Feature Request: Enable MCP and Access Tokens flags in Penpot (or expose EXTRA_PENPOT_FLAGS)

[sanoker]

Hi everyone,

I am trying to set up the new official Penpot MCP (Model Context Protocol) server to integrate my self-hosted Penpot instance with local AI coding clients like Cursor and Claude Desktop.

Currently, this is impossible on the Cloudron deployment because the necessary UI elements ("Integrations" and "Access Tokens" in the account settings) are hidden behind Penpot feature flags that are not enabled in the Cloudron package.

Because Cloudron dynamically constructs PENPOT_FLAGS on startup, manually editing env.sh to add these flags gets ignored/overwritten.

Could we get one of the following implemented in the next package update?

Option A (Ideal): Enable the enable-mcp and enable-access-tokens flags by default in the app's startup script, as these are becoming standard features for modern AI workflows.

Option B (Flexible): Expose an EXTRA_PENPOT_FLAGS variable in env.sh that gets appended to the main string on startup. This would allow advanced users to opt-in to new Penpot backend features without waiting for package updates.

Thanks for maintaining this package! Let me know if there is a temporary workaround I can use in the meantime.

[james]

Hello @sanoker and welcome to the Cloudron forum

Can you please share what you have configured in the env.sh?

[sanoker]

I created a /app/data/env.sh file and tried adding the following line:

export PENPOT_FLAGS="enable-registration enable-login-with-password enable-access-tokens enable-mcp"

After saving the file and completely restarting the app via the Cloudron dashboard, the "Integrations" and "Access Tokens" UI elements still do not appear in the Penpot account settings.

My assumption was that the Cloudron deployment's internal startup script dynamically generates or overrides the PENPOT_FLAGS variable (perhaps to ensure SMTP or OIDC settings stay intact) and is ignoring the manual export in env.sh.

If there is a specific syntax I should be using in env.sh to append custom flags without them getting overwritten by the system, please let me know! Otherwise, having a supported way to inject flags like EXTRA_PENPOT_FLAGS would be really helpful.

[james]

Hello @sanoker
The @penpot app does not have the logic to handle an /app/data/env.sh file.
I can look into adding enable-access-tokens and enable-mcp to the app.

[Operator]

+1 for this.

I’ve just hit the same limitation on a Cloudron-hosted Penpot 2.16.0 instance.

The frontend bundle appears to include the MCP / access-token UI code, but the features are not available because the required flags are not active. In our live app, /js/config.js shows penpotFlags without enable-mcp or enable-access-tokens, and /mcp/stream, /mcp/sse, and /mcp/ws currently route to 404.

So I think this is exactly the right package-level fix:

• enable enable-access-tokens
• enable enable-mcp
• ideally expose something like EXTRA_PENPOT_FLAGS for future opt-in flags

The flexible EXTRA_PENPOT_FLAGS option would be especially useful because Penpot is moving quickly and Cloudron users may need to opt into new official features before the package defaults catch up.

Thanks for looking into this happy to test once there’s a package update or workaround.