patentdev/patent-connector repository overview

⁠Patent Connector - CLI & MCP Server

Agentic-AI-first toolkit for patent and trademark research: a patent CLI and a server that give AI agents and applications one uniform interface to the official IP offices, using your own API keys (BYOK, stored encrypted).

One image, two roles:

• CLI tool - built agentic-first: an agent (Claude Code, etc.) or you can drive it from the terminal, running patent and trademark lookups in-process or against a server.
• Server - the long-lived service this image runs (patent server): an MCP endpoint for AI agents, a REST API for apps and the CLI, and a web dashboard to manage your account and provider credentials.

Data sources - official patent and trademark offices:

• EPO OPS - European Patent Office / Europäisches Patentamt (Open Patent Services)
• USPTO ODP - United States Patent and Trademark Office (Open Data Portal)
• USPTO TSDR - US trademark status and document retrieval
• EUIPO - EU Intellectual Property Office (trademarks and designs)
• DPMA - Deutsches Patent- und Markenamt (German Patent and Trade Mark Office)
• IP Australia - Australian patents, trade marks and designs
• JPO - Japan Patent Office / 特許庁
• TIPO - Taiwan Intellectual Property Office / 經濟部智慧財產局
• INPI France - Institut national de la propriété industrielle (French patents, trademarks and designs)
• Global Dossier - USPTO Global Dossier: public EP/JP/KR/CN file wrappers (office actions, decisions, EP opposition and appeal filings) as PDFs and page images; no API key required, self-hosted deployments only
• Lens - Lens.org: patent documents from 100+ jurisdictions with forward citations, DOCDB families and calculated legal status (bring your own Lens API token)
• Patent Reference server - built-in corpus of CPC/IPC classification and examination manuals (MPEP, EPO Guidelines); no API key required
• and more

Homepage: https://patent.dev⁠

⁠Setup

Use the hosted service - sign in at https://patent.dev/patent-connector/⁠, then add the MCP endpoint https://patent.dev/mcp to your AI client, or run patent login for the CLI.

Run it fully on-prem (the server and in-process tools) - get in touch at [email protected]⁠. Write the free license into a persistent volume so the server picks it up automatically:

# 1) register (an activation code is sent to your email):
docker run --rm patentdev/patent-connector patent register --email [email protected]

# 2) activate, storing the license in a persistent volume:
docker run --rm -v patent-data:/app/data \
  patentdev/patent-connector patent activate <code>

The license lands at /app/data/patent.license (the image's default PATENT_LICENSE_FILE); mount the same patent-data volume into the server below.

Or license from the browser. Start the server without a license and it does not crash - it serves a setup page at your BASE_URL with live deployment diagnostics (reachability, certificate, DNS, SMTP). Paste a lic_... key there, confirming with the one-time setup code printed in docker logs, or set PATENT_LICENSE_KEY in the environment. The server restarts into normal mode as soon as a valid license is present - including when it is minted or renewed on our side, with nothing to do on the box. An unlicensed instance only contacts license.patent.dev to check its own license; nothing else is sent. Because it serves this page rather than exiting, keep a restart policy on the container (restart: unless-stopped, already in the examples below).

⁠Self-host quick start

The dataset is tiny (accounts and settings), so the bundled SQLite backend is plenty - persist one volume and you are done.

services:
  patent-connector:
    image: patentdev/patent-connector:latest
    restart: unless-stopped
    ports:
      - "8080:8080"
    environment:
      BASE_URL: http://localhost:8080      # externally reachable URL
      ENCRYPTION_KEY: ${ENCRYPTION_KEY}     # 32 hex chars: openssl rand -hex 16
      # Sign-in is passwordless: a one-time code is emailed. Configure SMTP so
      # users can self-serve login (no relay? mint a code with `issue-code`, below):
      SMTP_HOST: smtp.example.com          # your mail server / relay
      SMTP_FROM: [email protected]        # from address for sign-in codes
      # SMTP_USER/SMTP_PASS: set both if the relay needs a login; omit both for
      # an internal relay that authorizes by IP.
      # DB (SQLite) and license default into /app/data, the mounted volume below.
      # For MySQL, override DATABASE_URL with a DSN:
      # DATABASE_URL: user:pass@tcp(host:3306)/patent_mcp?parseTime=true
    volumes:
      - patent-data:/app/data

volumes:
  patent-data:

export ENCRYPTION_KEY=$(openssl rand -hex 16)
docker compose up -d

Open http://localhost:8080⁠ and sign in with your email - login is passwordless: you enter your email, receive a one-time 6-digit code by email (delivered via the SMTP relay above), and enter it. Then add your provider API keys in the dashboard. Set BASE_URL to the exact URL you open in the browser (on a LAN that is something like http://192.168.1.55:8080; behind a proxy, your https:// URL) - the login cookie follows BASE_URL, so over plain HTTP this keeps the dashboard login working.

No mail relay? Sign-in codes are normally emailed (configure SMTP above). Without SMTP, mint a code on the host and type it on the sign-in page - handy for the first admin login or whenever email is unavailable:

docker exec <container> patent server issue-code --email [email protected]

⁠HTTPS without a reverse proxy

AI assistants (Claude, ChatGPT) only connect to HTTPS endpoints on the standard port, and the server can terminate TLS itself - no Caddy/nginx/Traefik needed:

services:
  patent-connector:
    image: patentdev/patent-connector:latest
    restart: unless-stopped
    ports:
      - "443:443"
      - "80:80"    # Let's Encrypt HTTP-01 challenge + redirect to HTTPS
    environment:
      BASE_URL: https://patents.acme.com   # DNS must point at this host
      ENCRYPTION_KEY: ${ENCRYPTION_KEY}
      TLS_ACME: "true"                     # automatic Let's Encrypt certificate
      TLS_ACME_EMAIL: [email protected]          # optional: CA expiry notices
      SMTP_HOST: smtp.acme.com
      SMTP_FROM: [email protected]
      # Optional: dashboard (and login) only from your offices/VPN; connected
      # assistants keep working from anywhere (they authenticate with tokens):
      # WEBUI_ALLOWED_CIDRS: 203.0.113.0/24,2001:db8:acme::/48
    volumes:
      - patent-data:/app/data

volumes:
  patent-data:

With TLS_ACME=true the listen port defaults to 443 and certificates are obtained and renewed automatically (cached in /app/data, so keep the volume). Issuance retries in the background with backoff - but do not delete the volume and restart repeatedly against the production CA, Let's Encrypt rate-limits failed attempts per hour. Prefer your own certificates? Set TLS_CERT_FILE/TLS_KEY_FILE instead; renewed files are picked up without a restart. A server without public ingress (LAN/VPN) can still get Let's Encrypt certificates via the DNS-01 challenge (TLS_ACME_DNS_PROVIDER + TLS_ACME_DNS_API_TOKEN).

A classic reverse proxy in front remains fully supported: terminate TLS there, set BASE_URL to the public HTTPS URL, and bind the port locally (ports: ["127.0.0.1:8080:8080"]) so only the proxy reaches it. If you combine a proxy with WEBUI_ALLOWED_CIDRS, also set TRUSTED_PROXIES to the proxy's address - otherwise every request appears to come from the proxy and the allowlist cannot see real client addresses.

⁠Environment variables

Provider API keys (EPO OPS, USPTO, EUIPO, ...) are not set via environment variables - add them in the dashboard after first login; they are stored encrypted with ENCRYPTION_KEY.

⁠Admin console & shared credentials

The first account to sign in becomes the instance admin automatically. To promote another existing account from the host:

docker exec <container> patent server make-admin --email [email protected]

Offboarding from the host (also works when the user cannot log in themselves):

docker exec <container> patent server delete-user --email [email protected]

Admins open the console at <BASE_URL>/#/admin: instance diagnostics, user management (grant/revoke admin and delete accounts; the last admin and the shared-credentials source are protected), and shared credentials for firm-wide use - designate one account (a dedicated service account like [email protected] works best) whose provider credentials every user transacts under. Providers configured on that account are locked for other users; rotate a key by updating it on the source account and it propagates instantly. Providers the source lacks stay configurable per-user.

⁠Persistence

Persist /app/data - it holds the SQLite database, the license file and the Let's Encrypt certificate cache. Keep your ENCRYPTION_KEY stable and backed up; it decrypts stored provider credentials, so losing it means re-entering all provider keys.

⁠Health and debugging

The container exposes a health endpoint and ships with curl and jq:

curl -s http://localhost:8080/health | jq
docker exec <container> curl -s http://localhost:8080/health | jq

⁠Support

• Web: https://patent.dev⁠
• Email: [email protected]⁠

Envisioned and crafted by Wolfgang Stark - patent.dev - Funktionslust GmbH