# docs-index: a self-hosted, zero-ingress docs-retrieval MCP service

Self-hosted example of MCP retrieval service. With a provided AWS account everything ends up running in that same place,
no queries no internet access. Entirely self-contained and all of the infrastructure is owned by the customer. 
**no public ingress**: no load balancer, no public IPs, a security group with zero ingress rules. TLS terminates at Cloudflare's edge; a Cloudflare Tunnel dials *out* from the VPC; Cloudflare Access gates every request with a service token.

![demo](docs/img/demo.gif)
## Try it

```bash
claude mcp add --transport http docs-index https://<hostname>/mcp \
  --header "CF-Access-Client-Id: <client-id>" \
  --header "CF-Access-Client-Secret: <client-secret>"
```

Then ask Claude Code:

- *"Using docs-index, how do I add a custom domain to my Mintlify site?"* → cited answer with a deep link into mintlify.com/docs.
- *"Using docs-index, how do I rotate the Access service token?"* → the **internal runbook**, cited to `https://wiki.internal/…` — a page that exists nowhere on the public internet. This is the private-corpus story: the same index serves docs an enterprise would never upload to a shared service (`corpus/*.md`, same format, baked into the same image).
- *"Using docs-index, how do I configure Terragrunt remote_state?"* → `No indexed documentation for that query. Indexed products: anthropic, fastmcp, internal, mintlify, resend.` Matching is lexical (FTS5 + BM25), so the refusal fires when the query's terminology is absent from the corpus.

## Deploy your own

```bash
uv venv && uv pip install -e .
docs-index up
```

`up` runs the whole thing: checks prerequisites, prompts for a Cloudflare API token
and a hostname, discovers the account, zone and Zero Trust team from the API, creates
the registry, builds and pushes the image, applies the stack, then verifies that an
authenticated request answers *and* an anonymous one is refused.

Needs `tofu` (or `terraform`), `aws`, and `docker`, an AWS account, and a Cloudflare
zone with Zero Trust enabled. Token scopes are listed in `terraform.tfvars.example`.

## Scope boundary

This is just the *retrieval* layer of a docs platform and it is by no means a complete docs platform.
I am aiming to show how I would package it for a customer.