Connect an agent
NoteMCP is an MCP server: any assistant that speaks the Model Context Protocol can search, read, and write your notes — with your permission, revocable any time.
The endpoint
https://notemcp.com/mcp
Streamable HTTP, authenticated with OAuth 2.0 (PKCE, dynamic client registration) or a personal access token. Connecting an agent signs you in — each token only ever reaches your own notes.
Claude
That link opens claude.ai's Add custom connector dialog with the name and URL filled in. Confirm, then approve access on the NoteMCP consent screen. In Claude Code:
claude mcp add --transport http notemcp https://notemcp.com/mcp
ChatGPT
ChatGPT adds MCP servers through developer mode: Settings → Connectors → Advanced → Developer mode, then create a connector with the endpoint URL above and OAuth authentication.
Anything else
Point any MCP client at the endpoint and it will discover the OAuth flow on its own. For
clients that only take a bearer token, generate a personal access token from your Account
page and send it as Authorization: Bearer <token>.
What the agent can do
| Tool | What it does | |
|---|---|---|
search_notes | read | Keyword, semantic, or hybrid search with tag, source, date, and thread filters. |
list_recent_notes | read | The note stream, most recently touched first — same order as the app. |
get_note | read | One note in full, plus the thread of continuations appended to it. |
get_note_asset | read | An image already attached to a note, resized and compressed on demand. |
list_tags | read | Every tag with its live note count. |
create_note | write | A new note or a continuation of an existing thread; idempotent via client_id. |
append_to_note | write | Add markdown to the end of a note. |
replace_in_note | write | Change one exact span of text without touching the rest. |
update_note | write | Replace whole fields (title, body, pinned, archived). |
tag_note | write | Add tags to a note. |
untag_note | write | Remove tags from a note. |
delete_note | write | Hide a note (or, with cascade, its whole thread). A soft delete — the row is retained, not erased. |
Built-in guardrails
- Lists never carry bodies. Search and list replies are compact projections; an agent asks for a note's body explicitly.
- Photos never ride along in text. Embedded photos are redacted to
![photo]in note bodies, so an agent never receives image data it didn't ask for — retrieving one is an explicitget_note_assetcall that returns a bounded, resized copy. Whole-body rewrites of photo notes are refused so an agent can't destroy an image it can't see. - Writes are conflict-checked. Every edit can carry
if_updated_at; a note you changed on your phone mid-edit produces a rejected write, never a silent overwrite. - Deletes are soft. An agent's delete hides the note rather than erasing it — recovery is a support request today, not a button.
Help
Trouble connecting? See support. What we store and where: privacy policy.