ni-c/rustpad-mcp

A Model Context Protocol (MCP) server for
Rustpad, the efficient, minimal,
self-hosted collaborative text editor.
Lets MCP clients like Claude Code, Claude Desktop or Codex read and write the pads of
a Rustpad instance: fetch a document, create one, replace it wholesale or edit it in
place.
Eight tools is the ceiling, not the floor: RUSTPAD_ALLOW_TOOLS=essential
registers a curated five instead, and a model picks the right tool far more
reliably from five than from eight — see
choosing which tools load.
Reads go through Rustpad's HTTP API; writes speak the operational-transformation
WebSocket protocol, so targeted edits (append_to_document, replace_in_document)
merge cleanly with what human collaborators type at the same time instead of
overwriting it. While the server edits a pad, it is visible to everyone in the pad as
a collaborator named rustpad-mcp.
**The two edits that cannot be undone ask a person.** Where the client supports
MCP elicitation, replacing a non-empty pad and search-replacing across more than
one match raise a real dialog that the model cannot answer on its behalf — and
the replace_in_document one says how many places are about to change. Where it
does not, they fall back to a two-call token, and say so rather than implying
somebody approved. ELICITATION=false takes that fallback deliberately; it
never removes the guard. See
Asking a person.
What makes it different
**Real OT edits, not overwrites.** append_to_document and replace_in_document
retain everything they do not touch, and the Rustpad server transforms concurrent
edits — a human typing in the same pad at the same moment loses nothing. The model
shows up in the pad as a named collaborator.
**Built for an unauthenticated world.** Rustpad has no accounts, so every pad is
untrusted by definition. Everything that comes out of one — reads, metadata, even
upstream error bodies — is explicitly marked as data, never instructions, before a
model sees it.
Requirements
- A reachable Rustpad instance (self-hosted; the server is stateless and
needs no credentials — Rustpad has no authentication)
- Node.js >= 22, or Docker
Configuration
| Variable | Required | Description |
| ---------------------- | -------- | ---------------------------------------------------------------------------------- |
| RUSTPAD_URL | yes | Base URL of the instance, e.g. https://rustpad.example.net |
| RUSTPAD_READ_ONLY | no | true, 1 or yes registers only the read tools |
| RUSTPAD_INSECURE_TLS | no | true accepts self-signed certificates (scoped to this connection only) |
| RUSTPAD_ALLOW_TOOLS | no | Comma-separated tool names, list_* prefixes, or essential for a curated preset |
| RUSTPAD_DENY_TOOLS | no | Same syntax; removed from whatever RUSTPAD_ALLOW_TOOLS left |
| ELICITATION | no | false replaces the approval dialog with the two-call token. **Not prefixed** |
The same URL serves the HTTP API, the WebSocket endpoint and the share links
returned by the tools ( /# ). The RUSTPAD_* booleans must
be exactly true. The server starts and lists its tools without configuration;
every call then fails with setup instructions.
ELICITATION is the odd one out twice over: it carries no prefix, so it reaches
every MCP server in the same environment, and a value that is neither true nor
false stops the server rather than falling back — it is the only variable here
that defaults to _on_, and a typo would otherwise leave the dialog running while
you believed it was off. A server started with it off prints one line saying so.
Keep in mind what Rustpad is: **pads are ephemeral** (lost on server restart
and after 24 hours of inactivity, unless the instance is run with
SQLITE_URI) and **anyone who knows a pad id can read and write it**. Do not