Release date: July 14, 2026
Repository: owncloud/ocis-mcp-server
Release page: https://github.com/owncloud/ocis-mcp-server/releases/tag/v1.1.0
The ownCloud Infinite Scale MCP Server exposes oCIS to AI assistants and agent frameworks as a set of MCP tools, letting an LLM-based client invite users to spaces, upload and share files, manage groups, and query resources through the Model Context Protocol. Version 1.1.0 fixes an authentication gap in the HTTP transport, corrects four tool request shapes that were being rejected by a newer oCIS release, and repairs a LICENSE file that had picked up fabricated boilerplate text.
Added: HTTP transport authentication (#29)
Before this release, the HTTP transport served /mcp without requiring any credential. Any client able to reach the listener over the network could invoke every tool exposed by the server, running under the server’s own oCIS identity, with no bearer token or other credential check in front of it — a real gap for any deployment where the HTTP listener is reachable from more than one trusted process on the same host.
1.1.0 adds enforcement of a bearer secret via the OCIS_MCP_HTTP_SECRET environment variable. If the server is configured to bind to a non-loopback address without this secret set, it now fails at startup instead of serving requests unauthenticated. Binding to loopback (127.0.0.1) without a secret is still permitted, intended for local development, but the server logs a warning in that case so the choice is visible in logs rather than silent. The stdio transport is unaffected by this change, since it doesn’t expose a network listener.
Under the hood, the bearer check uses SHA-256 plus a constant-time comparison, so it’s not vulnerable to a timing attack on the secret itself.
Fixed: four tools rejected by oCIS 8.1.0-rc.1 (#26)
- ocis_invite_to_space, ocis_upload_and_share, and ocis_create_project_space (which also invites members) omitted the required @libre.graph.recipient.type field on invite recipients.
- ocis_add_group_member sent a bare user ID where the API expects a full URL for @odata.id.
- ocis_get_resource_by_id double-prefixed the DAV path when handling full resource IDs.
- ocis_list_assignments omitted the required account_uuid
All four request shapes now match what oCIS 8.1.0-rc.1 expects, with regression tests added for each fix.
Fixed: LICENSE text (#37)
The root Apache-2.0 LICENSE file’s Appendix section had picked up a fabricated sentence at some point: an instruction to “get an ‘Alarm or alarm’ in your text editor to find the word ‘alarm,'” which doesn’t correspond to anything in the real Apache-2.0 text. The file also had minor wording drift in a couple of spots (“the Licensor” instead of “Licensor,” “any notices” instead of “those notices”). Both the fabricated sentence and the wording drift are now corrected to match the canonical SPDX Apache-2.0 text exactly, verified against the text reuse download Apache-2.0 pulls from SPDX’s own license-list-data.
The same fabricated text had already been caught once, in a companion LICENSES/Apache-2.0.txt file, during review of a separate pull request; this fix applies the identical correction to the root LICENSE file it was originally copied from. Worth calling out: this is exactly the kind of thing a second set of eyes in code review is for, and it’s why this project requires review on every PR that touches licensing text, human-written or not.
Compatibility
This release requires Go 1.26 or later to build, targets oCIS 8.x, and was tested specifically against oCIS 8.0.1 and 8.1.0-rc.1. It uses github.com/modelcontextprotocol/go-sdk v1.6.1 for MCP support.
Upgrade and migration notes
If you run the HTTP transport bound to any non-loopback address, you must set OCIS_MCP_HTTP_SECRET before restarting on 1.1.0, or the server will refuse to start. This is a breaking change in practice for anyone who was previously running an unauthenticated HTTP listener on a reachable address. Loopback-only and stdio deployments require no configuration changes.
This post is based on the GitHub Release description for owncloud/ocis-mcp-server, cross-checked against the repository’s CHANGELOG.md (the two agree on substance; CHANGELOG.md’s wording was used where fuller). Source read: https://github.com/owncloud/ocis-mcp-server/releases/tag/v1.1.0.
ownCloud OSPO: moc.skrowetik@opso · kiteworks.com/opensource
