Install
$ agentstack add mcp-heitor-am-docsmith-mcp ✓ scanned · ✓ verified — works with Claude Code, Cursor, and more.
Security review
✓ PassedNo issues found. Passed automated security review. · v0.1.0 How review works →
- ✓ Prompt-injection patterns
- ✓ Secret / credential exfiltration
- ✓ Dangerous shell & filesystem operations
- ✓ Untrusted network calls
- ✓ Known-malicious package signatures
What it can access
- ● Network access Used
- ✓ Filesystem access No
- ✓ Shell / process execution No
- ✓ Environment & secrets No
- ✓ Dynamic code execution No
From automated source analysis of v0.1.0. “Used” means the capability is present in the source — more access means more to trust, not that it’s unsafe.
About
DocSmith MCP Server
Remote, authenticated, multi-tenant MCP server exposing DocSmith's semantic search and knowledge graph to any MCP client (Claude Code, Claude Desktop, Codex, MCP Inspector).
Authentication
Every request must carry your DocSmith tenant API key as a bearer token:
Authorization: Bearer sk-your-docsmith-api-key
The server forwards it to the DocSmith backend (X-API-Key), so you can only ever see your own tenant's collections. Always connect over HTTPS in production — the token is a bearer secret.
Connecting
Claude Code:
claude mcp add --transport http docsmith https://your-host/mcp \
--header "Authorization: Bearer sk-your-docsmith-api-key"
Claude Desktop: Settings → Connectors → Add custom connector → URL https://your-host/mcp, header Authorization: Bearer sk-....
MCP Inspector (local dev):
npx @modelcontextprotocol/inspector --cli http://localhost:8005/mcp \
--transport http --header "Authorization: Bearer sk-..." --method tools/list
> Note: the server redirects /mcp → /mcp/ (HTTP 307) before authentication. > Claude Code, Claude Desktop, and other fetch-based clients follow it transparently; > if your client does not auto-follow POST redirects (e.g. raw httpx), connect to > the trailing-slash URL https://your-host/mcp/ directly.
Tools
| Tool | Purpose | |------|---------| | list_collections | Discover your collections (call this first) | | semantic_search | Grounded retrieval with citations (vanilla/hyde/query_fusion, filters, rerank) | | keyword_search | Exact text matching | | graph_query | Raw read-only Cypher (escape hatch) | | resolve_entity | Name fragment → canonical entities (investigation entry point) | | entity_dossier | Everything about one entity: relations, sources, aliases | | entity_timeline | Mentions ordered by document date | | relationship_paths | How two entities connect (multi-hop + shared documents) |
All tools accept collection (name or UUID); it defaults when your tenant has exactly one collection.
Rate limits
Per tenant: 60 tool calls/minute (burst 60) and 5000/day by default (RATE_LIMIT_PER_MINUTE, QUOTA_PER_DAY).
Running
uv sync
uv run uvicorn server:app --host 0.0.0.0 --port 8005 # dev
# or from the docsmith repo:
docker compose up -d --build mcp
| Variable | Default | Description | |----------|---------|-------------| | DOCSMITH_URL | http://localhost:8004 | DocSmith API base URL | | REDIS_URL | redis://localhost:6379/1 | Rate-limit store | | RATE_LIMIT_PER_MINUTE | 60 | Per-tenant token bucket | | QUOTA_PER_DAY | 5000 | Per-tenant daily quota | | COLLECTIONS_CACHE_TTL_SECONDS | 300 | Collections cache TTL |
Production TLS
Terminate TLS at a reverse proxy and keep /metrics internal. Caddy example:
mcp.example.com {
reverse_proxy /mcp* localhost:8005
reverse_proxy /healthz localhost:8005
}
Source & license
This open-source MCP server is cataloged on AgentStack and links to its original source — we do not rehost the code.
- Author: heitor-am
- Source: heitor-am/docsmith-mcp
- License: MIT
Install and usage instructions live in the source repository linked above.
Reviews
No reviews yet — be the first.
Write a review
Versions
- v0.1.0 Imported from the upstream source.