1.2.3

Fixed

• Cursor still could not finish signing in: its https callback redirects
  again, and browsers check the consent page's form-action at every
  redirect after the form post, so the answer was blocked. Every app now gets
  the answer on a page that opens its callback, and the consent page allows
  form posts to this server only.

Image: ghcr.io/bbik52/docmost-mcp-remote:1.2.3

1.2.2

Fixed

• Desktop apps that receive the answer on their own URL scheme, such as
  Cursor (cursor://), were not always opened after "Allow": the browser
  stayed on the consent page and a second click said the request had expired.
  The server now answers with a page that opens the app and has a link to
  open it by hand. Web apps and loopback addresses still get a redirect.
• The RFC 8707 resource sent by an app is compared by origin and path, so
  a trailing slash, the default port or an uppercase host no longer cause
  invalid_target. When an app was given the server's base URL instead of
  the MCP URL, the error now names the URL to use.

Image: ghcr.io/bbik52/docmost-mcp-remote:1.2.2

1.2.1

Security

• GitHub Actions are pinned to commit SHAs and the base images to digests.
  CI scans the image with Trivy and fails on fixable critical or high
  vulnerabilities, and the published image is scanned every week.
• The image no longer ships pip, whose vendored msgpack, urllib3 and
  setuptools had known vulnerabilities; the server never used it.
• Titles and names from Docmost (pages, spaces, people, groups, labels),
  which reach the model outside the untrusted-content wrapper, lose control,
  bidi and other hidden characters and are cut at 300 characters
  (descriptions at 1000). The notice for the model now names them.
• "Sign out everywhere" on the account page ends the member's account page
  sessions in every browser, on the server, not only by deleting the cookie.
• Personal tokens can expire: 7, 30, 90 or 365 days, or never. New tokens
  expire after 90 days unless the member picks another lifetime, and the
  account page shows when each one expires. Tokens made before keep working
  without an expiry.
• The client address used for rate limits can no longer be chosen by the
  client: the compose file trusts X-Forwarded-For only from proxies on
  loopback and private networks instead of from everyone, the nginx example
  overwrites the header, and the server warns at startup about
  FORWARDED_ALLOW_IPS=*.
• Dynamic client registration can no longer be locked by filling it: only
  clients without a grant count against the limit of 1000, the oldest of them
  whose consent request has expired make room for new ones, and unused
  clients are deleted after an hour instead of a day.
• Upload links refuse bodies without a Content-Length (411) and Done
  requests over 64 KB, so a link holder cannot stream unbounded data into
  the server's temporary storage.
• move_page_to_space and duplicate_page into another space ask the person
  first, like trash_page: both widen who can read the page, which text in a
  page could otherwise talk a model into.
• A client that declares MCP elicitation but fails to ask no longer gets the
  change made anyway. The request state of a 2026-07-28 confirmation is an
  HMAC of the grant, the tool, its arguments and the question.
• Removing an email from ALLOWED_EMAILS now takes effect at once for that
  member's tokens, refresh tokens, web session and links, not only at the
  next sign-in.
• Revoking a grant ends the download and upload links it made. Upload links
  made before this release stop working.
• restore_page checks ALLOWED_SPACES before restoring, not after.
• Docmost below 0.80.1 is refused, at sign-in and on every tool call. Older
  releases let replace_page_json store javascript: URLs in attachment
  nodes (CVE-2026-34212, fixed in 0.71.0) and export_page pull restricted
  attachments in by a forged id (CVE-2026-48073, fixed in 0.80.1).
• An email outside ALLOWED_EMAILS is refused after the Docmost sign-in
  with the same error as a wrong password, so the answer and its timing no
  longer tell which emails are allowed.
• Files sent to upload links get their type from the file extension, not
  from the browser or the model. HTML, JavaScript, XML and Flash are stored
  as downloads, so a file cannot run as a page on the Docmost domain.

Upgrade notes

• If you set FORWARDED_ALLOW_IPS=* yourself, replace it with the address of
  your reverse proxy, and make nginx send X-Forwarded-For $remote_addr.
• Docmost 0.80.1 or newer is required. Upgrade Docmost first: on an older
  Docmost, members who are already signed in get an error on every tool call.
• Personal tokens created from now on expire after 90 days unless another
  lifetime is picked. Scripts that need a lasting token should pick "never"
  and keep the token safe.

Image: ghcr.io/bbik52/docmost-mcp-remote:1.2.1

1.2.0

Added

• MCP resources: docmost://spaces and docmost://pages/{page}, a page as
  Markdown with its place and link, for clients that let people attach
  resources. While a title is typed, argument completion offers the member's
  matching pages, and spaces for space arguments.
• MCP prompts: summarize_page, summarize_space, answer_from_wiki and
  whats_new, and with the write scope draft_page and tidy_page, which
  ask for confirmation before writing.
• check_space_health: a health check of one space with pages not updated
  for a given number of days, empty and untitled pages, pages sharing a title,
  links and @-mentions to pages that are gone or in Trash, and who updated
  most pages.
• Workspace people, with the admin scope: create_group, update_group,
  add_group_members, invite_people, resend_invitation,
  revoke_invitation, change_workspace_role, deactivate_member and
  activate_member; and with read, list_group_members and
  list_invitations. Nothing removes people or deletes groups.
• Risky changes ask the person in their client first, where the client
  supports MCP elicitation, in both the handshake-era and the 2026-07-28
  protocol: trash_page, add_space_members, change_space_member_role,
  invite_people, change_workspace_role and deactivate_member. Clients
  that cannot ask are not blocked.
• add_comment can @-mention people, given by email, name or id; Docmost
  notifies them.
• create_upload_link: a one-time link where the person drops files into a
  page from the browser, with progress, several files at once and a chosen
  order, or the assistant sends them with curl, without spending tokens.
  Files wait on this server, encrypted, until Done is pressed, and are deleted
  when the link expires (UPLOAD_RETENTION_MINUTES, default 60;
  UPLOAD_MAX_MB, default 50). get_upload_status reports what happened.
• upload_attachment and upload links can put files at the end of a section
  (after_heading) or after a paragraph (after_text), not only at the end.
• docmost-mcp-remote --tool-catalog lists the tools, resources and prompts
  over stdio without Docmost, a database or configuration, for MCP
  directories such as Glama, which start a server to see what it offers.
  glama.json names the maintainer there.
• Pages can also be given as the last part of their URL
  (getting-started-a1B2c3D4e5).

Changed

• README, in English and Russian: highlights, a comparison with other Docmost
  MCP servers, tools grouped and numbered, client setup in collapsible
  sections, the safety features in one place, and the diagram as an image so
  that it shows on PyPI and in MCP directories too. Issue forms for bug
  reports and feature requests.
• README: screenshots show the admin scope; the download links, the
  WEB_SESSION_HOURS setting and the Docmost version list_attachments
  needs are documented.
• Writes that rewrite a whole page body (update_page replace,
  replace_section, replace_page_json, restore_snapshot,
  restore_page_version, upload_attachment adding the file) are refused
  while someone else is editing the page: when another person saved it less
  than a minute ago. Appending and prepending still work.
• The admin scope is described as managing spaces, groups and people on the
  consent and account pages; screenshots updated.
• Resource reads share the tool call rate limit and are written to the audit
  log as read_resource.

Image: ghcr.io/bbik52/docmost-mcp-remote:1.2.0

1.1.0

Added

• whoami returns account_url, the page where a member sees and revokes
  connected apps and tokens.
• get_space: details of one space, with its member count and your role.
• duplicate_page: copy a page with its child pages, in the same space or
  into another space.
• move_page_to_space: move a page with its child pages to another space.
• update_comment: change the text of one of your own comments; the
  previous text is returned.
• get_page_outline, get_section and replace_section: read and change
  one section of a long page. replace_section takes the section's hash
  from get_section and refuses to write if the section changed since, and
  warns when Docmost's Markdown conversion also changed text elsewhere.
• update_page and replace_section take dry_run to show the change as a
  diff without writing it.
• list_page_history, get_page_version and diff_page: the versions
  Docmost saves of a page, read as Markdown, and a diff between the current
  body, a version and a snapshot. Versions are stored by Docmost as
  ProseMirror JSON; the server converts them to Markdown laid out like
  Docmost's own.
• list_backlinks, list_labels, find_pages_by_label, add_labels and
  remove_label (Docmost 0.90 or newer).
• search takes title_only and labels (Docmost 0.96 or newer) and
  created_by_me.
• Links to pages of the same Docmost in Markdown written by the server are
  stored as internal links, so Docmost counts them as backlinks.
• suggest: quick lookup of pages, people and groups by name, as Docmost's
  search box does.
• get_page_tree: several levels of a page tree in one call, limited by
  depth and page count; branches not read are listed to continue from.
• list_space_members, list_workspace_members and list_groups.
• A new admin scope, never granted unless ticked, for create_space,
  update_space, add_space_members (users by email, groups by name) and
  change_space_member_role. Docmost still checks the member's own rights.
  With ALLOWED_SPACES set, only spaces in that list can be created or
  renamed to. Removing members and deleting spaces are not offered.
• get_page takes format="json" to return the body as Docmost's
  ProseMirror JSON, with colors, merged cells, columns, diagrams and
  mentions that Markdown loses.
• replace_page_json: replace a page body with a ProseMirror document. It is
  checked against Docmost's editor schema before it is sent, because Docmost
  silently drops what it cannot read; if what Docmost stored differs from
  what was sent, the previous body is put back. Snapshots taken before such
  a write hold JSON, so restore_snapshot brings the formatting back too.
• get_page and get_page_outline list in markdown_loses the formatting of
  a page that Markdown cannot hold (found by a Markdown round trip on Docmost
  0.97: colors, highlights, underline, alignment, merged or colored cells,
  columns, tabs, mentions, embeds, diagrams, files). update_page replace and
  replace_section refuse to remove it unless drop_formatting is set, and
  point to replace_page_json instead.
• restore_page_version: put a page body back to a version from
  list_page_history, exactly as Docmost saved it.
• export_page and export_space: Docmost's own Markdown or HTML export. A
  single page comes back in the result; a zip (a page with its children or
  files, a whole space) as a download link to this server, valid for ten
  minutes and bound to the member, which streams the file from Docmost and
  stores nothing.
• list_attachments (Docmost 0.96 or newer), get_attachment (with a
  download link, and the text of small text files) and upload_attachment
  (base64, up to 10 MB), which by default adds the file at the end of the
  page as an image or a file block.
• Tools that need a newer Docmost than the connected one say so instead of
  failing with a Docmost error.

Changed

• README: a note near the top that the project is independent from
  Docmost, Inc. and that Docmost is their trademark.

Fixed

• The account and consent pages leave space between the scopes box and the
  button below it.

Image: ghcr.io/bbik52/docmost-mcp-remote:1.1.0

1.0.2

Changed

• README: badges, a diagram of how the server fits between AI clients and
  Docmost, and screenshots of the consent and account pages.
• Dependabot opens its pull requests against develop; the CI and release
  workflows use actions/checkout v7.
• SECURITY.md states the supported versions without naming a release number.
• README.ru.md is now a full translation of README.md, and both link to
  each other at the top.

Image: ghcr.io/bbik52/docmost-mcp-remote:1.0.2

1.0.1

Fixed

• Sign-in failed with an internal error when Docmost did not report its
  version. Docmost's version endpoint answers with an empty body when its own
  request to the GitHub API fails, for example when rate limited; the server
  now logs a warning and treats the version as unknown.
• The release workflow could not publish to the MCP Registry because an
  action reference did not resolve; 1.0.0 is therefore not in the registry.

Image: ghcr.io/bbik52/docmost-mcp-remote:1.0.1

1.0.0

First release.

Added

• Remote MCP server (streamable HTTP at /mcp) for Docmost Community Edition
  0.70.0 or newer.
• Per-member sign-in with the member's own Docmost account; every tool call
  runs as that member with their Docmost rights. Optional ALLOWED_EMAILS
  and ALLOWED_SPACES limits.
• OAuth 2.1 authorization server following the MCP authorization spec:
  dynamic client registration, PKCE (S256), consent page with read,
  write and delete scopes, resource-bound tokens, rotating refresh tokens
  with reuse detection. Personal bearer tokens for scripts. Grants and tokens
  are listed and revoked on the account page.
• Read tools: whoami, list_spaces, list_pages, recent_pages,
  get_page (Markdown), search, list_comments, list_trash,
  list_snapshots. Page content is returned inside an untrusted-content
  envelope.
• Write tools: create_page, update_page (append, prepend, replace),
  rename_page, move_page, add_comment, restore_snapshot; delete-scope
  tools trash_page and restore_page. No permanent delete.
• Encrypted snapshot of a page body before every change, kept for
  SNAPSHOT_RETENTION_DAYS; read-back after every write to catch changes
  Docmost did not apply.
• Per-member rate limit (TOOL_CALLS_PER_MINUTE) and an audit log of tool
  calls without content (AUDIT_RETENTION_DAYS).
• admin command line: list members and grants, revoke grants or members,
  disable members, read the audit log, rotate SECRET_KEY.
• Database schema migrations applied at startup under a lock; an older
  server refuses to start on a schema upgraded by a newer one.
• Container image for linux/amd64 and linux/arm64, compose.yaml with
  Postgres, and a PyPI package.

Image: ghcr.io/bbik52/docmost-mcp-remote:1.0.0