Skip to main content
Glama
megamaced

passwords-mcp

by megamaced

passwords-mcp

A Model Context Protocol server for the Nextcloud Passwords app. It lets Claude and other MCP-compatible clients read and manage entries in your Nextcloud password vault β€” listing/searching by metadata, revealing a single secret on request, and creating, updating, and (reversibly) deleting and restoring passwords and folders.

⚠️ This project is 100% AI-written. All source code, tests, CI configuration, and this documentation were written by AI (Claude). Review it yourself before pointing it at a real password vault. It is provided as-is, with no warranty (see LICENSE).

πŸ”“ Requires client-side encryption (CSE) to be OFF. This server only works with accounts where the Passwords app's client-side (end-to-end) encryption is disabled. See Encryption requirement below.

Security model

This is a password-manager bridge, so it is built defensively even though it can now write:

  • Reads never bulk-expose secrets. list_passwords and search_passwords return metadata only (label, username, URL, folder, timestamps). The plaintext secret, notes, and custom fields are stripped at a single choke point (toPasswordMeta). Only get_password, called with one specific id, ever returns a secret. Folder results pass through the equivalent toFolderMeta allowlist.

  • Search ignores secrets. Searching matches on label / username / URL only β€” never on the password, notes, or custom fields.

  • Deletes are soft and reversible. delete_password / delete_folder move items to the trash. They first fetch the item and refuse if it is already trashed, so this server can never permanently delete anything β€” empty the trash from the Passwords app if you really mean it. restore_password / restore_folder are the undo; they only lift an item out of the trash and never roll an entry back to an older revision.

  • Updates never blank data. update_password fetches the current entry, merges only the fields you passed, and sends the current revision β€” so an edit can't silently wipe fields, and the server rejects the write if the entry changed underneath it. This includes fields the API would otherwise reset to their defaults: hidden on passwords, and hidden + favorite on folders, are carried across every update.

  • Writes are never retried automatically. A 5xx or a network failure on a create/update/delete proves nothing about whether the server applied it, so the tool reports an explicit unknown-outcome error instead of replaying the request β€” a retried create would duplicate an entry, and a retried revision-guarded write would report a false conflict. Reads are still retried with capped, jittered backoff.

  • Optional read-only mode. Set PASSWORDS_READONLY=true to drop all eight write tools from the tool list and refuse them at dispatch (defence in depth).

  • HTTPS enforced. Plaintext http:// is refused unless you explicitly set ALLOW_INSECURE_HTTP=true, and even then only for a loopback host (localhost, 127.0.0.0/8, ::1) β€” the opt-in can never send credentials to a remote host in the clear.

  • Redirects refused. Requests are made with redirect: 'error'. Following a redirect would hand the Authorization header, and therefore the app-password, to whatever host the Location header names. The Passwords API never legitimately redirects, so any 3xx is a hard failure.

  • Error responses are discarded unread. A Passwords API error body can echo the request that failed, so it is drained and thrown away without ever being inspected. A failure surfaces the status code, a static hint and a random correlation id β€” to the model and to the log alike. There is no configuration, DEBUG included, that routes a response body anywhere.

  • App-password auth. Authenticates with a revocable Nextcloud app-password over HTTP Basic β€” never your real account password. NEXTCLOUD_URL is rejected if it embeds credentials, a query string, or a fragment; NEXTCLOUD_USER is rejected if it contains a colon or control characters.

  • Secrets never logged. Debug logging (DEBUG=1) writes the method, path, status and correlation id to stderr. Credentials, session tokens, response bodies, and secret fields are never logged, cached, or written to disk β€” a test asserts this with debugging on.

  • ping reads nothing. Connectivity is proved with the session handshake and session/keepalive. It deliberately avoids password/list, whose default model would pull every decrypted password, note and custom field into this process.

  • Custom fields are validated, not passed through. They are accepted as structured objects and serialized centrally against the documented API limits, so a malformed or oversized blob can never be written into the vault. Limit violations report lengths, never values.

  • Minimal dependencies. Only the official MCP SDK and zod. Networking uses Node's built-in fetch; requests carry a 30s timeout, and no retry wait can exceed 30s regardless of what Retry-After asks for.

None of this removes the underlying risk: an app-password that can read and write the vault gives any connected client the same power β€” reading every secret and modifying entries. Scope and rotate the app-password accordingly, and use PASSWORDS_READONLY=true if you only need lookups.

Related MCP server: fallvault-mcp

Encryption requirement

The Nextcloud Passwords app supports two encryption modes:

  • Server-side encryption (SSE) β€” encrypted at rest; the server holds the keys and returns plaintext to any authenticated session. Supported.

  • Client-side encryption (CSE) β€” end-to-end encryption gated by a master password the server never sees. Not supported.

This server implements none of the CSE (E2E) cryptography. On startup of each session it asks the server whether a challenge is required (session/request); if CSE is enabled it refuses to run with a clear error rather than returning ciphertext. To use this server, disable client-side encryption in the Passwords app settings.

Tools exposed (14; 6 in read-only mode)

Read (always available):

Tool

Returns

Secret?

ping

Connectivity check; confirms CSE is off. Reads no vault data

No

list_passwords

All entries as metadata (optionally filtered by folder)

No

search_passwords

Metadata for entries matching a label/username/URL substring

No

get_password

A single entry incl. plaintext password, notes, custom fields

Yes

list_folders

All folders

No

get_folder

A single folder

No

Write (hidden when PASSWORDS_READONLY=true):

Tool

Does

create_password

Create an entry (label + password required; username/url/notes/folder/favorite/hidden/customFields optional)

update_password

Change specific fields of an entry by id (merge; others preserved)

delete_password

Move an entry to the trash (reversible; refuses if already trashed)

restore_password

Take an entry back out of the trash (refuses if not trashed)

create_folder

Create a folder (label required; optional parent/favorite/hidden)

update_folder

Rename, re-parent, or change favorite/hidden state of a folder by id

delete_folder

Move a folder and its contents to the trash (reversible; refuses if already trashed)

restore_folder

Take a folder back out of the trash (refuses if not trashed)

Every tool carries MCP annotations (readOnlyHint, destructiveHint, idempotentHint, openWorldHint) so clients can tell a metadata read from a secret disclosure or a vault mutation in their confirmation UI. They are hints for presentation β€” the read-only enforcement above is what actually blocks writes.

Writable fields

customFields replaces the entire set on an entry, so send the complete list rather than a delta. Fields are { label, type, value }, where type is one of text, secret, email, url, file, or data.

Tags are out of scope. The API leaves tags untouched when the field is omitted, which is what this server does. Editing them would need tag-discovery tools (list/create tags) that do not exist here, and sending a partial list would silently drop tags the model never saw.

Install

Build a tarball and install it globally:

pnpm install
pnpm pack:tarball          # produces passwords-mcp-<version>.tgz
npm install -g ./passwords-mcp-0.3.1.tgz

This installs the passwords-mcp command.

Configuration

Add to your MCP client config (Claude Code shown):

{
  "mcpServers": {
    "passwords": {
      "command": "passwords-mcp",
      "args": [],
      "env": {
        "NEXTCLOUD_URL": "https://your-nextcloud.example.com",
        "NEXTCLOUD_USER": "your-username",
        "NEXTCLOUD_APP_PASSWORD": "xxxx-xxxx-xxxx-xxxx-xxxx"
      }
    }
  }
}

Generate the app-password in Nextcloud under Settings β†’ Security β†’ Devices & sessions β†’ "Create new app password". The server only needs an app-password, never your real account password β€” and you can revoke it at any time without affecting your main login.

Environment variables

Variable

Required

Description

NEXTCLOUD_URL

yes

Instance base URL (no trailing slash). Must be https://.

NEXTCLOUD_USER

yes

Nextcloud username.

NEXTCLOUD_APP_PASSWORD

yes

A dedicated app-password.

PASSWORDS_READONLY

no

Set to true to expose only the read tools and refuse all writes.

DEBUG

no

Set to any value to log method, path, status and a correlation id to stderr (never secrets or response bodies).

ALLOW_INSECURE_HTTP

no

Set to true to permit plaintext http:// for a loopback host only (localhost testing). Remote hosts are refused regardless.

Development

pnpm install
pnpm dev        # stdio MCP server; point the MCP inspector at it
pnpm test       # unit tests (config validation + secret-stripping guarantees)
pnpm lint       # eslint
pnpm typecheck  # tsc --noEmit
pnpm build      # tsc -> dist/

The unit tests are pure and need no server (global fetch is stubbed where a request is exercised). They assert:

  • metadata projection and search never expose secret fields β€” the core guarantee

  • the config validation rules

  • the write-payload builders: hash computation, the merge that preserves untouched fields, and that hidden/favorite survive an unrelated edit

  • custom-field validation and round-tripping

  • read-only gating, and that unknown tool names β€” including ones inherited from Object.prototype β€” return a tool error rather than throwing

  • MCP annotations are present and correct on every registered tool

  • session handling: one handshake under concurrent first calls, replay of the most recent X-API-SESSION, GET for session/close, and re-open on a 412

  • retry policy: reads retry, writes never do, and Retry-After is parsed strictly and clamped

  • ping never requests password/list

  • with DEBUG on, no response body or session token reaches stderr

License

MIT β€” see LICENSE.

Available Tools

14 tools
create_folderB

Create a new folder. Requires a label; parent folder id is optional.

ParametersJSON Schema
NameRequiredDescriptionDefault
labelYesFolder label (required).
hiddenNoHide the folder and its contents from list actions (default false).
parentNoParent folder id; omit for the base folder.
favoriteNo

TDQS

B3.2/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=false, so the agent knows this is a mutation. The description adds no extra behavioral contextβ€”no mention of side effects, permission needs, idempotency, or error behavior. The openWorldHint=true is left unexplained, leaving the agent to guess what additional resources might be created.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

A single, front-loaded sentence with no unnecessary words. It states the action and the key requirement immediately, making it easy to scan.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a mutation with openWorldHint=true and no output schema, the description is too sparse. It does not mention return values, failure modes, duplicate-label behavior, or what 'open world' implies in practice. An agent would have to rely heavily on inference, which is insufficient for reliable invocation.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 75% and the description reiterates that label is required and parent is optional, adding minor clarity. However, hidden and favorite are not addressed in the description, and favorite has no schema description at all. The description adds only marginal value beyond the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb and resource ('Create a new folder') and explicitly names the required parameter (label). It is unambiguous and clearly distinct from sibling tools like list_folders, update_folder, and delete_folder, so an agent can easily differentiate it.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance is provided on when to use this tool versus alternatives. The description only touches on parameter requirements (label required, parent optional) and gives no context about prerequisites, exclusions, or relationships with sibling folder tools.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

create_passwordA

Create a new password entry. Requires a label and the secret value; username, url, notes, folder id and favorite are optional. Stored with server-side encryption (cseType none).

ParametersJSON Schema
NameRequiredDescriptionDefault
urlNo
labelYesDisplay label (required).
notesNo
folderNoFolder id; omit for the base folder.
hiddenNoHide the entry from list/search actions (default false).
favoriteNo
passwordYesThe secret value (required).
usernameNo
customFieldsNoUser-defined fields. Replaces ALL existing custom fields, so send the complete set. Max 20 fields; label <= 48 chars, value <= 320 chars.

TDQS

A4.2/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description discloses server-side encryption and notes that customFields replaces all existing fields (though this is odd for a create, it is a behavioral detail). Annotations already indicate read/write, destructive, and idempotent hints, but the encryption note adds value beyond the metadata.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, well-structured sentence followed by a brief encryption note. It avoids redundancy and uses parallel lists, making it easy to scan quickly.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description covers the essential information: required vs. optional fields, encryption, and custom field constraints. It does not mention return value or error cases, but those are not required given the absence of an output schema. It is sufficiently complete for an agent to invoke the tool correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema provides descriptions for several parameters (label, password, folder, hidden, customFields, and customFields.type), and the description text clarifies that username, url, notes, folder id, and favorite are optional. It also gives constraints on customFields (max 20, label/value lengths), compensating for the 56% schema description coverage.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Clearly states the action 'Create' and the resource 'a new password entry'. It also lists required and optional fields, and the name distinguishes it from sibling tools like update_password, delete_password, and list_passwords.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description makes the purpose obvious, but it does not explicitly explain when to choose this tool over alternatives (e.g., use update_password for existing entries). It also lacks guidance on typical scenarios or prerequisites beyond the required fields.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

delete_folderA
Destructive

Move a folder AND ITS CONTENTS to the trash (reversible, soft delete). Refuses if the folder is already trashed, so it can never permanently delete.

ParametersJSON Schema
NameRequiredDescriptionDefault
idYesId of the folder to trash.

TDQS

A4.5/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Beyond the destructiveHint annotation, the description discloses that the operation is reversible, affects contents as well as the folder, refuses already-trashed folders, and can never permanently delete. This gives the agent a clear and honest model of side effects.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two concise sentences, front-loads the main action and scope, and adds only relevant caveats. No filler or redundant wording is present.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a tool with one parameter and no output schema, the description is complete: it states the action, the scope including contents, the reversibility, and a key error/refusal condition. An agent has enough context to invoke it correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema already fully covers the single required parameter, and the description repeats the core semantic: 'Id of the folder to trash.' It adds no additional detail such as ID format, validation rules, or source of the ID, so it stays at the baseline for high schema coverage.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool moves a folder and its contents to the trash, describing the action, resource, and side effects. It is obvious this is the soft-delete operation for folders and is distinct from password operations or folder restoration.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explains when the tool applies and its limits: it is a reversible, soft delete and refuses to act on an already-trashed folder. It does not explicitly name alternatives like restore_folder or permanent deletion, but the boundaries are clear enough for an agent to select the correct operation.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

delete_passwordA
Destructive

Move a password to the trash (a reversible, soft delete β€” restore it from the Passwords app). Refuses if the entry is already trashed, so it can never permanently delete anything.

ParametersJSON Schema
NameRequiredDescriptionDefault
idYesId of the password to trash.

TDQS

A5/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Description fully discloses the side effect (soft delete to trash) and explicitly states it can never permanently delete anything. It also mentions the refusal condition for already-trashed entries, going beyond the annotation flags.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two concise sentences, no redundant information, and the key points are front-loaded. Highly efficient and readable.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the simple action and no output schema, the description covers all necessary aspects: action, reversibility, edge case, and guarantee of non-permanence. No missing context for an agent to invoke it correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The only parameter 'id' is clearly documented in the schema as 'Id of the password to trash', and the description consistently references it. Full parameter coverage with no ambiguity.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Description clearly states it moves a password to trash as a reversible soft delete, distinguishing it from any permanent deletion. It specifically identifies the action and resource.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Description explains the behavior and edge case (refuses if already trashed), making it clear when to use this tool. It also implies the alternative restore process via the Passwords app, aligning with sibling tools.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

get_folderA
Read-only

Fetch a single folder by its id.

ParametersJSON Schema
NameRequiredDescriptionDefault
idYesThe folder id.

TDQS

A4/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true and openWorldHint=true, covering the safety profile. The description adds 'Fetch' which aligns with read-only behavior but provides no additional context about error handling or return format. With annotations covering the core, a 3 is appropriate.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, front-loaded sentence with zero waste. It states the essential information clearly and nothing else.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple get-by-id tool with one parameter and annotations covering safety, the description is adequate. It implies the return of a folder object, and no output schema exists to clarify further. The lack of error conditions is a minor gap but acceptable for such a straightforward operation.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100% (the 'id' parameter is described as 'The folder id'). The description repeats this by saying 'by its id', adding no new semantic meaning. Baseline 3 applies when the schema already documents the parameter fully.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description 'Fetch a single folder by its id' uses a specific verb and resource, clearly distinguishing it from list_folders (which returns multiple) and other folder operations. The scope is unambiguous.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides clear context for when to use this tool: when you have a specific folder id. It does not explicitly mention alternatives or exclusions, but the purpose is self-evident enough that an agent can infer not to use it for listing all folders.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

get_passwordA
Read-only

Reveal a SINGLE password entry by its id, including the plaintext secret, notes and any custom fields. This exposes sensitive credentials β€” only call it for a specific id the user has asked to see, never to bulk-export. Get ids from list_passwords or search_passwords.

ParametersJSON Schema
NameRequiredDescriptionDefault
idYesThe password id to reveal.

TDQS

A4.7/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The readOnlyHint annotation already signals no modification, and the description reinforces sensitivity by warning about exposing credentials. While it does not explicitly state 'read-only' in prose, the annotation covers that aspect, and the warning about misuse adds useful behavioral context beyond the annotation.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is concise, using two sentences to convey purpose, usage constraints, and a pointer to related tools. There is no redundant wording or unnecessary detail.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description covers what the tool returns (plaintext secret, notes, custom fields), when to use it (specific id from user), and how to obtain valid ids. Combined with readOnlyHint and openWorldHint annotations, it provides enough context for an agent to invoke it correctly without additional information.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The single parameter 'id' is clearly described as the password id to reveal, matching the schema description exactly. No further detail is provided (e.g., expected format or source), but the explanation is sufficient for correct usage given the tool's narrow scope.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's purpose: to reveal a single password entry by its id, including plaintext secret, notes, and custom fields. It also distinguishes itself from list_passwords and search_passwords by explicitly noting that ids come from those tools.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides explicit usage guidance: only call it for a specific id the user has asked to see, and never for bulk export. It also directs callers to obtain ids via list_passwords or search_passwords, reducing ambiguity about when to use this tool.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

list_foldersA
Read-only

List all folders (id, label, parent folder id, timestamps). Folders hold no secret material. Use a folder id with list_passwords to filter.

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

TDQS

A4.5/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true and openWorldHint=true. The description adds the valuable note that 'Folders hold no secret material,' which sets expectations about content sensitivity, and it specifies the returned fields. It doesn't describe pagination or ordering, but for a read-only list tool this is adequate given the annotation coverage.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences, no wasted words. The first sentence front-loads the core purpose and return fields; the second provides a practical usage pointer. Every word earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a parameterless tool with annotations covering safety and open-world behavior, and no output schema, the description is complete. It tells the agent what it returns, that it's safe (no secrets), and how to chain it with a sibling tool. Nothing an agent needs to call it correctly is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

With zero parameters and 100% schema coverage (empty properties), there is nothing to document. The description adds value by explaining how the output (folder ids) can be used with list_passwords, which is a semantic clarification beyond the schema. Baseline for 0 params is 4, and the description meets it.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb (List), resource (folders), and enumerates the returned fields (id, label, parent folder id, timestamps). It clearly distinguishes itself from sibling tools like list_passwords (which lists passwords) and get_folder (which retrieves a single folder) by indicating scope as 'all folders'. No ambiguity.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It provides a direct cross-tool usage hint: 'Use a folder id with list_passwords to filter.' This tells the agent how to apply the output. It doesn't explicitly state when not to use this tool or compare with get_folder, but the purpose is clear enough that an agent can infer the appropriate context.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

list_passwordsA
Read-only

List saved passwords as METADATA ONLY (id, label, username, url, folder, timestamps). The secret value is never included β€” use get_password with a specific id to reveal one. Optionally filter by folder id.

ParametersJSON Schema
NameRequiredDescriptionDefault
folderNoOptional folder id to filter by.

TDQS

A4.3/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true, so the description adds value by stating the secret value is never included and that only metadata fields are returned. This is beyond the annotation and clarifies the tool's non-destructive, metadata-only nature. No contradiction.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two sentences: the first states the main purpose and scope, the second adds the critical caveat about secret exclusion and the optional filter. Every sentence carries meaningful information, with the most important detail (metadata only) front-loaded.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a read-only list tool with one optional parameter and no output schema, the description covers the return fields, the exclusion of secrets, the pointer to get_password for secret retrieval, and the optional filter. An agent has enough information to decide when to use this tool and how to call it correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The single parameter 'folder' is fully described in the schema as 'Optional folder id to filter by.' The tool description repeats the same optional filtering concept without adding syntax or format details. Since schema coverage is 100%, the description adds no extra parameter semantics beyond a restatement.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb (list), resource (saved passwords), and clarifies the metadata-only scope, naming the exact fields returned. It also distinguishes itself from get_password by explicitly stating the secret is never included. This clearly separates it from sibling tools like search_passwords and get_password.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It explicitly says to use get_password with a specific id to reveal a secret, giving clear direction on when to switch to an alternative. It also mentions optional folder filtering, but does not explicitly discuss when to prefer search_passwords over list_passwords. The context is clear for the core use case.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

pingA
Read-only

Verify connectivity to the configured Nextcloud Passwords instance: that the URL and app-password work, the Passwords app is installed, and client-side encryption is disabled. Reads no vault data.

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

TDQS

A4.5/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true and openWorldHint=true, and the description reinforces 'Reads no vault data.' It adds specific checks (URL, app-password, app installed, encryption disabled) beyond annotations, providing valuable context for an agent deciding whether to call it. No side effects are implied.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences with no wasted words. The primary purpose is front-loaded, followed by the specific checks and the read-only guarantee. Every clause earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a zero-parameter diagnostic tool with readOnlyHint and openWorldHint annotations, the description fully covers what the tool does and what it does not do. No output schema exists, but for a connectivity check, the agent has everything needed to invoke it correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool has zero parameters, so schema coverage is 100% by default. The description adds nothing about parameters because none exist, and there's nothing to clarify. Baseline 4 is appropriate for a no-parameter tool.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb ('Verify connectivity') and resource (Nextcloud Passwords instance), enumerates exactly what is checked (URL, app-password, app installation, client-side encryption), and clarifies it reads no vault data. This clearly distinguishes it from all sibling data-operation tools like list_passwords or get_password.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implicitly signals this is a diagnostic/health-check tool to be used when verifying setup, and explicitly notes it reads no vault data, implying it's safe to call anytime. It does not explicitly name alternatives or conditions, but the purpose is self-evident and no exclusion is needed.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

restore_folderA

Restore a trashed folder, undoing delete_folder. Only takes the folder out of the trash β€” it never rolls it back to an older revision. Reports an error if the folder is not in the trash.

ParametersJSON Schema
NameRequiredDescriptionDefault
idYesId of the trashed folder.

TDQS

A4.5/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Beyond annotations, the description reveals that the tool only removes the folder from trash and never rolls it back to an older revision, and that it errors if the folder is not in the trash. This adds meaningful behavioral context that the annotations do not provide, such as the non-revision behavior and error condition.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two sentences, front-loaded with the primary purpose and then a concise clarification of limitations and error behavior. Every sentence adds value, with no wasted words.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a single-parameter, simple operation, the description fully covers what the tool does, what it does not do, and its error condition. Since there is no output schema, no return value details are expected, and the description is complete for correct invocation.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema already provides full coverage (100%) with a clear description for the 'id' parameter ('Id of the trashed folder'). The tool description does not add extra detail about the parameter, so the baseline of 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's action with a specific verb ('Restore') and resource ('trashed folder'), and directly ties it to 'undoing delete_folder'. This distinguishes it from sibling tools like restore_password, which operate on a different resource type.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies when to use it via 'undoing delete_folder' and provides a condition: it reports an error if the folder is not in the trash, so it should be used only for trashed folders. However, it does not explicitly contrast with alternatives like restore_password, though the resource type makes that implicit.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

restore_passwordA

Restore a trashed password, undoing delete_password. Only takes the entry out of the trash β€” it never rolls the entry back to an older revision. Reports an error if the password is not in the trash.

ParametersJSON Schema
NameRequiredDescriptionDefault
idYesId of the trashed password.

TDQS

A4.5/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The annotations indicate readOnlyHint=false and destructiveHint=false, aligning with the description's statement that it modifies state (restores from trash) without being destructive. The description adds valuable detail about not rolling back to older revisions and reporting an error when the item is not in the trash, which goes beyond the annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two sentences, directly stating the action, its scope, and error behavior. No redundant words or tangential information, making it highly concise and well-structured.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple tool with one input and no output schema, the description covers the purpose, the exact effect (removes from trash only), what it doesn't do (revision rollback), and the error case. This is sufficient for an agent to invoke it correctly without further context.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The only parameter 'id' is described in the schema as 'Id of the trashed password.' The description repeats this without adding new meaning (e.g., format, constraints, or examples). Since schema coverage is 100%, the baseline of 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Clearly states it restores a trashed password and explicitly ties it to undoing delete_password. The description also distinguishes it from a revision rollback, which prevents confusion with other operations.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Provides direct guidance on what the tool does and does not do (only removes from trash, never rolls back to older revision). It also mentions the error condition when the password is not in the trash, which helps set expectations. However, it does not explicitly contrast with restore_folder, though the sibling list makes the distinction inferable.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

search_passwordsA
Read-only

Search saved passwords by a case-insensitive substring of their label, username or URL. Returns METADATA ONLY (no secret values). Use get_password with an id from the results to reveal a single secret.

ParametersJSON Schema
NameRequiredDescriptionDefault
queryYesSubstring to match on label / username / url.

TDQS

A5/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Beyond the readOnlyHint annotation, the description adds critical behavioral details: case-insensitive matching, metadata-only returns, and no secret values exposed. This fully sets expectations for the tool's behavior.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two concise sentences, front-loading the action, then clarifying the output scope and follow-up step. No unnecessary words or redundancy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple search tool, the description provides all necessary context: what it searches, how it matches, what it returns, and how to proceed to obtain the actual secret. The sibling tool landscape makes the purpose and usage unambiguous.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The single 'query' parameter is described as a substring to match on label/username/url, which aligns with the tool's purpose. The tool description adds case-insensitivity, making the parameter's meaning fully clear.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool searches saved passwords by case-insensitive substring across label, username, or URL, and explicitly notes it returns metadata only. This distinguishes it from siblings like list_passwords (which likely lists all) and get_password (which retrieves a specific secret).

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It explicitly instructs to use get_password with an id from results to reveal a secret, providing a clear next step. The case-insensitive substring behavior and metadata-only return give concrete guidance on when to invoke this tool versus alternatives.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

update_folderA
Destructive

Rename a folder, move it under a different parent, or change its favorite/hidden state, by id. Fields you do not pass keep their current value. Hiding a folder also hides everything inside it.

ParametersJSON Schema
NameRequiredDescriptionDefault
idYesId of the folder to update (required).
labelNo
hiddenNoHide/unhide the folder. Hiding also hides its contents.
parentNoNew parent folder id.
favoriteNo

TDQS

A4.2/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description discloses the side effect that hiding a folder hides its contents. The annotation destructiveHint=true is consistent with that side effect, though other potential side effects (e.g., moving affecting child paths) are not mentioned.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences: first lists the actions, second explains partial update and the hiding side effect. No unnecessary detail.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description is sufficient to distinguish from sibling tools and provides the key behaviors needed to call it. It does not mention the return value or error conditions, but that's minor given the absence of an output schema.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema descriptions cover id, hidden, and parent, but label and favorite lack descriptions. The tool description provides some context for these (rename, favorite state), but the semantics are not fully detailed.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states that the tool renames, moves, toggles favorite/hidden state, and specifies that it operates by id. This distinguishes it from create/delete/restore folders.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explains partial update behavior (fields not passed keep current value) and notes the side effect of hiding contents. While it doesn't explicitly mention alternatives, the sibling tools are distinct enough that an agent would know when to use this for modifications.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

update_passwordA
Destructive

Update fields of an existing password by id. Only the fields you pass are changed; all others β€” including hidden/favorite state and custom fields β€” are preserved (the server rejects the write if the entry changed underneath us). Note that customFields REPLACES the whole set. Tags are left untouched and cannot be edited through this server. Provide at least one field besides id.

ParametersJSON Schema
NameRequiredDescriptionDefault
idYesId of the password to update (required).
urlNo
labelNo
notesNo
folderNo
hiddenNoHide/unhide the entry.
favoriteNo
passwordNo
usernameNo
customFieldsNoUser-defined fields. Replaces ALL existing custom fields, so send the complete set. Max 20 fields; label <= 48 chars, value <= 320 chars.

TDQS

A4.7/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description discloses important side effects beyond annotations, including that customFields is fully replaced, hidden/favorite state is preserved, tags are untouched and uneditable, and the server rejects writes if the entry changed underneath. This is transparent about destructive behavior and complements destructiveHint: true.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is concise and front-loaded, stating the purpose first and then adding necessary caveats in a compact manner. No unnecessary words or redundant restatements appear.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a tool with no output schema, the description provides the key operational context: partial update behavior, customFields replacement, tags limitation, required field constraint, and optimistic concurrency rejection. This is sufficient for an agent to use the tool effectively.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is only 30%, and while the prose clarifies update semantics and customFields behavior, several individual parameters like url, label, notes, folder, password, username, and favorite lack explicit format or meaning. In particular, folder is ambiguous (ID vs name) and no validation details are given for most fields.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool updates fields of an existing password by id, using a specific verb and resource. This distinguishes it from sibling tools like create_password, delete_password, restore_password, and search/get variants.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives explicit usage guidance: only passed fields are changed, other fields are preserved, customFields replaces the entire set, tags cannot be edited, and at least one field besides id must be provided. It also notes concurrency rejection, which helps the agent decide when and how to invoke the tool safely.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

  1. 14 tool updatesv0.3.1
    • First observedcreate_folder
    • First observedcreate_password
    • First observeddelete_folder
    • First observeddelete_password
    • First observedget_folder
    • First observedget_password
    • First observedlist_folders
    • First observedlist_passwords
    • First observedping
    • First observedrestore_folder
    • First observedrestore_password
    • First observedsearch_passwords
    • First observedupdate_folder
    • First observedupdate_password

TDQS

A4.2/5.0

Scored across 14 tools

Disambiguation5/5

Each tool targets a distinct action on a distinct resource (password vs folder) with clear separation between metadata-only listing, search, and secret-revealing get. The restore/delete pairs are unambiguous, and ping stands alone. No two tools overlap in purpose.

Naming Consistency5/5

All tools follow a consistent verb_noun snake_case pattern (list_passwords, get_password, create_folder, restore_password, etc.). The only deviation, 'ping', is a standard health-check verb that fits the style. Naming is predictable and uniform.

Tool Count5/5

14 tools cover the full password and folder lifecycle (CRUD + restore + search + metadata listing) without bloat. Each tool serves a necessary function and the count matches the domain scope well.

Completeness5/5

The server provides complete coverage for password and folder management: create, read (metadata and secret), update, delete (soft with restore), plus search and folder hierarchy operations. No obvious gaps; bulk export is intentionally omitted for security, and all required actions are supported.

Maintenance

ActivityMaintained
ResponsivenessResponsive

Related MCP Connectors

Related MCP Servers

  • A
    license
    B
    quality
    A
    maintenance
    MCP server for Nextcloud Collectives that exposes collectives, pages, tags, attachments, page history, and trash to Claude and MCP-compatible clients via OCS API and WebDAV.
    57
    MIT
  • A
    license
    Not graded
    quality
    C
    maintenance
    MCP server for sovereign AES-256-GCM backup encryption and decryption. Enables encrypting, decrypting, verifying, and scoring passphrases with zero network calls.
    MIT
  • A
    license
    Not graded
    quality
    A
    maintenance
    Local, encrypted password vault with AES-256-GCM and PBKDF2, exposing MCP tools for secure credential management, password generation, and search.
    MIT
  • A
    license
    A
    quality
    A
    maintenance
    Provides local, secure access to Enpass password vaults via MCP. Enables unlocking vaults, listing entries, retrieving passwords, TOTP codes, and attachments, with optional write support.
    10
    26 npm
    1
    MIT