
Security News
Deno Goes the Way of the Dinosaur
Cloudflare is acquiring Deno’s team, which will provide another year of bug fixes and security updates before ending support for the runtime.
doco-agent-cli
Advanced tools
Doco CLI and MCP server — one command to connect your AI agent to your knowledge base. Block-level addressing, optimistic concurrency, 29 MCP tools.
The Doco CLI and MCP server — one command to connect your AI agent to your knowledge base.
Doco is the document space where humans and AI agents write together: block-level stable addressing, optimistic concurrency, and a 29-tool MCP server. See doco.page for the product and the API reference for the OpenAPI 3.1 spec.
# 1. Log in (browser device authorization, same mental model as the GitHub CLI)
npx -y --package doco-agent-cli doco login
# 2. Use it
npx -y --package doco-agent-cli doco whoami
npx -y --package doco-agent-cli doco docs ls
npx -y --package doco-agent-cli doco docs cat <docId> -f md
npx -y --package doco-agent-cli doco edit <docId> # pulls Markdown into $EDITOR; saving writes back
claude mcp add doco -- npx -y --package doco-agent-cli doco mcp
Cursor: paste into MCP settings
{ "doco": { "command": "npx", "args": ["-y", "--package", "doco-agent-cli", "doco", "mcp"] } }
Codex (~/.codex/config.toml):
[mcp_servers.doco]
command = "npx"
args = ["-y", "--package", "doco-agent-cli", "doco", "mcp"]
Gemini CLI (~/.gemini/settings.json or project .gemini/settings.json):
{ "mcpServers": { "doco": { "command": "npx", "args": ["-y", "--package", "doco-agent-cli", "doco", "mcp"], "trust": false } } }
VS Code Copilot (.vscode/mcp.json, or portable workspace .mcp.json):
{ "servers": { "doco": { "type": "stdio", "command": "npx", "args": ["-y", "--package", "doco-agent-cli", "doco", "mcp"] } } }
See the client-specific integration guide for verification and security notes.
MCP toolset (29 tools, deliberately restrained): doco_whoami / doco_list_knowledge_bases / doco_get_tree /
doco_list_documents / doco_search / doco_search_v2 / doco_get_document / doco_outline / doco_read / doco_get_blocks / doco_patch_block /
doco_insert_blocks / doco_delete_block / doco_batch_edit / doco_create_document /
doco_upload_attachment / doco_changes / doco_traverse / doco_create_relation /
doco_summary / doco_save_summary / doco_rebuild_summary / doco_update_document / doco_concepts /
doco_edit_concepts / doco_refresh_concept_candidates / doco_translations / doco_translation_units /
doco_review_translation_unit. Concepts and translations are grouped by action instead of
exploding into per-CRUD tools. Enumerable, subscribable resources are also exposed:
doco://kb/<id>, doco://doc/<id>.md, doco://doc/<id>/outline.json.
For headless MCP use, environment variables replace doco login: DOCO_TOKEN, DOCO_BASE_URL.
Doco 同时提供远程 Streamable HTTP MCP 入口:
https://api.doco.page/mcp。它是无状态服务,每个请求都必须携带调用者自己的 Doco API
Token;Token 只允许通过 Authorization: Bearer ... 或 X-Doco-Token 请求头传递,不能放进 URL
或 Cookie。服务不会共享或落盘请求中的 Token。
Smithery 的 URL 发布需要把 X-Doco-Token 配置为请求头。使用 Smithery CLI 发布时可以这样声明:
smithery mcp publish "https://api.doco.page/mcp" -n @songofhawk/doco \
--config-schema '{"type":"object","properties":{"docoToken":{"type":"string","description":"Doco API Token","x-from":{"header":"x-doco-token"}}},"required":["docoToken"]}'
在网页表单中先填写同一个 URL;若页面要求配置字段,字段名使用 docoToken,传输位置选择
HTTP header,名称为 x-doco-token。不要把真实 Token 拼进发布 URL。当前远程入口使用 Doco
API Token,而不是 OAuth;需要 OAuth 的客户端应继续使用本地 stdio MCP,或等待 Doco OAuth
授权服务单独上线。为便于目录扫描,initialize 和 tools/list 允许无 Token;实际工具调用
仍始终要求调用者自己的 Token。
doco login [--base-url <url>] [--token <token>] [--scope read_write|read_only] [--no-browser]
doco logout
doco whoami
doco docs ls [--kb <id>] [--folder <id>] [--q <query>] [--locale <BCP47>] [--include-variants] [--limit <n>]
doco docs languages <docId>
doco docs cat <docId> [-f md|json|html] [--locale <BCP47>]
doco docs new --title <title> (--kb <id>|--folder <id>) [--body -] # --body - reads Markdown from stdin
doco blocks ls <docId> [--recursive]
doco blocks patch <docId> <blockId> --node @node.json [--attrs '<json>'] [--content '<json>']
doco blocks insert <docId> --nodes @nodes.json [--after <blockId>|--before <blockId>|--parent <blockId>|--start|--end]
doco blocks delete <docId> <blockId>
doco changes <docId> [--after <cursor>] [--locale <BCP47>] [--limit <n>]
doco read <docId> [--view markdown|tiptap-json|plain-text|outline] [--locale <BCP47>] [--around <blockId>] [--max-tokens <n>] [--cursor <cursor>]
doco search --q <query> [--mode topk|exhaustive] [--locale <BCP47|all>] [--kb <id>] [--limit <n>] [--cursor <cursor>]
doco links ls <docId> [--direction outgoing|incoming|both] [--predicate <type>]
doco links add <docId> <sourceBlockId> --target <doco://doc/...> [--predicate <type>] [--anchor <text>]
doco links delete <relationId>
doco summary get <id> [--scope document|folder|knowledge-base] [--block <blockId>] [--q <question>]
doco summary set <id> --text <summary> [--scope document|folder|knowledge-base] [--block <blockId>] [--pinned]
doco summary rebuild <id> [--scope document|folder|knowledge-base] [--block <blockId>] [--generator deterministic|model]
doco summary job <jobId>
doco concepts ls [--kb <id>] [--q <query>] [--status <status>] [--limit <n>] [--cursor <cursor>]
doco concepts get <conceptId>
doco concepts create --kb <id> --name <name> [--description <text>] [--aliases <json|@file>]
doco concepts update <conceptId> [--name <name>] [--description <text>] [--aliases <json|@file>]
doco concepts sources <conceptId> --sources <json|@file>
doco concepts relate <conceptId> --relations <json|@file>
doco concepts merge <sourceConceptId> <targetConceptId>
doco concepts traverse <conceptId> [--direction outgoing|incoming|both] [--predicate <type>]
doco concepts candidates [--kb <id>] [--status pending|accepted|rejected] [--min-confidence <0..1>]
doco concepts extract --target <documentId>
doco concepts accept <candidateId> [--concept <conceptId>] [--name <name>]
doco concepts reject <candidateId> [--reason <reason>]
doco edit <docId> [--block <blockId>]
doco mcp
doco skill [install] [--target codex|claude] # prints / installs the full Doco agent skill
markdown and tiptap-json views read the whole document unless --around, --max-tokens,
or --cursor is given. Pass --max-tokens explicitly to bound context; truncation is reported
on stderr together with a next_cursor.
Global --json prints machine-parseable JSON; human-readable output is the default.
Every write command runs the golden loop automatically:
version (ETag).If-Match.Concept updates, source/relation edits, merges, and candidate reviews also read the ETag and
send If-Match automatically; concept creation, candidate extraction, and the edits above all
generate an Idempotency-Key. Complex aliases / sources / relations arrays accept inline
JSON or @data.json file input.
On conflict, doco edit reopens your editor with the latest content while your previous draft
is saved as document.conflict-N.md for merging — blind overwrites never happen.
Defaults to https://api.doco.page/api/v1; override with --base-url / DOCO_BASE_URL
for local development or self-hosted instances. Config lives in ~/.config/doco/config.json
(mode 0600):
{ "base_url": "https://api.doco.page/api/v1", "token": "doco_tok_…" }
Environment variables take precedence over the config file: DOCO_BASE_URL, DOCO_TOKEN, DOCO_CONFIG_DIR.
doco skill install --target codex # installs to ~/.codex/skills/doco/
doco skill install --target claude # installs to ~/.claude/skills/doco/
The package ships the operating protocol, UI metadata, an acceptance matrix, and isolation verification scripts. The agent works as discover → evidence → act → review → report, running the ETag/If-Match golden loop on every write.
120 requests/min per token, 30 writes/min, 10 writes/min per document; on 429, respect Retry-After.
FAQs
Doco CLI and MCP server — one command to connect your AI agent to your knowledge base. Block-level addressing, optimistic concurrency, 29 MCP tools.
We found that doco-agent-cli demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
Cloudflare is acquiring Deno’s team, which will provide another year of bug fixes and security updates before ending support for the runtime.

Security News
Anthropic’s free OSS Scanner uses Mythos and other Claude models to find open source vulnerabilities and send maintainers reports with proposed fixes.

Security News
On Front Lines’ Early Adopters: CISO podcast, Andrew Becherer shares lessons from Datadog, weighs the long-term costs of AI-built tools, and explains how founders can actually gain a CISO’s trust.