Skip to content
verify mcp Beta VerifyMCP is currently in beta. If you notice any issues, get in touch and we’ll put it right.

AIquila — Nextcloud MCP Server

NPM · AIQUILA-MCP · 3 COMPONENTS

Nextcloud MCP server — 345 tools: files, calendar, contacts, mail, Talk, Deck, photos, maps, notes

−1 this week 89 Trust /100

Last scanned (4 hours ago)

Scores higher than 93% of npm servers

Category Documents and Files

Trust breakdown (7 categories)

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →

Supply Chain Security93
  • No malware found by supply-chain analysis.Pass
  • CVE check failed: a known medium-severity CVE affects minimatch 9.0.9, reached via webdav > minimatch. A fixed version is available. View diagnostics → Fail
  • No install/post-install scripts declared.Pass
  • 45 of 124 dependencies flagged as unhealthy (1 deprecated). View diagnostics → Partial
Provenance & Transparency74
  • Repository check failed: the declared repository URL redirects; it must resolve directly. See how to fix → View diagnostics → Fail
  • Cryptographically verified build provenance (signed, bound to elgorro/aiquila). View diagnostics → Pass
  • Clear OSI-approved license (MIT).Pass
  • Actively maintained (last published 3 days ago).Pass
  • Publishes a security disclosure policy (SECURITY.md).Pass
Schema Quality & AI Usability81
  • AI-judged instruction clarity (excellent).Pass
  • Tool/resource definitions use about 23946 tokens (~69/item across 345 items; 345 tools + 0 resources), lean.Pass
  • Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management100
  • No destabilizing schema changes in the last 30 days.Pass
Tool Coverage99
  • 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
  • 97% of tool parameters carry a description.Partial
Tool Safety100
  • No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
  • All 56 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation.Pass
  • An AI judge read all 345 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
  • Implements a current MCP spec version (2026-07-28).Pass
Changelog

Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.

  • 3 Nov 26 0
    • Stability: 0.97 → pass security
  • 2 Nov 26 0
    • Stability: pass → 0.97 functional
  • 31 Oct 26 +24
    • CVE-2026-118764 affects this package: medium ▼ security
    • Known CVEs: unverified → fail ▼ security
    • Malware scan: unverified → pass ▲ security
    • Dependency health: unverified → 0.83 ▲ functional
  • 30 Oct 26 −25
    • Malware scan: pass → unverified ▼ security
    • Known CVEs: pass → unverified ▼ security
    • Dependency health: 0.82 → unverified ▼ functional
    • Security disclosure: fail → pass ▲ functional
    • MCP protocol: Implements a current MCP spec version (2026-07-28). functional
    • Package version: 0.4.19 → 0.5.0 functional
  • 27 Oct 26 +15
    • Malware scan: unverified → pass ▲ security
    • Stability: 0.97 → pass security
  • 26 Oct 26 −15
    • Malware scan: pass → unverified ▼ security
    • Stability: pass → unverified ▼ security
    • Tool safety: pass → unverified ▼ security
    • Schema quality: 20947 → 24000 ▼ functional
    • Capabilities: pass → unverified ▼ functional
    • Tool coverage: 100 → unverified ▼ functional
    • Stability: pass → 0.97 functional
    • Package version: 0.4.11 → 0.4.19 functional
    • Package version: 0.4.11 → 0.4.18 functional
  • 24 Oct 26 0
    • Package version: 0.3.23 → 0.4.11 functional
  • 20 Oct 26 0
    • Stability: 0.97 → pass security
Diagnostics

Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.

Captured 5 Nov 2026 · Analysed npm/aiquila-mcp@0.5.0

Provenance Verified

A signed build attestation was found and verified, binding this exact artifact to the source repository it claims to come from.

Result Verified
Ecosystem npm
Reason Verified
Discovered via Registry attestation endpoint
Source repo elgorro/aiquila
Certificate issuer https://token.actions.githubusercontent.com
Certificate SAN https://github.com/elgorro/aiquila/.github/workflows/mcp-release.yml@refs/heads/main
Rekor log index 3591551501
Predicate type SLSA build provenance https://slsa.dev/provenance/v1
Subject digest sha512:66d9c92b6c9ce09b5ef3db5037e2f50901bd725b1a968e0fa09c7a59c905f0c2f93d6cc105a08fd7af0ce3ed99880384fcefd2acbf804127c295c145a

Background: How many MCP packages publish verified provenance →

Vulnerabilities 1 finding
ID CVE Severity Vector Fix available
GHSA-g3hv-75wg-m249 CVE-2026-118764 medium yes

Background: What a vulnerability scan can and cannot prove →

Dependencies 124 packages
Packages resolved 124
Deprecated 1
Stale 44
Tree resolution Complete

Background: SBOMs and build attestations, explained →

MCP tools · 345 exposed · ~23,946 tokens

The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →

Tool Tokens
rename_map_favorite_category ~80

Rename one or more favorite categories. All favorites in the listed categories are moved to the new name.

NameTypeReqDescription
categoriesarrayyesExisting category names to rename
myMapIdnumber–ID of a custom map to scope the operation to; omit for the user's default map
newNamestringyesNew category name

No output schema declared.

No examples provided.

rename_news_folder ~38

Rename a News folder.

NameTypeReqDescription
folderIdnumberyesThe folder ID to rename
namestringyesThe new folder name

No output schema declared.

No examples provided.

reopen_poll ~29

Reopen a previously closed poll so voting can resume.

NameTypeReqDescription
pollIdintegeryesPoll ID

No output schema declared.

No examples provided.

reorder_form_options ~66

Reorder all options for a choice question. Pass the full list of option IDs in the desired order.

NameTypeReqDescription
formIdintegeryesForm ID
newOrderarrayyesFull list of option IDs in desired order
questionIdintegeryesQuestion ID

No output schema declared.

No examples provided.

reorder_form_questions ~55

Reorder all questions in a form. Pass the full list of question IDs in the desired order.

NameTypeReqDescription
formIdintegeryesForm ID
newOrderarrayyesFull list of question IDs in desired order

No output schema declared.

No examples provided.

reset_map_photo_coords ~47

Remove GPS coordinates from one or more photos.

NameTypeReqDescription
myMapIdnumber–Custom map ID to scope to
pathsarrayyesFile paths in Nextcloud storage

No output schema declared.

No examples provided.

reset_registration_setting ~52

Reset a Nextcloud Registration app setting to its default by deleting the stored value. Requires the configured Nextcloud user to be an admin.

NameTypeReqDescription
keystringyesThe Registration config key to reset to its default

No output schema declared.

No examples provided.

reset_terms_signatures ~52

Reset ALL users' terms of service signatures org-wide, forcing every user to accept the terms again on next login. This is destructive and cannot be undone. Requires the configured Nextcloud user to be an admin.

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

restore_file_version ~58

Restore a previous version of a file (creates a new current version from the old one)

NameTypeReqDescription
fileIdnumberyesThe Nextcloud internal file ID
versionIdstringyesThe version identifier (from list_file_versions output)

No output schema declared.

No examples provided.

restore_from_trash ~51

Restore a file from the trash to its original location (use the Key from list_trash)

NameTypeReqDescription
trashKeystringyesThe trash item key (from the Key field in list_trash output)

No output schema declared.

No examples provided.

resume_coworker ~28

Resume a paused coworker.

NameTypeReqDescription
idnumberyesCoworker ID

No output schema declared.

No examples provided.

run_coworker ~37

Run a coworker immediately (synchronously) and return the run result.

NameTypeReqDescription
idnumberyesCoworker ID

No output schema declared.

No examples provided.

run_occ ~173

Execute an allowlisted Nextcloud OCC command on the server and return the output. Only command and argument combinations in the allowlist may be run (configurable via MCP_OCC_ALLOWLIST env var). The default allows read-only commands only: status, app:list, setupchecks, integrity:check-core, integrity:check-app, user:list, user:info and group:list with any arguments; update:check, maintenance:mode and theming:config without arguments.

NameTypeReqDescription
argsarray–Optional arguments for the command (e.g., ["--shipped=false", "--output=json"])
commandstringyesThe OCC command to execute (e.g., "app:list", "config:list", "setupchecks")
timeoutnumber–Timeout in seconds (default: 120, max: 600)

No output schema declared.

No examples provided.

run_setup_checks ~32

Run Nextcloud setup checks to verify system configuration (security, performance, PHP modules, etc.). Requires admin privileges

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

search_files ~69

Search for files in Nextcloud by name pattern and/or mime type

NameTypeReqDescription
mimestring–Filter by mime type prefix (e.g., 'image/', 'text/plain')
pathstring–Base directory to search in
querystringyesSearch query (file name pattern)

No output schema declared.

No examples provided.

search_map_contacts ~48

Search address book contacts by name, to find the bookid/uri/uid needed to place a contact on the map.

NameTypeReqDescription
querystringyesSearch term matched against contact display names

No output schema declared.

No examples provided.

search_sharees ~115

Search for valid share recipients (users, groups, emails, federated users, circles, rooms)

NameTypeReqDescription
itemTypestring–Item type (default: file)
searchstringyesSearch query for recipient name/email
shareTypesarray–Share types to include: 0=user, 1=group, 3=public, 4=email, 6=federated, 7=circle, 10=room (default: [0,1,3,4,6])

No output schema declared.

No examples provided.

set_coworker_schedule ~86

Change when a coworker runs. Takes a 5-field cron expression in the server's time zone and returns the next run time.

NameTypeReqDescription
cronSchedulestringyes5-field cron: minute hour day-of-month month day-of-week, e.g. "30 6 * * 1-5"
idnumberyesCoworker ID

No output schema declared.

No examples provided.

set_file_tags ~83

Set personal tags on a file or folder in Nextcloud. Replaces all existing personal tags. Use an empty array to clear all tags.

NameTypeReqDescription
pathstringyesThe file or folder path in Nextcloud (e.g., '/Photos/test.png')
tagsarrayyesArray of tag names to set (e.g., ['Wallpapers', 'Nature'])

No output schema declared.

No examples provided.

set_out_of_office ~134

Set an out-of-office / absence period with status message (NC 28+)

NameTypeReqDescription
firstDaystringyesFirst day of absence (YYYY-MM-DD)
lastDaystringyesLast day of absence (YYYY-MM-DD)
messagestringyesDetailed absence message shown to others
replacementUserIdstring–User ID of the replacement/delegate during absence
statusstringyesShort status label (e.g. "Vacation", "Sick leave")
userIdstring–User ID to set absence for (defaults to the configured Nextcloud user)

No output schema declared.

No examples provided.

set_poll_subscription ~58

Subscribe or unsubscribe the current user to poll notifications (new votes, comments). Use subscribe=true to subscribe, false to unsubscribe.

NameTypeReqDescription
pollIdintegeryesPoll ID
subscribebooleanyestrue to subscribe, false to unsubscribe

No output schema declared.

No examples provided.

set_terms_of_service ~137

Create or update the terms of service for a given country/language pair. If terms already exist for that pair they are replaced, otherwise new terms are created. Use get_terms_of_service to discover valid country/language codes; an invalid code returns an error (HTTP 417). Requires the configured Nextcloud user to be an admin.

NameTypeReqDescription
bodystringyesThe terms text (markdown: headers, formatting, lists, links)
countryCodestring–2-letter region code, or "--" for global (default)
languageCodestringyes2-letter language code (e.g. "en")

No output schema declared.

No examples provided.

set_user_status ~39

Set the current user's status type (online, away, dnd, invisible, offline)

NameTypeReqDescription
statusTypestringyesStatus type to set

No output schema declared.

No examples provided.

set_user_status_message ~81

Set a custom status message with optional emoji icon and auto-clear time

NameTypeReqDescription
clearAtnumber–Unix timestamp when the message should auto-clear (null = never)
messagestringyesCustom status message text
statusIconstring–Status emoji icon (e.g. "☕", "🏠", "🤒")

No output schema declared.

No examples provided.

share_map_category ~39

Share a favorite category via a public link. The category must already contain at least one favorite.

NameTypeReqDescription
categorystringyesCategory name to share

No output schema declared.

No examples provided.

share_map_device ~74

Share a GPS device via a public link, limited to a time window. Returns the share token.

NameTypeReqDescription
idnumberyesDevice ID to share
timestampFromnumberyesUnix timestamp — start of the shared time window
timestampTonumberyesUnix timestamp — end of the shared time window

No output schema declared.

No examples provided.

social_account_statuses ~113

Read the posts of one fediverse account in Nextcloud Social, newest first.

NameTypeReqDescription
accountstringyesAccount id, or the handle (user@server)
limitnumber–Statuses to return (default 20, max 50)
max_idnumber–Only statuses older than this status id (page back)
min_idnumber–Only statuses newer than this status id (page forward)
only_mediaboolean–Only posts carrying media (default false)

No output schema declared.

No examples provided.

social_bookmark ~48

Bookmark a post in Nextcloud Social so it can be found again. Bookmarks are private to this user and are not federated.

NameTypeReqDescription
status_idnumberyesThe numeric status id

No output schema declared.

No examples provided.

social_boost ~75

Boost (reblog) a post in Nextcloud Social, republishing it to this user's followers. This publishes to the fediverse: the action is delivered to other servers immediately and cannot be recalled. A public post is world-readable. Confirm with the user before boosting.

NameTypeReqDescription
status_idnumberyesThe numeric status id

No output schema declared.

No examples provided.

social_delete_status ~57

Delete one of this user’s own posts in Nextcloud Social. A delete is federated to the servers that received the post, but copies already shown or cached elsewhere may remain.

NameTypeReqDescription
status_idnumberyesThe numeric status id

No output schema declared.

No examples provided.

social_dismiss_notifications ~56

Dismiss one Nextcloud Social notification, or clear all of them when no id is given. Dismissed notifications cannot be brought back.

NameTypeReqDescription
notification_idnumber–The notification to dismiss; omit to clear every notification

No output schema declared.

No examples provided.

social_favourite ~69

Favourite (star) a post in Nextcloud Social. This publishes to the fediverse: the action is delivered to other servers immediately and cannot be recalled. A public post is world-readable. The author's server is told who favourited it.

NameTypeReqDescription
status_idnumberyesThe numeric status id

No output schema declared.

No examples provided.

social_follow_account ~84

Follow a fediverse account from this user's Nextcloud Social account. This publishes to the fediverse: the action is delivered to other servers immediately and cannot be recalled. A public post is world-readable. The other server is told who followed; a locked account has to approve the request first.

NameTypeReqDescription
accountstringyesAccount id, or the handle (user@server)

No output schema declared.

No examples provided.

social_get_status ~66

Read one post in Nextcloud Social by its id, optionally with the thread around it (the posts it replies to and the replies to it).

NameTypeReqDescription
include_contextboolean–Also fetch the surrounding thread (default false)
status_idnumberyesThe numeric status id

No output schema declared.

No examples provided.

social_hashtag_timeline ~109

Read the public posts carrying a given hashtag in Nextcloud Social.

NameTypeReqDescription
hashtagstringyesThe hashtag, without the leading #
limitnumber–Statuses to return (default 20, max 50)
localboolean–Only posts from this Nextcloud server (default false)
max_idnumber–Only statuses older than this status id (page back)
min_idnumber–Only statuses newer than this status id (page forward)

No output schema declared.

No examples provided.

social_home_timeline ~85

Read the home timeline in Nextcloud Social: posts from the accounts this user follows, newest first.

NameTypeReqDescription
limitnumber–Statuses to return (default 20, max 50)
max_idnumber–Only statuses older than this status id (page back)
min_idnumber–Only statuses newer than this status id (page forward)

No output schema declared.

No examples provided.

social_list_account_follows ~118

List the followers of a fediverse account, or the accounts it follows.

NameTypeReqDescription
accountstringyesAccount id, or the handle (user@server)
directionstringyesfollowers = who follows this account; following = who this account follows
limitnumber–Statuses to return (default 20, max 50)
max_idnumber–Only statuses older than this status id (page back)
min_idnumber–Only statuses newer than this status id (page forward)

No output schema declared.

No examples provided.

social_list_follow_requests ~27

List the accounts waiting for this user to approve their follow request in Nextcloud Social.

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

social_list_notifications ~114

List this user’s Nextcloud Social notifications — mentions, follows, favourites, boosts and poll results — grouped so that forty favourites of one post read as one line.

NameTypeReqDescription
exclude_typesarray–Skip these types
limitnumber–Notifications to read before grouping (default 20, max 50)
max_idnumber–Only notifications older than this id (page back)
typesarray–Only these types, e.g. ["mention","follow","favourite","reblog"]

No output schema declared.

No examples provided.

social_list_saved_statuses ~102

List the posts this user has favourited or bookmarked in Nextcloud Social.

NameTypeReqDescription
kindstringyesWhich collection to read: favourites (starred) or bookmarks (saved)
limitnumber–Statuses to return (default 20, max 50)
max_idnumber–Only statuses older than this status id (page back)
min_idnumber–Only statuses newer than this status id (page forward)

No output schema declared.

No examples provided.

social_list_timeline ~112

Read the timeline of one of this user’s Social lists. Call it without list_id first to see the available lists and their ids.

NameTypeReqDescription
limitnumber–Statuses to return (default 20, max 50)
list_idnumber–The list to read; omit to list the available lists instead
max_idnumber–Only statuses older than this status id (page back)
min_idnumber–Only statuses newer than this status id (page forward)

No output schema declared.

No examples provided.

social_lookup_account ~51

Look up one fediverse account by handle in Nextcloud Social and return its profile and counts.

NameTypeReqDescription
acctstringyesThe handle: user for a local account, user@server for a remote one

No output schema declared.

No examples provided.

social_post_status ~232

Publish a post from this user's Nextcloud Social account. This publishes to the fediverse: the action is delivered to other servers immediately and cannot be recalled. A public post is world-readable. Supports replies, media attachments (see social_upload_media), polls, content warnings and visibility. Confirm the wording and the visibility with the user before calling this.

NameTypeReqDescription
in_reply_to_idnumber–Numeric id of the status this replies to
languagestring–ISO 639 language code of the post, e.g. en
media_idsarray–Media ids returned by social_upload_media
pollobject–Attach a poll to the post
sensitiveboolean–Mark attached media as sensitive
spoiler_textstring–Content warning shown in place of the post until the reader expands it
statusstringyesThe text of the post
visibilitystring–Who sees it: public (default, world-readable and listed), unlisted, private (followers only), direct (mentioned accounts only). An unrecognised value is treated as direct

No output schema declared.

No examples provided.

social_public_timeline ~110

Read the public timeline in Nextcloud Social — every public post this server knows about. Set local to true for posts from this server only.

NameTypeReqDescription
limitnumber–Statuses to return (default 20, max 50)
localboolean–Only posts from this Nextcloud server (default false)
max_idnumber–Only statuses older than this status id (page back)
min_idnumber–Only statuses newer than this status id (page forward)

No output schema declared.

No examples provided.

social_respond_follow_request ~98

Approve or reject a pending follow request in Nextcloud Social. This publishes to the fediverse: the action is delivered to other servers immediately and cannot be recalled. A public post is world-readable. Approving lets that account see this user’s followers-only posts.

NameTypeReqDescription
account_idstringyesThe id of the requesting account, from social_list_follow_requests
actionstringyesauthorize to approve, reject to decline

No output schema declared.

No examples provided.

social_search ~125

Search Nextcloud Social for accounts, hashtags or post content. Set resolve to true to fetch a handle or post URL this server has never seen — that contacts the remote server.

NameTypeReqDescription
limitnumber–Results per kind (default 20, max 40)
qstringyesThe search query: text, a handle, a hashtag or a post URL
resolveboolean–Fetch an unknown handle or URL from its home server (default false)
typestring–Restrict the search to one kind of result; omit to search all three

No output schema declared.

No examples provided.

social_status_history ~37

List the successive versions of a post that has been edited in Nextcloud Social.

NameTypeReqDescription
status_idnumberyesThe numeric status id

No output schema declared.

No examples provided.

social_unbookmark ~32

Remove a bookmark from a post in Nextcloud Social.

NameTypeReqDescription
status_idnumberyesThe numeric status id

No output schema declared.

No examples provided.

social_unboost ~32

Undo a boost of a post in Nextcloud Social.

NameTypeReqDescription
status_idnumberyesThe numeric status id

No output schema declared.

No examples provided.

social_unfavourite ~35

Remove this user’s favourite from a post in Nextcloud Social.

NameTypeReqDescription
status_idnumberyesThe numeric status id

No output schema declared.

No examples provided.

Install

How do I install the AIquila — Nextcloud MCP Server server?

AIquila — Nextcloud MCP Server runs locally as an npm package, launched with npx -y aiquila-mcp. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.

npm · aiquila-mcp

# add to Claude Code
claude mcp add elgorro-aiquila-mcp -- npx -y aiquila-mcp
Common questions

What is the AIquila — Nextcloud MCP Server server?

AIquila — Nextcloud MCP Server is listed in the public MCP registry as io.github.elgorro/aiquila-mcp. Nextcloud MCP server, 345 tools: files, calendar, contacts, mail, Talk, Deck, photos, maps, notes. This page covers its npm package (aiquila-mcp).

Is the AIquila — Nextcloud MCP Server server safe to use?

AIquila — Nextcloud MCP Server scores 89 out of 100 on VerifyMCP. We recorded 1 known advisory against it as of 5 November 2026. It declares no install or post-install scripts. Its build provenance is signed and verified. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

What tools does the AIquila — Nextcloud MCP Server server expose?

AIquila — Nextcloud MCP Server exposes 345 tools: list_files, read_file, write_file, create_folder, delete, and 340 more. Their descriptions and schemas cost roughly 23,946 tokens of context every time the server is loaded.

Is the AIquila — Nextcloud MCP Server server still maintained?

AIquila — Nextcloud MCP Server is still listed as active in the MCP registry. We last reached this channel on 5 November 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.

What licence is the AIquila — Nextcloud MCP Server server under?

AIquila — Nextcloud MCP Server declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.