Nextcloud MCP Server: why it is not safe to use

What we found

Our review did not find hidden instructions, hardcoded real secrets, obfuscated code, or signs of privilege escalation. The concern is operational scope. This skill can perform broad write and delete actions in Nextcloud, including mail deletion, share management, posting messages, and create, update, or delete actions across notes, files, calendars, contacts, deck, tables, and collectives. The README does not state a universal user-confirmation step for these actions.

We also found optional features that can send user content from Nextcloud to configured external services, such as embedding or reranking providers, OTLP collectors, and managed hosting components. Some documented container features also fetch remote model weights on first boot. In addition, the skill legitimately handles Nextcloud app passwords and, in multi-user setups, may receive credentials through Authorization headers or obtain per-user app passwords via Login Flow v2, with encrypted SQLite storage described for hosted flows.

What to do instead

Use this skill only with the minimum Nextcloud permissions needed, disable optional external integrations unless required, and avoid hosted or multi-user credential flows unless you have reviewed where data and tokens are stored and sent. Prefer a deployment with clear user confirmation for destructive actions and a network policy limited to only the services you intend to use.