diff --git a/CHANGELOG.md b/CHANGELOG.md index 835a16e8ff..8a615bacbf 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -15,6 +15,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 ### Fixed - Fixed the flickering of the navigation items in the header for logged-in users +- Fixed the description of the `ROOT_URL` requirement for the server of the Model Context Protocol (MCP) (experimental) ## 3.97.0 - 2026-11-02 diff --git a/README.md b/README.md index 00ae13e290..f8c3c92b89 100644 --- a/README.md +++ b/README.md @@ -110,7 +110,7 @@ Find answers to commonly asked questions about self-hosting Ghostfolio in our [F | `REDIS_PORT` | `number` | | The port where _Redis_ is running | | `REDIS_TLS` | `boolean` (optional) | `false` | Enables TLS/SSL connection to _Redis_ | | `REQUEST_TIMEOUT` | `number` (optional) | `3000` | The timeout of network requests to data providers in milliseconds | -| `ROOT_URL` | `string` (optional) | `http://0.0.0.0:3333` | The root URL of the Ghostfolio application, used for generating callback URLs and external links. | +| `ROOT_URL` | `string` (optional) | `http://0.0.0.0:3333` | The root URL of the Ghostfolio application, used for generating callback URLs and external links. The endpoint of the _Model Context Protocol_ (MCP) accepts only requests to the host name of this URL. | | `TRUST_PROXY` | `string` (optional) | | The [trust proxy](https://expressjs.com/en/guide/behind-proxies.html) setting of _Express.js_ to determine the client IP address for rate limiting, e.g. `1` if the Ghostfolio application runs behind a single reverse proxy | #### OpenID Connect OIDC (experimental) @@ -405,7 +405,7 @@ The _Model Context Protocol_ (MCP) server lets an AI client read your portfolio, ### Prerequisites - Set `ENABLE_FEATURE_MCP` to `true` -- Set `ROOT_URL` to the public URL of your instance if a client calls the endpoint from a browser page. The host name of `ROOT_URL` is the only accepted origin. +- Set `ROOT_URL` to the public URL of your instance. The clients must use the host name of this URL: the endpoint accepts only requests to this host name, and a request from a browser page only with this host name as origin. If a reverse proxy is in front of your instance, it must send the original `Host` header. - Grant an access of the type _MCP_ in _My Ghostfolio_ under _Access_ and copy its token An _MCP_ access with the _Restricted view_ permission reads the portfolio without the monetary values. Grant the _View_ permission to let the client also read the monetary values. Grant the _Restricted view and manage_ or the _View and manage_ permission to let the client also import activities and update the cash balances of your accounts. @@ -415,7 +415,7 @@ An _MCP_ access with the _Restricted view_ permission reads the portfolio withou Point the client to the endpoint below and set the MCP access token as the _Bearer Token_. ``` -POST http://localhost:3333/mcp +POST /mcp "Authorization": "Bearer " ``` diff --git a/apps/api/src/main.ts b/apps/api/src/main.ts index 8139feea45..6b60d49c05 100644 --- a/apps/api/src/main.ts +++ b/apps/api/src/main.ts @@ -151,7 +151,7 @@ async function bootstrap() { const { hostname } = new URL(configurationService.get('ROOT_URL')); logger.warn( - `The Model Context Protocol (MCP) is enabled, but ROOT_URL is not set. A client which calls the endpoint from a browser page is accepted only with the origin ${hostname}.` + `The Model Context Protocol (MCP) is enabled, but ROOT_URL is not set. The endpoint accepts only requests to the host name ${hostname}. Set ROOT_URL to the public URL of the instance.` ); }