Security model
Boundaries before features.
The app separates bridge identity from Nextcloud credentials, derives tenant scope from verified OAuth claims, and restricts file access to a user-selected root.
Last updated · 20 August 2026Identity and tenant isolation
Every hosted MCP request verifies token signature, issuer, audience, expiry, subject, and required scopes. The exact issuer and subject are converted into a pseudonymous tenant identifier. Callers cannot choose a tenant identifier in tool input, and every connection, credential, Login Flow, and household-profile lookup includes the current tenant boundary.
Nextcloud account connection
The bridge uses Nextcloud Login Flow v2. Users authenticate directly with their own Nextcloud, including Nextcloud-managed two-factor authentication. The bridge never asks for the account password. The generated app password is encrypted with tenant-bound AES-256-GCM authenticated data and is never returned through an MCP tool.
Workspace scope
The generated app password is account-level, so the configured root is a bridge-enforced least-privilege boundary. Account-root access, parent traversal, deletion of the configured root, out-of-root WebDAV results, and oversized transfers are rejected. A dedicated Nextcloud user remains the strongest optional server-side boundary.
Public network boundary
Hosted targets must use HTTPS on the allowed port and resolve only to globally routable addresses. The production composition sends outbound Nextcloud traffic through an internal CONNECT-only proxy that resolves and validates the destination at connection time, pins the validated IP, and prevents the bridge process from directly reaching the public network.
Tool and invoice safety
Public tools carry explicit read-only, destructive, idempotent, and closed-world annotations. Share tokens and public URLs are omitted. Invoice review is bounded and advisory: it does not approve, book, pay, transmit, or automatically archive a document, and it does not expose raw extracted text or full payment identifiers.
Responsible disclosure
Report vulnerabilities privately. Include a minimal, sanitized reproduction and the affected version. Do not access another user's data, retain copied data, disrupt service, or publish a finding before coordinated remediation.
Open a private security report ↗