Skip to content

Deploy

These pages are for an operator running the server for others over HTTP, as a container or a system service, with every caller authenticated. Each page covers one task. Start with Docker for a container or systemd for the .deb/.rpm package; then Authentication, then the reverse proxy that exposes it.

  • Docker: the image, Compose, ports, volumes and health checks.
  • systemd and the Linux packages: the package's contents and the environment file; the unit's confinement; upgrades.
  • Authentication: bearer tokens or OIDC, and when to use which.
  • OIDC: which of the two OIDC modes to run, and how to configure it.
  • OIDC providers: Authelia, Keycloak, Google, and GitHub through a broker.
  • Reverse proxy: TLS, its own hostname or a path prefix, and the routing OAuth discovery needs.
  • Transfer links: one-time download and upload URLs, for the person holding one and for the operator.

Before exposing the server, read the security model: an authenticated caller has every tool the instance exposes, and under OIDC the identity provider alone decides who gets in.

Scholar MCP needs one writable path, SCHOLAR_MCP_CACHE_DIR, for its SQLite cache, downloaded PDFs and converted Markdown. It calls public scholarly APIs over HTTPS and, when configured, a docling-serve for PDF conversion and EPO OPS for patents; the security model lists every service.