Connection check
verified live · 26h ago
ainote
Agent-native notes, tasks, dev-docs, vaults, sync & handoffs. MCP + OpenAPI dual surface.
Tools
35
GitHub stars
—
Installs / wk
52
Licence
—
Transport
streamable-http, stdio
Last checked
26h ago
Tools & capabilities
35 toolsRead from the running server on 26h ago.
assumption_write
idbmc_blockstatementproject_id*criticalityevidence_condition
Create or update an assumption under a project (L2 intent layer). Omit `id` to create, pass it to update. There is no delete tool. 🔴 `verdict` is REJECTED with an error if passed… Create or update an assumption under a project (L2 intent layer). Omit `id` to create, pass it to update. There is no delete tool. 🔴 `verdict` is REJECTED with an error if passed — verdict is confirmed only through a human judgment decision (see judgment_submit). This tool can only shape the assumption itself: what is being assumed, how critical it is, and what evidence would settle it.
auth_key
nameemailaction*password
Obtain an MCP key. action: login | signup (consolidated surface — same handlers as the legacy tools) Required per action — login: email, password | signup: email, password. Obtain an MCP key. action: login | signup (consolidated surface — same handlers as the legacy tools) Required per action — login: email, password | signup: email, password.
delete_dev_doc
can modify data
idtitlecategory
Soft-delete a dev document by title or UUID. Reversible from trash. Pass `category` when multiple docs share the same title across subcategories (memory/claude/cursor/env/docs). Soft-delete a dev document by title or UUID. Reversible from trash. Pass `category` when multiple docs share the same title across subcategories (memory/claude/cursor/env/docs).
delete_task
can modify data
id*
Soft-delete a task by ID. Destructive but reversible within 30 days (TaskCleanupJob purges trash daily at 2am KST). Returns 404 if the task does not exist or is not owned by the au… Soft-delete a task by ID. Destructive but reversible within 30 days (TaskCleanupJob purges trash daily at 2am KST). Returns 404 if the task does not exist or is not owned by the authenticated user.
dev_docs_read
read-only
idtitleaction*searchcategorycontent_type
+1
Read dev docs. action: get | list | categories | pull (consolidated surface — same handlers as the legacy tools) Read dev docs. action: get | list | categories | pull (consolidated surface — same handlers as the legacy tools)
dev_doc_write
idmodetitleaction*contentcategory
+3
Create or update a dev doc (non-destructive). action: create | update. Deletion is a separate tool (delete_dev_doc). (consolidated surface — same handlers as the legacy tools) Requ… Create or update a dev doc (non-destructive). action: create | update. Deletion is a separate tool (delete_dev_doc). (consolidated surface — same handlers as the legacy tools) Required per action — create: title, content | update: content.
env_sync_read
read-only
oplimitaction*cursordevice_idsince_hlc
+1
Read env-sync state. action: devices | drift | status | txn_pull. Secret reads are a separate tool (env_sync.secret_pull). (consolidated surface — same handlers as the legacy tools… Read env-sync state. action: devices | drift | status | txn_pull. Secret reads are a separate tool (env_sync.secret_pull). (consolidated surface — same handlers as the legacy tools)
env_sync.secret_pull
read-only
aliasnode_iddevice_id
Pull an encrypted secret blob. Response is ciphertext_b64 only — server never sees and never returns plaintext. Pull an encrypted secret blob. Response is ciphertext_b64 only — server never sees and never returns plaintext.
env_sync.secret_push
kind*alias*device_id*client_hlcrecipients*ciphertext_b64*
Push a new client-encrypted secret. Ciphertext only — server never sees plaintext. Recipients must include the pushing device's own pubkey. Push a new client-encrypted secret. Ciphertext only — server never sees plaintext. Recipients must include the pushing device's own pubkey.
env_sync.secret_rotate
can modify data
node_id*device_id*client_hlcnew_recipients*new_ciphertext_b64*
Rotate a secret: soft-delete the old node, create a new live node with the same alias and the new ciphertext+recipients. 7-day grace before hard delete of old ciphertext bytes. Rotate a secret: soft-delete the old node, create a new live node with the same alias and the new ciphertext+recipients. 7-day grace before hard delete of old ciphertext bytes.
env_sync_txn_push
can modify data
device_idoperations*
Ingest a batched envelope of client-recorded env_sync mutations. HLC-skew gated, partial-success on conflict. Ingest a batched envelope of client-recorded env_sync mutations. HLC-skew gated, partial-success on conflict.
env_sync_txn_rollback
can modify data
forcetxn_id*device_idinclude_descendants
Inverse-apply a prior env_sync transaction. Safety gates: ownership, idempotency, descendant-conflict (force opt-out). Inverse-apply a prior env_sync transaction. Safety gates: ownership, idempotency, descendant-conflict (force opt-out).
env_sync_write
osaliasaction*device_idage_pubkeyclient_hlc
+10
Non-destructive env-sync writes. action: enroll | request_share | heartbeat. Secret push/rotate are separate tools. (consolidated surface — same handlers as the legacy tools) Requi… Non-destructive env-sync writes. action: enroll | request_share | heartbeat. Secret push/rotate are separate tools. (consolidated surface — same handlers as the legacy tools) Required per action — enroll: alias, age_pubkey, enrollment_token | request_share: target_device_id, secret_shares, device_id | heartbeat: device_id, installed_skills_hash, installed_hooks_hash.
get_setup_guide
read-only
Get instructions for setting up AI Note MCP in Claude Desktop, Cursor, or other MCP clients. No authentication required. Get instructions for setting up AI Note MCP in Claude Desktop, Cursor, or other MCP clients. No authentication required.
graph_read
read-only
aliaslimitaction*cursornode_iddevice_id
+2
Read knowledge-graph nodes. action: get | list (consolidated surface — same handlers as the legacy tools) Read knowledge-graph nodes. action: get | list (consolidated surface — same handlers as the legacy tools)
graph_soft_delete
can modify data
node_id*device_id*client_hlc
Soft-delete an env_sync graph node (sets deleted_at; .live scope hides it from reads). Idempotent — re-deleting a deleted node is a no-op success. Soft-delete an env_sync graph node (sets deleted_at; .live scope hides it from reads). Idempotent — re-deleting a deleted node is a no-op success.
graph_write
aliasaction*node_idpayloaddevice_idnode_type
+2
Add or update a graph entity (non-destructive). action: add | update. Deletion is a separate tool (graph_soft_delete). (consolidated surface — same handlers as the legacy tools) Re… Add or update a graph entity (non-destructive). action: add | update. Deletion is a separate tool (graph_soft_delete). (consolidated surface — same handlers as the legacy tools) Required per action — add: node_type, alias, payload, device_id | update: node_id, device_id, field_updates.
handoff_read
read-only
datetagstimelimitsincetopic
+5
Read session handoffs. action: get | list (consolidated surface — same handlers as the legacy tools) Required per action — get: project, topic. Read session handoffs. action: get | list (consolidated surface — same handlers as the legacy tools) Required per action — get: project, topic.
handoff_save
datetimetopic*contentproject*device_id
+1
Save a session handoff note for cross-device / cross-session continuation. Stored at handoffs/{project}-{topic}-{YYYY-MM-DD}.txt in the user's primary vault. Use the optional `time… Save a session handoff note for cross-device / cross-session continuation. Stored at handoffs/{project}-{topic}-{YYYY-MM-DD}.txt in the user's primary vault. Use the optional `time` param (HHMM, KST) to disambiguate multiple handoffs saved on the same day — it is appended to the topic slug (e.g. topic='phase-d', time='1555' → handoffs/{project}-phase-d-1555-{date}.txt).
judgment_list
read-only
kindlimitdecisionrisk_tierproject_idsubject_id
+1
List the authenticated user's own judgments (L3 layer) — use this to check your own blocking status (risk_tier 1 pending = execution blocked). Default order matches the /command qu… List the authenticated user's own judgments (L3 layer) — use this to check your own blocking status (risk_tier 1 pending = execution blocked). Default order matches the /command queue: risk_tier ascending, then arrival order.
judgment_submit
kind*summary*evidencerisk_tierproject_idsubject_id
+1
Request a human judgment (L3 layer) by attaching evidence — approval, evidence, or verdict. This is the ONLY door an agent has into the judgment queue. 🔴 `decision` is REJECTED w… Request a human judgment (L3 layer) by attaching evidence — approval, evidence, or verdict. This is the ONLY door an agent has into the judgment queue. 🔴 `decision` is REJECTED with an error if passed — judgments are always created with decision='pending'. Only a human decides them (from the /command queue). Use judgment_list afterwards to check whether this judgment has since been decided. risk_tier controls urgency: 1=destructive (blocks execution until decided), 2=reversible (may auto-proceed after a wait window), 3=informational (auto-expires after 24h).
list_papers
read-only
limitoffsetsearchsort_bysort_ordercategory_id
+2
List notes/papers from AI Note. Supports keyword search across title and content, category filtering, pagination, and sorting. Returns id/title/content_preview/category_id/created_… List notes/papers from AI Note. Supports keyword search across title and content, category filtering, pagination, and sorting. Returns id/title/content_preview/category_id/created_at. Use this when the user asks 'find my note about X', 'what did I write on Y', or wants to search their knowledge base.
memory_read
read-only
idhopmodepathlimitquery
+3
Read agent memory. action: get | search (consolidated surface — same handlers as the legacy tools) Required per action — get: source | search: query. Read agent memory. action: get | search (consolidated surface — same handlers as the legacy tools) Required per action — get: source | search: query.
project_read
read-only
idstatus
List the authenticated user's projects (L2 intent layer), or fetch one by id. Each entry includes riskiest_assumption — the single highest-priority unverified assumption (or, if al… List the authenticated user's projects (L2 intent layer), or fetch one by id. Each entry includes riskiest_assumption — the single highest-priority unverified assumption (or, if all are verified, the highest-criticality one).
project_write
idnameintentstatussuccess_criteria
Create or update a project (L2 intent layer). Omit `id` to create, pass it to update. There is no delete tool — use status: 'archived' to retire a project. Create or update a project (L2 intent layer). Omit `id` to create, pass it to update. There is no delete tool — use status: 'archived' to retire a project.
sync_audit_layer5
path*summaryverdict*chunk_countduration_ms
Record the result of a client-side Layer 5 codex review (sync.py merge gate) as a vault_events row. Body of the review is NOT stored — only an HMAC digest of the summary so operato… Record the result of a client-side Layer 5 codex review (sync.py merge gate) as a vault_events row. Body of the review is NOT stored — only an HMAC digest of the summary so operators can correlate without exposing review content. Opt-in: server skips writes (still returns success) unless ENV['AINOTE_LAYER5_AUDIT']='on' AND a versioned HMAC secret is configured. Used by the sync.py SessionStart hook + merge command to surface 'why was this blocked?' across multi-PC sessions.
sync_delete
can modify data
path*forcebase_shadevice_id
Delete a file from the primary vault. Optional CAS via base_sha to detect concurrent multi-PC writes. Protected paths (global/memory/, global/skills/, global/planning/, global/clau… Delete a file from the primary vault. Optional CAS via base_sha to detect concurrent multi-PC writes. Protected paths (global/memory/, global/skills/, global/planning/, global/claude-config/, handoffs/) require base_sha or explicit force:true (audited). Idempotent: deleting a non-existent path returns success with deleted:false.
sync_push
can modify data
path*forcecontentbase_shadevice_idcontent_b64
+2
Push a markdown file into the primary vault. Optional CAS via base_sha to detect concurrent multi-PC writes (Layer 3 of multi-PC sync plan). WAF-bypass tip: large bodies (~10KB+) t… Push a markdown file into the primary vault. Optional CAS via base_sha to detect concurrent multi-PC writes (Layer 3 of multi-PC sync plan). WAF-bypass tip: large bodies (~10KB+) that get false-positive blocked at Cloudflare can be sent via `content_b64` (base64-encoded) OR `content` prefixed with `__B64__:` instead. When the push CREATES a new .md file, the response may carry `dedup_candidates` — existing memory files that look similar (keyword + title similarity, no LLM). It is an advisory, not a rejection: YOU decide to merge into one of them (re-push that path), drop this write as a duplicate (skip), or keep it as a new memory (store).
sync_push_batch
can modify data
items*device_ididempotency_key*supports_superseded
Push MANY files into the primary vault in ONE call. Use this instead of looping sync_push whenever you have more than a couple of changed paths — the cost of sync_push is round tri… Push MANY files into the primary vault in ONE call. Use this instead of looping sync_push whenever you have more than a couple of changed paths — the cost of sync_push is round trips, not bytes. Per-item semantics are identical to sync_push (Layer 3 base_sha CAS, superseded contract, content_b64 WAF fallback). Partial success is normal and returns HTTP 200: read `results[]` and match entries by `path`, NOT by position. A conflict result always carries `remote_sha` + `conflict_reason` so you can go straight to sync_merge. Request-level failures (duplicate paths in one batch, idempotency key reused with a different payload, >200 items, >4MB) return 4xx and apply NOTHING. Each item MUST carry `content_sha` (SHA1 hex of the decoded body, same algorithm as git_sha) — it powers both the integrity check and the retry-safe `skipped_identical` result. Newly created .md items may carry `dedup_candidates` (same merge/skip/store advisory as sync_push); a batch creating more than 10 new files skips the check entirely and reports `dedup_skipped: "bulk"`.
sync_read
read-only
pathlimitsinceaction*cursorbase_sha
+3
Read-only vault sync operations. action: list | pull | diff | merge | conflicts. Writes (push/delete) are separate tools — they carry CAS semantics. (consolidated surface — same ha… Read-only vault sync operations. action: list | pull | diff | merge | conflicts. Writes (push/delete) are separate tools — they carry CAS semantics. (consolidated surface — same handlers as the legacy tools) Required per action — diff: path | merge: path, base_text, local_text.
tasks_read
read-only
limitaction*offsetsearchstatusoverdue
+13
Read tasks and task categories. action: tasks | categories (consolidated surface — same handlers as the legacy tools) Read tasks and task categories. action: tasks | categories (consolidated surface — same handlers as the legacy tools)
task_write
idnotesaction*contentdue_datedue_time
+13
Create or update a task (non-destructive). action: create | update. Deletion is a separate tool (delete_task). (consolidated surface — same handlers as the legacy tools) Required p… Create or update a task (non-destructive). action: create | update. Deletion is a separate tool (delete_task). (consolidated surface — same handlers as the legacy tools) Required per action — create: content | update: id.
vault_create
name*slugdescription
Create a new private vault as a GitHub repository under the user's account. Requires the user to have completed the GitHub App install flow first. Create a new private vault as a GitHub repository under the user's account. Requires the user to have completed the GitHub App install flow first.
vault_read
read-only
nameaction*target_pathinclude_commit_sha
Read vault metadata. action: list | clone | status (consolidated surface — same handlers as the legacy tools) Required per action — clone: name. Read vault metadata. action: list | clone | status (consolidated surface — same handlers as the legacy tools) Required per action — clone: name.
vault_sync
can modify data
pathlimitsinceactioncursorcontent
+1