docs-index: a self-hosted, zero-ingress docs-retrieval MCP service

Self-hosted example of MCP retrieval service. With a provided AWS account everything ends up running in that same place, no queries no internet access. Entirely self-contained and all of the infrastructure is owned by the customer. no public ingress: no load balancer, no public IPs, a security group with zero ingress rules. TLS terminates at Cloudflare's edge; a Cloudflare Tunnel dials out from the VPC; Cloudflare Access gates every request with a service token.

Try it

claude mcp add --transport http docs-index https://<hostname>/mcp \
  --header "CF-Access-Client-Id: <client-id>" \
  --header "CF-Access-Client-Secret: <client-secret>"

Then ask Claude Code:

• "Using docs-index, how do I add a custom domain to my Mintlify site?" → cited answer with a deep link into mintlify.com/docs.

• "Using docs-index, how do I rotate the Access service token?" → the internal runbook, cited to https://wiki.internal/… — a page that exists nowhere on the public internet. This is the private-corpus story: the same index serves docs an enterprise would never upload to a shared service (corpus/*.md, same format, baked into the same image).

• "Using docs-index, how do I configure Terragrunt remote_state?" → No indexed documentation for that query. Indexed products: anthropic, fastmcp, internal, mintlify, resend. Matching is lexical (FTS5 + BM25), so the refusal fires when the query's terminology is absent from the corpus.

Related MCP server: MCPDocSearch

Deploy your own

uv venv && uv pip install -e .
docs-index up

up runs the whole thing: checks prerequisites, prompts for a Cloudflare API token and a hostname, discovers the account, zone and Zero Trust team from the API, creates the registry, builds and pushes the image, applies the stack, then verifies that an authenticated request answers and an anonymous one is refused.

Needs tofu (or terraform), aws, and docker, an AWS account, and a Cloudflare zone with Zero Trust enabled. Token scopes are listed in terraform.tfvars.example.

Scope boundary

This is just the retrieval layer of a docs platform and it is by no means a complete docs platform. I am aiming to show how I would package it for a customer.