[FabioHAraujo]

An MCP server inside the LowNotes process, so external AI clients (Claude Desktop, Claude Code, Cursor) can read the open vault while the window sits in the tray. Read-only, off by default.

What it does

• SDK: rmcp 3.8.0 (Apache-2.0), pinned exactly, with only server, macros and transport-async-rw.
• Endpoint, per user:
  • Windows: a named pipe with a DACL that grants access to the current user's SID only. reject_remote_clients is on, and first_pipe_instance refuses a name that another process already holds.
  • macOS/Linux: a Unix socket in its own 0700 folder, with the socket itself at 0600.
• Authentication: before any MCP traffic the client sends LOWNOTES-MCP/1 <token>\n and gets OK or DENIED back. The comparison is constant-time.
  • The token is generated on first start and stored in the OS credential store (slot mcp:token).
  • for_frontend() and settings exports blank it.
• Tools (all readOnlyHint): list_notes (optional folder), read_note, search_notes (the current keyword search), get_links, get_backlinks.
• Resource template: lownotes://note/{path}.
• Responses: JSON that carries the vault_id. The server instructions tell the client that note text is data, not instructions.
• Scope: only the active vault, and only when its id is in mcp.vault_ids.
  • Paths must be Markdown and outside .lownotes/; safe_join still rejects .. and hidden folders.
  • Notes are cut at 512 KiB, responses are capped at 2 MiB, and incoming lines at 1 MiB.
  • At most 8 clients connect at once.
• Threads: tool handlers run on the blocking pool. vault_service reads now take the vault the caller resolved, so a vault switch between the scope check and the read cannot serve another vault.
• Logs: tool name, duration, response size and error key only. No note content, queries or token.

Not in this PR

• Enabling MCP from Settings is Settings section for the MCP server #103. Until then, set "mcp": { "enabled": true, "vault_ids": ["<vault id>"] } in settings.json and restart. McpService::apply starts or stops the server to match the settings.
• The lownotes-mcp stdio bridge that clients launch is lownotes-mcp: stdio bridge for MCP clients, shipped on all platforms #102. The end-to-end test plays the client: it does the handshake, initialize, tools/list, every tool, resources/read, and checks refused paths and an unshared vault.
• Documentation is Document the MCP server in the threat model, architecture and a user guide #104.

Checks

• cargo fmt --check, cargo clippy --lib --tests -- -D warnings (Windows)
• cargo test --locked --lib: 194 passed, 10 ignored. The new tests run over a real named pipe with the restricted DACL on Windows; CI covers the Unix socket path.
• cargo deny check bans sources: ok. advisories reports RUSTSEC-2026-0414 in pulldown-cmark 0.13.4. That was already on main, where references.rs enables ENABLE_WIKILINKS, so the Security check on this PR fails until a separate dependency PR moves to 0.13.5.

Closes #101