Librarian MCP — a self-hosted MCP server that curates a shared, git-backed document store for AI agents.

Other agents (Claude, CC, OC, Hermes, k2) query it for context and submit new information at the end of sessions, instead of touching files directly. The librarian owns all writes, maintains an FTS5 search index, and keeps a git log plus provenance cache (log.ndjson) of who submitted what and when.

TOOLS:

• query(criteria, scope?) — keyword search across granted scopes; returns ranked matches (no LLM call)
• submit(content, scope, hint?) — a curator model (via litellm) decides create / update / merge / reject_duplicate, then the result is written and committed
• get(doc_id) — full document content plus commit history

TAILNET IDENTITY — Unraid NATIVE integration (no image changes needed):
This image is Tailscale-unaware. Unraid's built-in per-container Tailscale (Unraid 7+) gives the container its own tailnet presence via the container's Tailscale settings in the Docker UI:

• Use Tailscale toggle: ENABLED (pre-set by this template)
• Tailscale hostname: librarian-mcp (node appears as librarian-mcp.pygmy-bramble.ts.net)
• Tailscale tag: tag:librarian-mcp (ACL grant live: tag:librarian-mcp → tcp:8090)
• Tailscale State Directory: /mnt/user/appdata/tailscale/librarian-mcp

FIRST DEPLOY / REGISTRATION (pre-tagged auth key, no log-link):
Gary generates a pre-tagged, reusable auth key in the Tailscale admin console
(scoped to tag:librarian-mcp), saves it to 1Password, and pastes it into the
Tailscale Extra Parameters field in place of the REPLACE_WITH_TAILSCALE_AUTH_KEY
placeholder (the field is pre-filled with the full flags below). Then start the
container — no interactive registration is needed. Confirm in the admin console
that the node appears with tag:librarian-mcp.

⚠ AUTH KEY VISIBILITY: the Tailscale Extra Parameters field is a plain text
field (not password-masked) and the value is stored in the template/container
config, so the pasted key is visible in the Unraid UI and via docker inspect.
This matches the earlier env-var-visibility caveat. If strict no-inspect
compliance is required, say so and we'll switch to a file-mounted key instead.

BINDING: the app listens on 0.0.0.0 inside its isolated container netns (BIND_ADDRESS=0.0.0.0). No host port is published, so the service is reachable only via its Tailscale identity — tailnet-only.

SECURITY:

• Agent bearer tokens are loaded from a file mount only (Agent Token File), never env/CLI.
• Timing-safe token comparison; scope enforcement (a caller cannot write outside its granted scopes).
• Request body size limits on submit; input validation on all tool parameters.
• Refuses to start if required secrets are missing.

BEFORE FIRST START:

1. Create the data directory: /mnt/user/appdata/librarian
2. Create the agent token file (one identity per agent so provenance records who wrote what; all share the single shared pool):
   printf '%s' '{"agents":{"gary-cc":{"token":"REPLACE_WITH_LONG_RANDOM_TOKEN","scopes":["shared"]},"gary-claude":{"token":"REPLACE_WITH_LONG_RANDOM_TOKEN","scopes":["shared"]},"gary-oc":{"token":"REPLACE_WITH_LONG_RANDOM_TOKEN","scopes":["shared"]},"gary-k4":{"token":"REPLACE_WITH_LONG_RANDOM_TOKEN","scopes":["shared"]},"graham-hermes":{"token":"REPLACE_WITH_LONG_RANDOM_TOKEN","scopes":["shared"]},"graham-neo":{"token":"REPLACE_WITH_LONG_RANDOM_TOKEN","scopes":["shared"]}}}' /mnt/user/appdata/librarian/tokens.json
   chown 99:100 /mnt/user/appdata/librarian/tokens.json && chmod 600 /mnt/user/appdata/librarian/tokens.json
3. Create the litellm API key file (a scoped litellm virtual key, e.g. gary-agents):
   printf '%s' 'sk-your-litellm-virtual-key' /mnt/user/appdata/librarian/litellm_key
   chown 99:100 /mnt/user/appdata/librarian/litellm_key && chmod 600 /mnt/user/appdata/librarian/litellm_key

AGENT CONNECTION: point your agent's MCP client at:
http://librarian-mcp.pygmy-bramble.ts.net:8090/mcp
with header: Authorization: Bearer agent-token

Full docs: https://github.com/bitcryptic-gw/librarian-mcp