FabioHAraujo · Oct 29, 2026 · Oct 29, 2026
@@ -8,6 +8,7 @@ Releases up to 0.3.5 are described on the [GitHub releases page](https://github.
 
 ### Added
 - Excalidraw drawings inside notes. **Drawing** in the editor toolbar adds one and opens a full-screen canvas; the preview shows it and opens it on click. Drawings are stored as `excalidraw` code blocks, sync and merge like the rest of the note, and are embedded in Word and PDF exports ([#98](https://github.com/LowBloat/LowNotes/issues/98)).
+- An MCP server for AI apps such as Claude Desktop, Claude Code and Cursor. It is off by default; **Settings → MCP server** turns it on, chooses the shared vaults and shows the configuration to copy. Apps launch the bundled `lownotes-mcp` program and can list, search and read the open vault and its links, read-only, while LowNotes runs or sits in the tray. The access token stays in the system credential store ([#101](https://github.com/LowBloat/LowNotes/issues/101), [#102](https://github.com/LowBloat/LowNotes/issues/102), [#103](https://github.com/LowBloat/LowNotes/issues/103), [#104](https://github.com/LowBloat/LowNotes/issues/104)).
 
 ## [0.4.2] - 2026-10-24
 

@@ -38,6 +38,7 @@ LowNotes is an **open-source, local-first Markdown note-taking app** for Windows
 - **Connect your computers.** Pair devices for encrypted P2P sync and real-time collaborative editing.
 - **Build a knowledge base.** Use folders, search, wikilinks, a connection map and Mermaid diagrams.
 - **Choose your assistant.** Use local models through Ollama or LM Studio, or configure a remote provider. Remote requests send the prompt and selected context to that provider. The Research skill sends search terms (never notes) to the web search services you enable; only DuckDuckGo is on by default.
+- **Bring your own AI app.** Claude Desktop, Claude Code, Cursor and other MCP clients can search and read the open vault while LowNotes sits in the tray. It is read-only and off by default.
 - **Recover and share your work.** Review local history and trash, then export notes to Word or PDF.
 
 | Day to day | When you need more |
@@ -118,6 +119,10 @@ Vault search selects snippets by words, phrases and headings **on your own compu
 
 Under **Settings → Web search**, Firecrawl, Keenable, Exa, DuckDuckGo and a public SearXNG instance come enabled without a key. The app rotates the initial source and tries the next one on failure. Brave and Parallel can be enabled with your own key; Firecrawl, Keenable and Exa also accept an optional key. Public services may enforce limits or change availability.
 
+### AI apps over MCP
+
+**Settings → MCP server** lets AI apps on this computer that speak the Model Context Protocol, such as Claude Desktop, Claude Code and Cursor, list, search and read the notes of the open vault and follow its links. They cannot change notes. Apps launch the `lownotes-mcp` program installed next to LowNotes, which authenticates with a token kept in the system credential store. Only vaults you share are served, and what an app reads goes to that app and its AI provider. See [docs/MCP.md](docs/MCP.md) for setup, the available tools and the safety notes.
+
 ## How it works
 
 ```mermaid

@@ -53,13 +53,15 @@ The interface never reads the vault directly. Settings arrive through `AppSettin
 | "Open with LowNotes" entries and launch arguments | `context_menu.rs` |
 | Atomic storage and recovery notices | `storage.rs` |
 | Vault listing and paths | `vault.rs` |
+| Vault reads and assistant changes shared by commands and the MCP server | `vault_service.rs` |
 | Stable note identities, deletes, moves | `catalog.rs`, `catalog_sync.rs`, `structural.rs`, `creation.rs` |
 | Collaborative state and durable saves | `crdt.rs`, `note_transaction.rs` |
 | History, trash, retention | `note_history.rs`, `retention.rs` |
 | Links, references, map | `links.rs`, `link_operations.rs`, `references.rs`, `reference_sync.rs` |
 | Images | `local_images.rs`, `export_images.rs` |
 | Assistant | `assistant.rs`, `rag.rs`, `web_search.rs`, `chat_history.rs` |
 | P2P sync | `network.rs` |
+| MCP server for external AI clients, and the `lownotes-mcp` bridge they launch ([MCP.md](MCP.md)) | `mcp.rs`, `mcp_bridge.rs`, `bin/lownotes-mcp.rs` |
 | Shared HTTP clients | `http.rs` |
 | Diagnostic log | `logging.rs` |
 
@@ -68,6 +70,8 @@ The interface never reads the vault directly. Settings arrive through `AppSettin
 - Tauri runs synchronous commands on the main thread. IO-heavy commands are `async` and run their body on the blocking pool through `on_worker` in `commands.rs`.
 - The network service runs on its own thread with a two-worker Tokio runtime (`NetworkService::start`). Disk and CRDT phases inside network tasks go through `block_in_place`.
 - `structural::exclusive` serializes structural work per vault with a reentrant lock and runs pending recovery on the outermost entry.
+- The MCP server (`McpService`) runs on Tauri's async runtime: one task accepts connections on the per-user pipe or socket, and one task per client runs its session. Tool calls run on the blocking pool, like `on_worker`. A restart waits for the previous server to release the endpoint.
+- `lownotes-mcp` is a separate console process with a single-threaded Tokio runtime. It only relays bytes between the client's stdio and the app; it never opens the vault, so every read goes through the app's locks and recovery.
 
 ### Durability
 
@@ -85,6 +89,7 @@ The interface never reads the vault directly. Settings arrive through `AppSettin
 | `.lownotes/link-operations.json`, `links.json` | Map link operations and their projection |
 | `.lownotes/versions/`, `trash/` | Local history and trash (not synced) |
 | App config dir `settings.json` | Preferences and credential references (no secrets) |
-| OS credential store | Vault identity, pairing token, provider and search keys |
+| OS credential store | Vault identity, pairing token, provider and search keys, MCP access token |
+| `mcp/mcp.sock` in the runtime or local data dir (macOS, Linux) | MCP endpoint while the server runs; Windows uses a named pipe instead |
 
 See [SYNC-PROTOCOL.md](SYNC-PROTOCOL.md) for how vaults converge and [THREAT-MODEL.md](THREAT-MODEL.md) for the security boundaries.
@@ -0,0 +1,82 @@
+# Connect AI apps over MCP
+
+LowNotes can serve your notes to AI apps that speak the [Model Context Protocol](https://modelcontextprotocol.io/), such as Claude Desktop, Claude Code and Cursor. The app can search and read the vault open in LowNotes. It cannot create, change or delete notes.
+
+The server runs inside LowNotes, so the app must be running. It can stay in the system tray (**Settings → General → Keep running in the system tray**).
+
+## Turn it on
+
+1. Open **Settings → MCP server** and turn on **Turn on the MCP server**. The first time, this also shares the vault that is open.
+2. Under **Shared vaults**, check the vaults AI apps may read. An app only ever reads the vault that is open in LowNotes, and only while it is checked.
+3. Under **Connect an AI app**, copy the configuration for your app.
+
+### Claude Desktop
+
+Add the `lownotes` entry to `mcpServers` in `claude_desktop_config.json` (**Settings → Developer → Edit Config** in Claude Desktop), then restart Claude Desktop:
+
+```json
+{
+  "mcpServers": {
+    "lownotes": { "command": "C:\\Program Files\\LowNotes\\lownotes-mcp.exe" }
+  }
+}
+```
+
+### Claude Code
+
+```bash
+claude mcp add --scope user lownotes -- "C:\Program Files\LowNotes\lownotes-mcp.exe"
+```
+
+### Cursor
+
+Add the same `mcpServers` entry as Claude Desktop to `~/.cursor/mcp.json`.
+
+Settings shows the right path for your installation. Typical locations:
+
+| System | `lownotes-mcp` |
+| --- | --- |
+| Windows (installer) | `C:\Program Files\LowNotes\lownotes-mcp.exe` |
+| Windows (portable) | next to `LowNotes.exe` |
+| macOS | `/Applications/LowNotes.app/Contents/MacOS/lownotes-mcp` |
+| Linux (.deb, .rpm, Arch) | `/usr/bin/lownotes-mcp` |
+
+The AppImage mounts itself at a new path on every start, so a path copied from it stops working after a restart. Use the .deb, .rpm or Arch package to connect AI apps on Linux.
+
+## What AI apps can do
+
+| Tool | What it returns |
+| --- | --- |
+| `list_notes` | Paths, titles, dates and sizes of the notes, optionally inside one folder |
+| `read_note` | The Markdown of one note (up to 512 KiB; longer notes come back truncated) |
+| `search_notes` | The best matching excerpts for words or a phrase, with their note paths |
+| `get_links` | The links between notes: wikilinks and links drawn in the map |
+| `get_backlinks` | The notes that link to one note |
+
+Each note is also available as a resource, `lownotes://note/{path}`. Paths inside `.lownotes/` and files that are not Markdown are refused.
+
+Search uses the same local keyword search as the assistant: words, phrases and headings, without embeddings.
+
+## Privacy and safety
+
+- **What leaves LowNotes.** Everything an AI app reads goes to that app and to the AI provider it uses, under that provider's terms. Share only the vaults you are comfortable sending.
+- **Notes from other devices.** A paired device can sync any text, including text written to steer an AI ("ignore your instructions and…"). LowNotes labels note content as data and tells clients not to follow instructions inside it, but it cannot control the AI app. Be careful when the same app can also run commands, send messages or browse.
+- **Who can connect.** Only programs running as your user on this computer. `lownotes-mcp` presents an access token that LowNotes keeps in the system credential store; it never appears in the AI app's configuration or in LowNotes' interface.
+- **Regenerate the token** (**Settings → MCP server → Regenerate token**) if you stop trusting an app that was connected. Every connected app is disconnected and has to reconnect.
+- **Turn it off** at any time with the same switch; connected apps are disconnected at once.
+
+The diagnostic log records which tool was called, how long it took and how large the answer was, never note content, search terms or the token.
+
+## Troubleshooting
+
+`lownotes-mcp` answers the AI app with an error that says what is wrong:
+
+| Message | What to do |
+| --- | --- |
+| LowNotes is not open | Start LowNotes; it can stay in the tray. |
+| The LowNotes MCP server is off | Turn it on in **Settings → MCP server**. |
+| The vault open in LowNotes is not shared | Check the vault under **Shared vaults**, or open a shared vault. |
+| LowNotes refused the token | The token was regenerated: restart or reconnect the AI app. |
+| Could not read the MCP token | Unlock the system credential store (Keychain, Credential Manager or Secret Service). |
+
+For more detail, run `lownotes-mcp` from a terminal with `LOWNOTES_LOG=info`; it logs to the terminal's error output.
@@ -10,6 +10,7 @@ This document describes what LowNotes protects, against whom, and the limits tha
 | Vault P2P identity (Iroh secret key) | OS credential store |
 | Pairing token | OS credential store; embedded in shared pair codes |
 | AI provider and search API keys | OS credential store |
+| MCP access token | OS credential store; read by the `lownotes-mcp` bridge |
 | Assistant conversations | App data directory, per vault |
 
 ## Adversaries and mitigations
@@ -40,6 +41,17 @@ This document describes what LowNotes protects, against whom, and the limits tha
 ### AI providers and search engines
 - Remote providers receive the prompt and the note excerpts selected as context. Search sources receive the search query. Local providers (Ollama, LM Studio) keep this on the device.
 
+### Local MCP clients and the models behind them
+The MCP server ([MCP.md](MCP.md)) lets AI apps on the same computer read the vault open in LowNotes.
+- Off by default. When on, it serves only the open vault, and only if that vault is shared in Settings. Every tool is read-only; paths inside `.lownotes/` and files that are not Markdown are refused.
+- The server listens on a per-user endpoint, never on the network: a named pipe whose DACL grants access to the current user's SID only and refuses remote clients, or a Unix socket (`0600`) in a folder only the user can enter (`0700`).
+- Clients authenticate before any MCP traffic with a 256-bit token, compared in constant time. The token lives in the OS credential store and reaches neither the webview nor the client's configuration files: `lownotes-mcp` reads it from the store itself. Regenerating it disconnects every client.
+- Pipe names are machine-wide, so `lownotes-mcp` checks that the process serving the pipe runs as the same Windows user before it sends the token. The pipe is created as the first instance, so LowNotes refuses to serve on a name another process already holds.
+- Requests are bounded: 1 MiB per incoming line, 512 KiB of note text and 2 MiB per response, 8 clients at a time.
+- What a client reads goes to that client and to its AI provider, as with the assistant's providers above.
+- Notes synced by paired devices are untrusted text that can try to steer the model (prompt injection). Responses carry note text as JSON data, and the server tells clients to treat it as information, never as instructions; LowNotes cannot enforce how the client behaves.
+- The diagnostic log records tool names, durations, sizes and error keys, never note content, search terms or the token.
+
 ### Update channel
 - Updates are signed with the project's minisign key and verified before installation. Release assets have SHA-256 checksums, and the AUR recipe is published with real checksums.
 
@@ -50,3 +62,5 @@ This document describes what LowNotes protects, against whom, and the limits tha
 - Path validation does not yet resolve symlinks and junctions inside the vault (roadmap B22).
 - Anyone with access to the unlocked operating system account can read the vault files and, through the OS credential store, the stored secrets.
 - Iroh discovery and relay services are third-party infrastructure.
+- An MCP client that also has other tools (commands, messages, browsing) can be steered by injected note text into acting on it or sending it elsewhere. Keep the MCP server off, or share only vaults you trust, when an AI app has such tools.
+- Any program running as the same user can obtain the MCP token through the OS credential store, as with the other stored secrets.