Nacre MCP — permission-aware document search for agents
Agent tools · reviewed listing
Nacre is a self-hosted, permission-aware context layer: one searchable index across an organisation's content, where every user and every agent sees only what they are authorised to see. Built for teams putting agents over internal documents where the reader boundary matters - regulated sectors, multi-team knowledge bases, anything holding records not everyone may read. The distinction that matters is where the filter runs. Most retrieval layers filter after the search, so a request for ten results returns however many survived, and the existence of the removed documents leaks through the count, the ranking and the latency. Nacre applies the permission predicate inside the index traversal, so top-k returns k permitted documents. Permissions are computed per request from live grants rather than copied into the index, so a revoked grant is reflected in the next search. A request without permission returns 404 rather than 403, so "not permitted" is indistinguishable from "does not exist". Retrieval is hybrid: dense vectors and BM25 fused with Reciprocal Rank Fusion, with optional cross-encoder reranking. Embeddings come from any OpenAI-compatible endpoint. Two interfaces - MCP for agents, REST for applications. Eleven MCP tools on /mcp since 0.29.0: search, list_layers, get_document, ingest_document, request_upload, upload_file, ingest_status, delete_document, list_skills, get_skill, update_skill. Administration is a second MCP server, at /mcp/admin: people, groups, layers, grants, skills and the access log from a sentence, with fifteen read tools and writes that are proposals a person applies rather than calls that take effect. It is separate for the same reason the rest of the product exists - documents are untrusted input, and a sentence inside one can ask an agent to grant somebody access. So there is no search, no get_document and no ingest_document on that surface, it carries its own token audience and its own consent, and only a person holding org_admin is ever offered it, never a service account. Connect over Streamable HTTP at /mcp, authenticated with OAuth2. It is an index you push documents into, over REST, MCP, the SDK or the CLI - UTF-8 text, PDF, Word, PowerPoint, Excel, OpenDocument, EPUB and RTF, S3-compatible object storage, URL ingest for text. Nothing crawls on the index's own account and you own the sync. Six Apache-2.0 reference connectors ship separately at https://github.com/nacre-work/connectors - git, S3, SQL, Google Drive, MongoDB and IMAP - each one container that pushes a single source and removes what the source dropped. There is no Confluence, SharePoint, Slack, Notion or Jira connector, and a connector is the customer's sync written once rather than the way in. The core is Apache-2.0 - the permission model, its test suite and the Helm chart included, nothing gated to get started - and it runs on your own infrastructure via Docker Compose on amd64 and arm64, or on Kubernetes with the chart at deploy/helm, attached to every release since 0.29.3. Nine commercial modules ship separately: tenancy (suspension, offboarding, quotas), SSO over OIDC with SCIM group sync, issuing document-level grants and deny rules, Enterprise-Managed Authorization and ID-JAG, SIEM forwarding, global admin, an encrypted backup of the whole installation, requiring a second factor, and filtered administration for directories too large to page through. Four things you would expect on that list are not on it: one vector collection per organization, evaluating grants and deny rules, the air-gapped Compose profile, and the audit log - writing it, reading it at GET /v1/audit and its JSONL and CSV export are all in the open repository. One thing to be clear about: the MCP endpoint listed here is a public demo stand, there so you can try it without installing anything. It erases each organisation after 24 hours and is capped at 200 documents. This is a self-hosted product with a stand in front of it, not a hosted service.
Agent tools reviewed 32 opens
Listing owners: outbound opens and referrers are on your private submission status bookmark (the thank-you / status link you saved when you submitted) — open the Analytics tab. That dashboard is only yours; the public page only shows the open count badge.