# Docsmith Mcp

> MCP server exposing semantic search, knowledge graph queries, and keyword search over DocSmith document collections

- **Type:** MCP server
- **Install:** `agentstack add mcp-heitor-am-docsmith-mcp`
- **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior
- **Seller:** [heitor-am](https://agentstack.voostack.com/s/heitor-am)
- **Installs:** 0
- **Category:** [Databases](https://agentstack.voostack.com/c/databases)
- **Latest version:** 0.1.0
- **License:** MIT
- **Upstream author:** [heitor-am](https://github.com/heitor-am)
- **Source:** https://github.com/heitor-am/docsmith-mcp

## Install

```sh
agentstack add mcp-heitor-am-docsmith-mcp
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

# DocSmith MCP Server

Remote, authenticated, multi-tenant MCP server exposing DocSmith's semantic
search and knowledge graph to any MCP client (Claude Code, Claude Desktop,
Codex, MCP Inspector).

## Authentication

Every request must carry your DocSmith tenant API key as a bearer token:

```
Authorization: Bearer sk-your-docsmith-api-key
```

The server forwards it to the DocSmith backend (`X-API-Key`), so you can only
ever see your own tenant's collections. **Always connect over HTTPS in
production** — the token is a bearer secret.

## Connecting

**Claude Code:**

```bash
claude mcp add --transport http docsmith https://your-host/mcp \
  --header "Authorization: Bearer sk-your-docsmith-api-key"
```

**Claude Desktop:** Settings → Connectors → Add custom connector →
URL `https://your-host/mcp`, header `Authorization: Bearer sk-...`.

**MCP Inspector (local dev):**

```bash
npx @modelcontextprotocol/inspector --cli http://localhost:8005/mcp \
  --transport http --header "Authorization: Bearer sk-..." --method tools/list
```

> **Note:** the server redirects `/mcp` → `/mcp/` (HTTP 307) before authentication.
> Claude Code, Claude Desktop, and other fetch-based clients follow it transparently;
> if your client does not auto-follow POST redirects (e.g. raw `httpx`), connect to
> the trailing-slash URL `https://your-host/mcp/` directly.

## Tools

| Tool | Purpose |
|------|---------|
| `list_collections` | Discover your collections (call this first) |
| `semantic_search` | Grounded retrieval with citations (vanilla/hyde/query_fusion, filters, rerank) |
| `keyword_search` | Exact text matching |
| `graph_query` | Raw read-only Cypher (escape hatch) |
| `resolve_entity` | Name fragment → canonical entities (investigation entry point) |
| `entity_dossier` | Everything about one entity: relations, sources, aliases |
| `entity_timeline` | Mentions ordered by document date |
| `relationship_paths` | How two entities connect (multi-hop + shared documents) |

All tools accept `collection` (name or UUID); it defaults when your tenant has
exactly one collection.

## Rate limits

Per tenant: 60 tool calls/minute (burst 60) and 5000/day by default
(`RATE_LIMIT_PER_MINUTE`, `QUOTA_PER_DAY`).

## Running

```bash
uv sync
uv run uvicorn server:app --host 0.0.0.0 --port 8005     # dev
# or from the docsmith repo:
docker compose up -d --build mcp
```

| Variable | Default | Description |
|----------|---------|-------------|
| `DOCSMITH_URL` | `http://localhost:8004` | DocSmith API base URL |
| `REDIS_URL` | `redis://localhost:6379/1` | Rate-limit store |
| `RATE_LIMIT_PER_MINUTE` | `60` | Per-tenant token bucket |
| `QUOTA_PER_DAY` | `5000` | Per-tenant daily quota |
| `COLLECTIONS_CACHE_TTL_SECONDS` | `300` | Collections cache TTL |

## Production TLS

Terminate TLS at a reverse proxy and keep `/metrics` internal. Caddy example:

```
mcp.example.com {
    reverse_proxy /mcp* localhost:8005
    reverse_proxy /healthz localhost:8005
}
```

## Source & license

This open-source MCP server is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [heitor-am](https://github.com/heitor-am)
- **Source:** [heitor-am/docsmith-mcp](https://github.com/heitor-am/docsmith-mcp)
- **License:** MIT

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** yes
- **Filesystem access:** no
- **Shell / process execution:** no
- **Environment & secrets:** no
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: passed — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/mcp-heitor-am-docsmith-mcp
- Seller: https://agentstack.voostack.com/s/heitor-am
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.