Start on loopback
The default server binds to a random port on 127.0.0.1 and uses a bearer token. This is the right shape for a local MCP client and the baseline to preserve when adding a tunnel or proxy.
dir2mcp upThe startup output prints the actual MCP URL. Run dir2mcp doctorbefore sharing the endpoint; it checks providers, extraction coverage, indexing failures, and whether configured capabilities reach third-party hosts.
Run the release container
The multi-architecture container keeps corpus access read-only and stores the index in a named volume. It publishes the endpoint to loopback only.
docker run --rm -p 127.0.0.1:8080:8080 -v "$PWD:/corpus:ro" -v dir2mcp-state:/state ghcr.io/dirstral/dir2mcp:latestMount a .dir2mcp.yaml with the corpus or supply provider credentials through the container environment. The image includes ffmpeg but not docling.
Put TLS in front
Pin a local port, then point Cloudflare Tunnel or another reverse proxy at it. When the origin remains loopback-bound, the proxy must send a loopbackHost header so the MCP SDK's DNS-rebinding protection remains enabled.
dir2mcp up --listen 127.0.0.1:8087cloudflared tunnel --url http://127.0.0.1:8087 --http-host-header 127.0.0.1:8087Do not disable localhost protection to make a proxy work. Keep authentication enabled, use TLS for any non-local route, and verify the public endpoint with the repository's hosted smoke script.
Place compute beside the work
For a large archive, run the daemon on a GPU host beside embedding, OCR, and speech servers. Read the corpus from an NFS mount or an S3-compatible source, while keeping SQLite, indexes, and caches on fast local disk.
Exact-search embedded indexes are the zero-infrastructure default. At larger corpus sizes, Qdrant and pgvector are available as shared approximate-search backends. Changing the embedding provider, model, or dimension requires a full reindex because those settings define the vector space.