doction (dny1020/doction) is an MCP server listed on the M8ven Trust Index. It scores 74 out of 100, grade C. It declares 27 tools. No publisher has claimed this listing.

C
Warning
74/100

doction

Self-hosted, markdown-first wiki and knowledge base for humans and AI agents: REST API, native MCP server, local semantic search, per-page git history. No LLM inside, no SaaS. AGPL-3.0-only.

Warning. Serious findings were identified. Review the full report before connecting. Grades reflect the full trust pyramid: code, verification depth, and reputation. New projects cap at C until adoption is earned.

How we verified

⚡ Live Monitored: not connected

Verified is a snapshot. Live keeps it current, and builds your track record.

⚡ Connect GitHub → continuous verification on every pushwhy connect →

Who stands behind it

dny1020

Source: github_repo_search

Is this your MCP?

Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find. Or connect your repo for our deepest verification, Live Monitored: read-only, revoke anytime. What we access →

Install from

The grade above is for the source repository. Registries can serve a different version, so we mark the ones we were not able to read.

// key findings
🚨
Code appears obfuscated
1 file are unreadable to a human reviewer. Cannot audit what they do.
🔐
You'll be asked for 1 credential: SECRET_KEY
These are read from process.env at runtime. Make sure you trust where they’ll be sent.
// tools this server exposes27 tools

These names and descriptions are the publisher's own, read from the source code. We print them as written. Our assessment is the findings above, not this list.

list_workspaces

List the user's workspaces (slug, name, role).

list_members

List the members of a workspace (email, display name, role).

list_pages

List all pages in a workspace as a flat tree (slug, title, depth).

get_page

Read a page: title, markdown content and metadata.

search_pages
create_page

Create a markdown page. Returns the generated slug.

move_page

Reparent a page. Cheap: the git repo is flat, so no file moves. Omit parent_slug to move it to the root.

rename_page

Change a page's slug. The old slug keeps resolving through an alias, so existing [[wikilinks]] do not break.

delete_page

Soft-delete a page; it goes to the trash and can be restored.

list_children

Direct children of a page.

update_page

Update a page's title and/or content. Slug stays stable.

get_page_history

Git commit history for a page (sha, timestamp, author, message).

extract
list_backlinks

Pages that link to this page via [[wikilink]] — incoming edges, one hop. Traverses links, not tags: use related_pages for pages about the same subject, and get_linked_knowledge to walk further than one hop. Read-only.

get_linked_knowledge

The wikilink neighbourhood of a page in one call: every page reachable within `depth` hops in either direction, each with its distance, the direction of the hop that reached it (outgoing, incoming, or both when

related_pages

Neighbor pages ranked by shared-tag overlap. Traverses tags, not links: these pages are about the same subject but need not reference each other. Use list_backlinks or get_linked_knowledge for actual references. Read-only.

search_knowledge

Find pages. Hybrid search: the lexical and the vector rankings fused by reciprocal rank, filterable by tag. Returns one entry per page with its best matching passage and which retrievers found it — use this to pick what to read, and get_rag_context to read it. Read-only.

get_rag_context

Gather passages to answer from. Returns whole sections with provenance

get_workspace_tree

How the workspace is organised: pages and their subpages, nested. Use it to find where a topic belongs before writing. Read-only.

read_page_raw

A page's markdown exactly as stored, frontmatter block included and unmodified, plus its parsed frontmatter and tags. Read this before editing — it is what a write has to preserve. Read-only.

upsert_page_section

WRITE. Replace one section of a page, or add it if absent, leaving every other byte untouched — no need to send the whole body back, so two agents editing different sections do not overwrite each other. Refuses when the page has more than one heading with that text; pass `level` to disambiguate. Rec

sgrep

Hybrid search: the lexical and the vector rankings fused by reciprocal rank. Returns slug, title, score, matched chunk, and which retrievers found it. Identical ordering to the web UI and /api/search. Degrades to full-text search when semantic search is disabled or not yet indexed.

suggest_links

Pages this page should probably link to but doesn't yet: cosine similarity over local page embeddings, or literal title mentions when semantic search is off. Returns slug, title, score and a `mode` field.

suggest_tags

Candidate tags for a page: TF-IDF terms that are characteristic of it vs the rest of the workspace, boosting terms already used as tags elsewhere. No embeddings needed.

summarize_page
workspace_insights
rag

Retrieval pipe: returns the top-k most relevant chunks with provenance

// environment variables
To run this server yourself, you supply these values. They go in your own MCP client configuration and stay on your machine. The secret label means the value is sensitive, not that the server mishandles it.
configSECURE_COOKIESoff
configDISABLE_REGISTRATIONRegister your own account immediately, then set =1 and restart:
configSOURCE_URLthis repository
🔐 secretSECRET_KEYinsecure dev value
configDOCTION_APP_PATH
configDATA_DIR/data
configMODEL_DIR
configLOG_LEVELINFO
configLOG_DIR/logs
configOCR_UPLOADSoff
configOCR_LANGSeng+spa
configEVAL_CORPUS
configSEMANTIC_SEARCHoff
configRERANKoff
configGITHUB_BASE_REF
Deployment configuration, supplied by whoever hosts the server. Users are not asked for these.
deployDATABASE_URL
// quality suggestions

Tool annotations

No tools have read-only/destructive annotations

Add readOnlyHint or destructiveHint annotations to every tool so hosts can warn users before invoking.

All four hints declared on every tool

27/27 tools missing one or more hints — list_workspaces (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); list_members (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); list_pages (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint), +24 more. OpenAI's directory rejects tools where any of the four hints are missing or non-boolean.

For every tool, set all four hints (readOnlyHint, destructiveHint, idempotentHint, openWorldHint) to explicit true/false values that match the handler’s actual behaviour.

Readable source code

1 file are minified or bundled, which is usually build output rather than concealment

Ship unminified, readable source.

Claim the listing to review these findings one by one and send us a correction where you disagree, straight to the team. Claiming also means we tell you when the grade moves, and reach you first if we find anything urgent.

// full audit trail
The findings above are the summary. The full trail, every check we ran, each deduction, the network hosts observed and the dependency advisories, goes to verified publishers, along with an alert whenever a new one lands. Verified publishers can also review each finding and dispute it in one click. Publisher corrections have sharpened several of our checks this month, because the maintainer knows the codebase better than any scanner.
// improvement guidance — verified publishers only
We have 3 concrete improvements we can share with the publisher of this MCP. Each comes with specific guidance to raise the trust score.
// embed badge in your README
[![M8ven Verified](https://m8ven.ai/badge/mcp/dny1020/doction?variant=verified)](https://m8ven.ai/mcp/dny1020/doction)
Shows verification status without the grade. Want the grade badge instead? Remove ?variant=verified from the URL.
commit: fd5d297f9952f7ec15e9749f397262c1f0ff432d
code hash: ecad40c75d72205ffc1bc7d7a81d58964e0d7afca0e2cc372c8a2ce0723b40db
view raw JSON →
Check MCPs from inside your assistant
Tool Check · MCP

Vetting this one by hand? Tool Check is an MCP that scores other MCPs. Add it once and ask Claude, ChatGPT, or any MCP client to grade a server, surface CVEs, check the publisher, and suggest safer alternatives — before you install.

https://m8ven.ai/api/mcp/tool-check
check_toolsearch_toolscompare_toolsrecommend_alternativescheck_publisherreport_concern
How to add it →Free · no account needed · works in any MCP client