Back to Browse

Cloudsuite MCP Server

Developer ToolsModerate6.1MCP RegistryLocal
Free

Server data from the Official MCP Registry

Nextcloud from your agent: notes, calendars, contacts, and files over DAV and the Notes API.

About

Nextcloud from your agent: notes, calendars, contacts, and files over DAV and the Notes API.

Security Report

6.1
Moderate6.1Moderate Risk

cloudsuite is a clean, scoped Nextcloud client that requires NEXTCLOUD_URL, NEXTCLOUD_USERNAME and NEXTCLOUD_PASSWORD, sends credentials only to the configured instance over HTTP Basic auth, and uses zod validation with no shell execution, eval, or hardcoded secrets. Its network and file permissions match its stated purpose of managing Notes, calendars, contacts and WebDAV files. Minor items are noted: the calendar listing summary is crude, dtstart/dtend are not format-validated, and the server allows destructive delete operations and writes to remote files that users should be aware of. Supply chain analysis found 3 known vulnerabilities in dependencies (0 critical, 2 high severity). Package verification found 1 issue.

8 files analyzed · 8 issues found

Security scores are indicators to help you make informed decisions, not guarantees. Always review permissions before connecting any MCP server.

Permissions Required

This plugin requests these system permissions. Most are normal for its category.

HTTP Network Access

Connects to external APIs or services over the internet.

env_vars

Check that this permission is expected for this type of plugin.

File System Read

Reads files on your machine. Normal for tools that analyze or process local data.

File System Write

Writes or modifies files on your machine. Check that this is expected for the tool.

What You'll Need

Set these up before or after installing:

NEXTCLOUD_URLRequired
NEXTCLOUD_USERNAMERequired
NEXTCLOUD_PASSWORDRequired

How to Install

Add this to your MCP configuration file:

{
  "mcpServers": {
    "io-github-cloudcorprecords-cloudsuite": {
      "env": {
        "NEXTCLOUD_URL": "your-nextcloud-url-here",
        "NEXTCLOUD_PASSWORD": "your-nextcloud-password-here",
        "NEXTCLOUD_USERNAME": "your-nextcloud-username-here"
      },
      "args": [
        "-y",
        "@reneturcios/cloudsuite"
      ],
      "command": "npx"
    }
  }
}

Documentation

View on GitHub

From the project's GitHub README.

cloudsuite

cloudsuite lets an agent work with a self-hosted Nextcloud instance: search and edit notes, see calendars and create or delete events, list and create contacts, and browse, read, write, and delete files. Notes go through the instance's Notes app API; calendars, contacts, and files go through Nextcloud's CalDAV, CardDAV, and WebDAV endpoints.

This package is a clean-room rebuild, and a labelled core subset: it covers 15 of the 30 tools documented for the original Nextcloud MCP server. The omitted tools are listed under "Scope" below.

How it talks to the service

Every tool needs three environment variables:

export NEXTCLOUD_URL="https://cloud.example.com"   # base URL of the instance
export NEXTCLOUD_USERNAME="alice"
export NEXTCLOUD_PASSWORD="xxxxx-xxxxx-xxxxx-xxxxx"  # an app password

With any of the three missing, every call fails with an error naming the missing variables, before any request is made. Every request carries HTTP Basic auth built from the username and app password.

Wire-format note: the original project's README documents the tools and their purposes; the endpoint shapes here follow Nextcloud's public Notes API and DAV layout. Notes use {NEXTCLOUD_URL}/index.php/apps/notes/api/v1; calendars use CalDAV under {NEXTCLOUD_URL}/remote.php/dav/calendars/{user}/; contacts use CardDAV under {NEXTCLOUD_URL}/remote.php/dav/addressbooks/users/{user}/; files use WebDAV under {NEXTCLOUD_URL}/remote.php/dav/files/{user}/. Path segments are percent-encoded per segment (slashes preserved). DAV status 207 counts as success; any other non-2xx response is reported with its status and a body excerpt. Calendar event listing is a summary only: the REPORT response is reduced to its status, byte count, and the SUMMARY: lines found in it.

Install

npx @reneturcios/cloudsuite nextcloud_webdav_list_directory '{"path":"/"}'

Or run the container image:

docker run -i ghcr.io/cloudcorprecords/cloudsuite

The container defaults to the MCP server. Pass CLI arguments to use it as a CLI instead.

CLI

The CLI mirrors the tools: one subcommand per tool, taking its arguments as a single JSON object.

cloudsuite nextcloud_notes_search_notes '{"query":"shopping"}'
cloudsuite nextcloud_notes_create_note '{"title":"Ideas","content":"..."}'
cloudsuite nextcloud_calendar_list_calendars '{}'
cloudsuite nextcloud_webdav_read_file '{"path":"/Documents/notes.txt"}'
cloudsuite --version

Exit codes: 0 on success, 1 on an API or validation error (the error names the problem), 2 for usage errors.

MCP server

One bin serves both faces. The mcp subcommand starts a stdio MCP server:

npx -y @reneturcios/cloudsuite mcp

MCP client configuration:

{
  "mcpServers": {
    "cloudsuite": {
      "command": "npx",
      "args": ["-y", "@reneturcios/cloudsuite", "mcp"],
      "env": {
        "NEXTCLOUD_URL": "https://cloud.example.com",
        "NEXTCLOUD_USERNAME": "alice",
        "NEXTCLOUD_PASSWORD": "your app password"
      }
    }
  }
}

Tools

ToolInputWhat it does
nextcloud_notes_search_notesquery (required)Fetch all notes and keep those whose title or content contains the query (case-insensitive).
nextcloud_notes_create_notetitle, content (required), categoryCreate a note via the Notes API.
nextcloud_notes_update_noteid (required), title, content, categoryUpdate the provided fields of a note.
nextcloud_notes_append_contentid, content (required)Read the note, then write it back with the new content appended after a newline; the title is preserved.
nextcloud_notes_delete_noteid (required)Delete a note; returns {status, id}.
nextcloud_calendar_list_calendars—PROPFIND the calendars root and return each collection's display name and href.
nextcloud_calendar_create_eventcalendarId, summary, dtstart, dtend (required), description, locationPUT a generated VEVENT as an .ics file into the calendar; returns {status, uid}.
nextcloud_calendar_list_eventscalendarId (required)REPORT a calendar-query and summarize the response: status, bytes, and extracted SUMMARY: lines.
nextcloud_calendar_delete_eventcalendarId, eventId (required)DELETE the event resource.
nextcloud_contacts_list_contactsaddressBookId (required)PROPFIND an address book and return the hrefs it contains.
nextcloud_contacts_create_contactaddressBookId, fullName (required), email, phone, organizationPUT a generated VCARD as a .vcf file into the address book; returns {status, uid}.
nextcloud_webdav_list_directorypath (required)PROPFIND a folder and return each entry's name, href, and whether it is a collection.
nextcloud_webdav_read_filepath (required)GET a file and return its text content and byte count.
nextcloud_webdav_write_filepath, content (required)PUT text content to a file path.
nextcloud_webdav_delete_resourcepath (required)DELETE a file or folder.

Scope

Omitted from this core subset: hello, nextcloud_calendar_get_event, nextcloud_calendar_update_event, nextcloud_contacts_list_addressbooks, nextcloud_contacts_create_addressbook, nextcloud_contacts_delete_addressbook, nextcloud_contacts_delete_contact, all six nextcloud_tables_* tools, nextcloud_webdav_search_files, and nextcloud_webdav_create_directory. The CalDAV/CardDAV wire shapes are minimal reconstructions: there is no recurrence expansion, ETag handling, or timezone processing, and the calendar event listing extraction is intentionally crude. No live Nextcloud instance was used while building this package; behaviour is covered by fake-fetch tests only.

Development

npm install
npm run build   # tsc -> dist/
npm test        # node test runner over test/*.test.ts, fake fetch only, no network
npm run dev     # run the CLI from source via tsx

License

MIT — see LICENSE.

Reviews

No reviews yet

Be the first to review this server!