other authentication options on HTTP transports.

Type	string
Example	henry.milton@onlyoffice.com
Attributes	sensitive, trimmable
Transports	all

DOCSPACE_PASSWORD

Password for basic authentication. Used together with DOCSPACE_USERNAME. This option is used in conjunction with DOCSPACE_USERNAME.

This option is required if DOCSPACE_TRANSPORT is set to stdio and neither DOCSPACE_AUTHORIZATION, DOCSPACE_API_KEY, nor DOCSPACE_AUTH_TOKEN is set.

This option is mutually exclusive with DOCSPACE_AUTHORIZATION, DOCSPACE_API_KEY, DOCSPACE_AUTH_TOKEN, and the DOCSPACE_OAUTH_CLIENT_ID/DOCSPACE_OAUTH_CLIENT_SECRET pair if DOCSPACE_TRANSPORT is set to sse, streamable-http, or http.

Type	string
Example	ditgor-p...
Attributes	sensitive, trimmable
Transports	all

DOCSPACE_OAUTH_BASE_URL

Base URL of the DocSpace OAuth service. Must use HTTP or HTTPS with no search parameters or hash fragments. Set to an empty string to disable OAuth authentication.

Type	url
Example	https://oauth-instance.onlyoffice.com/
Attributes	trimmable
Transports	sse streamable-http http

DOCSPACE_OAUTH_CLIENT_ID

Client ID of the OAuth application. Used together with DOCSPACE_OAUTH_CLIENT_SECRET. Set to an empty string to disable client registration. This option is mutually exclusive with DOCSPACE_AUTHORIZATION, DOCSPACE_API_KEY, DOCSPACE_AUTH_TOKEN, and the DOCSPACE_USERNAME/DOCSPACE_PASSWORD pair if DOCSPACE_TRANSPORT is set to sse, streamable-http, or http.

Type	string
Example	68cf0a49...
Attributes	trimmable
Transports	sse streamable-http http

DOCSPACE_OAUTH_CLIENT_SECRET

Client secret of the OAuth application. Used together with DOCSPACE_OAUTH_CLIENT_ID. This option is mutually exclusive with DOCSPACE_AUTHORIZATION, DOCSPACE_API_KEY, DOCSPACE_AUTH_TOKEN, and the DOCSPACE_USERNAME/DOCSPACE_PASSWORD pair if DOCSPACE_TRANSPORT is set to sse, streamable-http, or http.

Type	string
Example	vEHLGi5...
Attributes	sensitive, trimmable
Transports	sse streamable-http http

OAuth Options

The following options are used to configure the behavior of the OAuth server.

DOCSPACE_OAUTH_AUTH_TOKEN_ALGORITHM

Algorithm for signing OAuth access tokens. Used together with DOCSPACE_OAUTH_AUTH_TOKEN_SECRET_KEY. Set to an empty string to disable token signing.

Type	string (union)
Default	HS256
Variants	HS256 HS384 HS512
Attributes	trimmable, case-insensitive
Transports	sse streamable-http http

DOCSPACE_OAUTH_AUTH_TOKEN_TTL

TTL for OAuth access tokens in milliseconds. Set to 0 to disable token expiration.

Type	number
Default	3600000 (1 hour)
Minimum	0
Attributes	trimmable
Transports	sse streamable-http http

DOCSPACE_OAUTH_AUTH_TOKEN_SECRET_KEY

Secret key for signing OAuth access tokens. Used together with DOCSPACE_OAUTH_AUTH_TOKEN_ALGORITHM. Set to an empty string to disable token signing.

Type	string
Example	Qynnyd-b...
Attributes	sensitive, trimmable
Transports	sse streamable-http http

DOCSPACE_OAUTH_STATE_TOKEN_ALGORITHM

Algorithm for signing OAuth state tokens. Used together with DOCSPACE_OAUTH_STATE_TOKEN_SECRET_KEY. Set to an empty string to disable state token signing.

Type	string (union)
Default	HS256
Variants	HS256 HS384 HS512
Attributes	trimmable, case-insensitive
Transports	sse streamable-http http

DOCSPACE_OAUTH_STATE_TOKEN_TTL

TTL for OAuth state tokens in milliseconds. Set to 0 to disable token expiration.

Type	number
Default	3600000 (1 hour)
Minimum	0
Attributes	trimmable
Transports	sse streamable-http http

DOCSPACE_OAUTH_STATE_TOKEN_SECRET_KEY

Secret key for signing OAuth state tokens. Used together with DOCSPACE_OAUTH_STATE_TOKEN_ALGORITHM. Set to an empty string to disable state token signing.

Type	string
Example	hoPkun-6...
Attributes	sensitive, trimmable
Transports	sse streamable-http http

Server Options

The following options are used to configure the behavior of the HTTP server.

DOCSPACE_SERVER_BASE_URL

The base URL of the server.

The base URL must use HTTP or HTTPS scheme without search parameters or hash fragments.

This option is required if DOCSPACE_TRANSPORT is set to sse, streamable-http, or http and DOCSPACE_OAUTH_BASE_URL is set.

Type	url
Example	https://mcp.example.com/
Attributes	trimmable
Transports	sse streamable-http http

DOCSPACE_HOST

The host to bind the server to.

This option is required if DOCSPACE_TRANSPORT is set to sse, streamable-http, or http.

Type	string
Default	127.0.0.1
Attributes	trimmable
Transports	sse streamable-http http

DOCSPACE_PORT

The port to bind the server to.

The 0 is a special value that binds the server to a random port.

Type	number
Attributes	trimmable
Minimum	0
Maximum	65535
Default	8080
Transports	sse streamable-http http

DOCSPACE_SERVER_PROXY_HOPS

The number of proxy servers between the server and the client.

The 0 is a special value that indicates no proxy servers are used.

Type	number
Attributes	trimmable
Minimum	0
Default	0
Transports	sse, streamable-http, http

DOCSPACE_SERVER_CORS_MCP_ORIGIN

The list of allowed origins to include in the Access-Control-Allow-Origin header for CORS requests to MCP endpoints (e.g., /sse, /messages, /mcp).

Type	list
Attributes	trimmable
Default	*
Example	https://example.com,https://another-example.com
Transports	sse, streamable-http, http

DOCSPACE_SERVER_CORS_MCP_MAX_AGE

The maximum age in milliseconds to include in the Access-Control-Max-Age header for CORS requests to MCP endpoints (e.g., /sse, /messages, /mcp).

The value 0 is a special value that omits the Access-Control-Max-Age header from the response.

Type	number
Attributes	trimmable
Minimum	0
Default	86400000 (1 day)
Transports	sse, streamable-http, http

DOCSPACE_SERVER_CORS_OAUTH_ORIGIN

The list of allowed origins to include in the Access-Control-Allow-Origin header for CORS requests to OAuth endpoints (e.g., /.well-known/oauth-authorization-server, /oauth/authorize, etc).

Type	list
Attributes	trimmable
Default	*
Example	https://example.com,https://another-example.com
Transports	sse, streamable-http, http

DOCSPACE_SERVER_CORS_OAUTH_MAX_AGE

The maximum age in milliseconds to include in the Access-Control-Max-Age header for CORS requests to OAuth endpoints (e.g., /.well-known/oauth-authorization-server, /oauth/authorize, etc). Set to 0 to omit the header entirely.

Type	number
Default	86400000 (1 day)
Minimum	0
Attributes	trimmable
Transports	sse, streamable-http, http

DOCSPACE_SERVER_RATE_LIMITS_MCP_CAPACITY

Maximum number of requests allowed per window for MCP endpoints (e.g., /sse, /messages, /mcp). Set to 0 to disable the rate limit.

Type	number
Default	1000
Minimum	0
Attributes	trimmable
Transports	sse, streamable-http, http

DOCSPACE_SERVER_RATE_LIMITS_MCP_WINDOW

Time window in milliseconds for the rate limit on MCP endpoints. Set to 0 to disable the rate limit.

Type	number
Default	1000 (1 second)
Minimum	0
Attributes	trimmable
Transports	sse streamable-http http

DOCSPACE_SERVER_RATE_LIMITS_OAUTH_SERVER_METADATA_CAPACITY

The maximum number of requests allowed per window for the OAuth server metadata endpoint (/.well-known/oauth-authorization-server).

The 0 is a special value that disables the rate limit.

Type	number
Default	200
Minimum	0
Attributes	trimmable
Transports	sse, streamable-http, http

DOCSPACE_SERVER_RATE_LIMITS_OAUTH_SERVER_METADATA_WINDOW

The time window in milliseconds for the rate limit for the OAuth server metadata endpoint (/.well-known/oauth-authorization-server).

The 0 is a special value that disables the rate limit.

Type	number
Default	60000 (1 minute)
Minimum	0
Attributes	trimmable
Transports	sse, streamable-http, http

DOCSPACE_SERVER_RATE_LIMITS_OAUTH_RESOURCE_METADATA_CAPACITY

The maximum number of requests allowed per window for the OAuth resource metadata endpoint (/.well-known/oauth-protected-resource).

The 0 is a special value that disables the rate limit.

Type	number
Default	200
Minimum	0
Attributes	trimmable
Transports	sse, streamable-http, http

DOCSPACE_SERVER_RATE_LIMITS_OAUTH_RESOURCE_METADATA_WINDOW

The time window in milliseconds for the rate limit for the OAuth resource metadata endpoint (/.well-known/oauth-protected-resource).

The 0 is a special value that disables the rate limit.

Type	number
Default	60000 (1 minute)
Minimum	0
Attributes	trimmable
Transports	sse, streamable-http, http

DOCSPACE_SERVER_RATE_LIMITS_OAUTH_AUTHORIZE_CAPACITY

The maximum number of requests allowed per window for the OAuth authorization endpoint (/oauth/authorize).

The 0 is a special value that disables the rate limit.

Type	number
Default	200
Minimum	0
Attributes	trimmable
Transports	sse, streamable-http, http

DOCSPACE_SERVER_RATE_LIMITS_OAUTH_AUTHORIZE_WINDOW

The time window in milliseconds for the rate limit for the OAuth authorization endpoint (/oauth/authorize).

The 0 is a special value that disables the rate limit.

Type	number
Default	60000 (1 minute)
Minimum	0
Attributes	trimmable
Transports	sse, streamable-http, http

DOCSPACE_SERVER_RATE_LIMITS_OAUTH_CALLBACK_CAPACITY

The maximum number of requests allowed per window for the OAuth callback endpoint (/oauth/callback).

The 0 is a special value that disables the rate limit.

Type	number
Default	200
Minimum	0
Attributes	trimmable
Transports	sse, streamable-http, http

DOCSPACE_SERVER_RATE_LIMITS_OAUTH_CALLBACK_WINDOW

The time window in milliseconds for the rate limit for the OAuth callback endpoint (/oauth/callback).

The 0 is a special value that disables the rate limit.

Type	number
Default	60000 (1 minute)
Minimum	0
Attributes	trimmable
Transports	sse, streamable-http, http

DOCSPACE_SERVER_RATE_LIMITS_OAUTH_INTROSPECT_CAPACITY

The maximum number of requests allowed per window for the OAuth introspection endpoint (/oauth/introspect).

The 0 is a special value that disables the rate limit.

Type	number
Default	10
Minimum	0
Attributes	trimmable
Transports	sse, streamable-http, http

DOCSPACE_SERVER_RATE_LIMITS_OAUTH_INTROSPECT_WINDOW

The time window in milliseconds for the rate limit for the OAuth introspection endpoint (/oauth/introspect).

The 0 is a special value that disables the rate limit.

Type	number
Default	60000 (1 minute)
Minimum	0
Attributes	trimmable
Transports	sse, streamable-http, http

DOCSPACE_SERVER_RATE_LIMITS_OAUTH_REGISTER_CAPACITY

The maximum number of requests allowed per window for the OAuth client registration endpoint (/oauth/register).

The 0 is a special value that disables the rate limit.

Type	number
Default	10
Minimum	0
Attributes	trimmable
Transports	sse, streamable-http, http

DOCSPACE_SERVER_RATE_LIMITS_OAUTH_REGISTER_WINDOW

The time window in milliseconds for the rate limit for the OAuth client registration endpoint (/oauth/register).

The 0 is a special value that disables the rate limit.

Type	number
Default	60000 (1 minute)
Minimum	0
Attributes	trimmable
Transports	sse, streamable-http, http

DOCSPACE_SERVER_RATE_LIMITS_OAUTH_REVOKE_CAPACITY

The maximum number of requests allowed per window for the OAuth token revocation endpoint (/oauth/revoke).

The 0 is a special value that disables the rate limit.

Type	number
Default	10
Minimum	0
Attributes	trimmable
Transports	sse, streamable-http, http

DOCSPACE_SERVER_RATE_LIMITS_OAUTH_REVOKE_WINDOW

Time window in milliseconds for the rate limit on the OAuth token revocation endpoint (/oauth/revoke). Set to 0 to disable the rate limit.

Type	number
Default	60000 (1 minute)
Minimum	0
Attributes	trimmable
Transports	sse, streamable-http, http

DOCSPACE_SERVER_RATE_LIMITS_OAUTH_TOKEN_CAPACITY

Maximum number of requests allowed per window for the OAuth token endpoint. Set to 0 to disable the rate limit.

Type	number
Default	10
Minimum	0
Attributes	trimmable
Transports	sse, streamable-http, http

DOCSPACE_SERVER_RATE_LIMITS_OAUTH_TOKEN_WINDOW

Time window in milliseconds for the rate limit on the OAuth token endpoint (/oauth/token). Set to 0 to disable the rate limit.

Type	number
Default	60000 (1 minute)
Minimum	0
Attributes	trimmable
Transports	sse, streamable-http, http

Request Options

The following options are used to configure the behavior of incoming requests.

DOCSPACE_REQUEST_QUERY

Controls whether the server accepts configuration via query parameters in incoming requests.

Type	boolean
Default	1 (true)
True	yes y true 1
False	no n false 0
Attributes	trimmable, case-insensitive
Transports	sse, streamable-http, http

DOCSPACE_REQUEST_AUTHORIZATION_HEADER

Controls whether the server checks for the Authorization header in incoming requests.

Type	boolean
Default	1 (true)
True	yes y true 1
False	no n false 0
Attributes	trimmable, case-insensitive
Transports	sse, streamable-http, http

DOCSPACE_REQUEST_HEADER_PREFIX

Prefix for custom configuration headers. Set to an empty string to disable custom configuration headers.

Type	string
Default	x-mcp-
Attributes	trimmable, lowercase
Transports	sse, streamable-http, http

Examples

The following examples demonstrate common configuration scenarios for different use cases and deployment environments.

stdio with API key

This configuration uses the default stdio transport with API key authentication. In this shared authentication model, all requests are associated with the API key owner.

DOCSPACE_BASE_URL=https://your-instance.onlyoffice.com/
DOCSPACE_API_KEY=sk-a499e...

stdio with Custom Tool Selection

This configuration uses the default stdio transport with API key authentication and restricts the available tools to a specific set. In this shared authentication model, all requests are associated with the API key owner.

DOCSPACE_TOOLSETS=files
DOCSPACE_ENABLED_TOOLS=get_all_people
DOCSPACE_DISABLED_TOOLS=delete_file,delete_folder
DOCSPACE_BASE_URL=https://your-instance.onlyoffice.com/
DOCSPACE_API_KEY=sk-a499e...

Local HTTP Server with Meta Tools

This configuration uses HTTP transport with API key authentication and enables meta tools. In this shared authentication model, all requests are associated with the API key owner.

DOCSPACE_TRANSPORT=http
DOCSPACE_DYNAMIC=1
DOCSPACE_BASE_URL=https://your-instance.onlyoffice.com/
DOCSPACE_API_KEY=sk-a499e...

Local HTTP Server with Session Management

This configuration uses HTTP transport with API key authentication and custom session management. It configures shorter session lifetimes and more frequent cleanup intervals. In this shared authentication model, all requests are associated with the API key owner.

DOCSPACE_TRANSPORT=http
DOCSPACE_BASE_URL=https://your-instance.onlyoffice.com/
DOCSPACE_API_KEY=sk-a499e...
DOCSPACE_SESSION_TTL=14400000 # 4 hours
DOCSPACE_SESSION_INTERVAL=120000 # 2 minutes

Network-Accessible HTTP Server with CORS

This configuration uses HTTP transport with API key authentication and custom CORS options. It restricts the allowed origins for CORS requests to a specific set of domains. In this shared authentication model, all requests are associated with the API key owner.

DOCSPACE_TRANSPORT=http
DOCSPACE_BASE_URL=https://your-instance.onlyoffice.com/
DOCSPACE_API_KEY=sk-a499e...
DOCSPACE_HOST=0.0.0.0
DOCSPACE_SERVER_CORS_MCP_ORIGIN=https://example.com,https://another-example.com
DOCSPACE_SERVER_CORS_MCP_MAX_AGE=1800000 # 30 minutes