Paperless-ngx

Getting a token

1. Sign in to Paperless-ngx, open the user menu → My Profile, and copy the API Auth Token (create one if the field is empty).
2. Put it in PAPERLESS_API_TOKEN and your instance's base URL in PAPERLESS_URL — no trailing slash and no /api, e.g. https://paperless.example.com.

The Authorization header is Token …, Django REST Framework's scheme — not Bearer. The adapter sends it correctly.

API version 9. Paperless-ngx picks the response format from the Accept: application/json; version=N header and answers 406 Not Acceptable to a version it no longer supports. 2.x accepts versions 1–9, 3.x only 9 and 10, so the adapter asks for 9, which both understand. In version 9 a document's created field is a date (no time).

Search is the point of this connector. paperless_ngx_search_documents passes a query to Paperless's full-text index, which searches the OCR'd content, not just the title. The index supports field terms (correspondent:acme, type:invoice, created:[2026-01-01 TO 2026-06-30]), quoted phrases and wildcards. paperless_ngx_list_documents is the structured alternative when you already know the correspondent or tag ids.

Documents reference everything by id. A document row carries correspondent, document_type and tags as numeric ids; resolve them with the three list tools, or ask for full_perms-style expansion in the UI. Reading content for a document is a separate call because the OCR text can be very large.

Permissions: Paperless-ngx 2.x supports per-document owners and per-object permissions. A token for a restricted user sees a smaller library and reports it as an empty page, not as an error.

Self-hosted, which is the thing to plan for.

• On AnythingMCP Cloud the instance must be reachable from the public internet on a real hostname with a valid TLS certificate. A self-signed certificate will fail: the connector offers no trust-anything switch.
• On an internal host (paperless.intern, 10.0.0.x), self-host AnythingMCP on the same network and add that host to SSRF_ALLOWED_HOSTS, or the outbound guard refuses the call before it is made.

Read-only by design: this adapter exposes no upload or delete. Documents are the audit trail; a wrong write there is not a thing an agent should be able to do by accident.