docuware-mcp

# docuware-mcp A Model Context Protocol (MCP) server that exposes a DocuWare DMS to LLM-based agents through a database-style API. It serves both the current sessionless MCP revision (2026-07-28) and the older handshake-based protocol — each client gets whichever it asks for. This is an independent project with no affiliation to DocuWare GmbH. ## Configuration Credentials are read from the `docuware-client` standard environment variables: ``` DW_URL=https://dms.example.com DW_USERNAME=service_account DW_PASSWORD=<secret> DW_ORG=<org> ``` Alternatively, point `DW_CREDENTIALS_FILE` at a JSON file — useful for switching between test and production systems, or for keeping secrets out of shell history: ``` DW_CREDENTIALS_FILE=/path/to/credentials.json ``` The file uses the same keys as the environment variables: ```json { "url": "https://dms.example.com", "username": "service_account", "password": "<secret>", "organization": "Acme GmbH" } ``` `organization` is optional if the service account belongs to a single organization. Make sure the file is not world-readable (`chmod 600`). For service-to-service deployments, OAuth2 Client Credentials is the recommended flow — no user account, no browser, no rotating refresh tokens. Requires a DocuWare "Trusted / Service" App Registration that provides a `client_secret`: ``` DW_URL=https://dms.example.com DW_CLIENT_ID=<app-registration-id> DW_CLIENT_SECRET=<secret> ``` This path is preferred over `DW_USERNAME` / `DW_PASSWORD` for unattended deployments (containers, systemd units, Claude Desktop on a workstation with secrets injected from a manager). `DW_CREDENTIALS_FILE` takes precedence if both are set. For internal DocuWare installations with self-signed or private-CA certificates, TLS verification can be disabled with `DW_VERIFY_CERT=false`. **Do not use this against production systems** — it disables protection against man-in-the-middle attacks. OAuth2 requires DocuWare 7.10 or later. ## Use wit…