Knowledge MCP

A self-hostable MCP server that exposes your Google Drive, Slack, GitHub and Railway to any MCP client (Claude Desktop, Claude web connectors, IDEs, …) — with semantic search, per-user permissions, and optional OAuth. You bring the credentials and a small config; everything about what to look at is yours.

Tools

Every tool group is gated by its credentials: a group you don't configure simply isn't offered to the client, so the model never tries a tool that can't work.

Related MCP server: brkt-gdrive-mcp

How configuration works

Two layers, kept separate on purpose:

• Secrets → environment variables (.env locally, host env vars in prod). See .env.example.

• What to look at → mcp.config.json (Drive folder IDs, Qdrant collection, Supabase schema, domains, branding). See mcp.config.example.json.

Config resolution order: MCP_CONFIG_JSON (inline env) → MCP_CONFIG_PATH (file) → ./mcp.config.json → built-in neutral defaults.

Quick start

# 1) Install
npm install

# 2) Configure
cp .env.example .env                       # fill in credentials
cp mcp.config.example.json mcp.config.json # set your Drive folder IDs, domains, etc.

# 3) Prepare Supabase
#    Run sql/setup.sql in your Supabase project, then provision an admin key:
#    insert into public.mcp_keys (key_hash, org_id, role, email)
#    values (encode(digest('YOUR_RAW_KEY','sha256'),'hex'), 'acme', 'admin', 'you@acme.com');

# 4) Index your Drive (for semantic_search_drive)
npm run reindex

# 5) Run
npm run dev            # local (stdio or http per MCP_TRANSPORT)
# or build + start
npm run build && npm start

Point your MCP client at https://<your-host>/mcp with Authorization: Bearer <your key>.

Deploy

The repo ships a Dockerfile and railway.toml. Any container host works (Railway, Fly, a VPS). The host injects PORT; the server listens on it. Set your env vars (and either MCP_CONFIG_JSON or commit-free mcp.config.json) in the host, then deploy.

⚠️ In-memory sessions assume a single replica. For multiple replicas you'd need sticky routing and a shared session store.

OAuth (optional)

Set the MCP_OAUTH_* / OAUTH_* env vars to turn on a built-in OAuth 2.1 Authorization Server that bridges login to Google Workspace and issues its own tokens — this is what lets Claude's custom web connectors sign users in. Without it, the server uses Bearer API keys only. See OAUTH_SETUP.md.

Security notes

• Never commit google-service-account.json or .env (both are gitignored).

• API keys are stored hashed (validate_mcp_key), support revoke/expiry, and are rate-limited.

• Per-user roles and resource scopes come from app_users; unregistered users are viewer.

• The server is fail-open for reads and never mutates your source systems (Slack/GitHub/Railway access is read-only; Drive is read + index only).

License

MIT © chanthr