AppLock
AppLock is an MCP server for locking, hiding, viewing, and restoring AI chats while keeping secrets encrypted and unlocked via Touch ID or a passphrase.
Check AppLock and vault status, hidden count, and browser extension connection.
List visible local Claude Code and Antigravity sessions.
Hide a local Claude Code or Antigravity session into the encrypted vault, including the current session.
List ChatGPT, Claude.ai, and Gemini web chats seen by the browser extension.
Lock a ChatGPT, Claude, or Gemini web chat so it disappears from the sidebar and requires unlock to open.
Optionally archive locked ChatGPT chats so they also hide in the ChatGPT phone/desktop apps.
Turn the ChatGPT 'hide on phone too' archiving setting on or off, applying it to already-locked chats.
Copy locked ChatGPT or Claude web chat transcripts into the vault without deleting them.
Unlock the vault with Touch ID, a local passphrase page, or a one-time link.
Re-lock the vault immediately.
List everything hidden in the vault.
Read a hidden transcript without restoring it.
Restore a hidden local session or unlock a locked web chat.
Encrypts local Google Antigravity sessions out of their history and hides chosen Gemini web chats via the browser extension. Provides MCP tools to list, hide, unlock, read, and restore these hidden sessions and chats.
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@AppLockhide this Claude Code session and lock the vault"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
AppLock
Lock and hide the AI chats you choose, behind Touch ID or a password — like Locked Notes on a Mac.
Browser extension hides chosen ChatGPT, Claude.ai and Gemini chats from the sidebar and shows a lock screen if one is opened directly.
MCP server encrypts local Claude Code and Google Antigravity sessions out of their history, and lets any MCP client (Claude Code, Antigravity, ChatGPT developer mode) hide chats for you.
Website with the full guide: https://harmantaj.github.io/applock-mcp/ (source in website/).
Why two pieces
ChatGPT, Claude.ai and Gemini keep chats on their servers. An MCP server only gives a model tools; it can't change what a web page shows. So the extension does the hiding in the browser, and the MCP server handles local history plus a lock-only bridge to the extension.
Related MCP server: sieve-map
Install
npm install -g https://github.com/Harmantaj/applock-mcp/releases/download/v0.6.4/applock-mcp-0.6.4.tgz
applock-mcp setup # passphrase + optional Touch ID
applock-mcp install claude # or: antigravity | chatgptBrowser extension: download applock-chrome.zip or applock-firefox.zip from the latest release. Chrome/Edge/Brave/Arc: unzip, chrome://extensions › Developer mode › Load unpacked. Firefox: about:debugging › This Firefox › Load Temporary Add-on (a permanent install needs the addons.mozilla.org listing). Build both with node scripts/build-extensions.mjs.
On your phone
No app or extension can change the ChatGPT/Claude/Gemini phone apps, so AppLock covers phones in layers:
Hide on your phone too (setting, ChatGPT only): locking also archives the chat through ChatGPT's own API, so it leaves the chat list in the iPhone/Android/Mac apps; removing the lock unarchives it. Jobs sync, so a lock made anywhere is archived by whichever computer next has ChatGPT open.
Per-chat lock in a phone browser: Firefox for Android, or Orion (Kagi) on iPhone/iPad, with the Firefox build installed. A lock button appears on chat pages on touch screens.
Face ID for the whole app: iOS 18 Require Face ID; Android 15 Private space.
Move to vault (ChatGPT, Claude): saves an encrypted transcript in the vault on your computer, then deletes the chat at the provider, so it's gone from every app and device. Read it on your phone in the AppLock Vault web app (
/vault/<secret>/on your tunnel address; add it to the Home Screen). Deletion only happens after the vault confirms the copy is stored.Phone connector (below) to control your Mac from Claude on the phone.
Claude everywhere (web, desktop, iPhone, Android) and ChatGPT on the web
Custom connectors added on claude.ai work in the Claude desktop and phone apps too; ChatGPT allows them only on chatgpt.com. On a Mac with Tailscale installed and signed in:
applock-mcp install phoneThis starts AppLock in the background (launchd), turns on Tailscale Funnel for AppLock only — it never reuses a port another program is serving, and never replaces someone else's Funnel route — verifies it from the internet, and copies the connector URL. Add it on claude.ai › Customize › Connectors › Add custom connector. From a phone, unlock_vault returns a one-time link to your Mac's unlock page, so the passphrase never passes through the AI. It can't hide chats inside the phone apps; it's a remote control for your Mac, which must be awake.
applock-mcp remote url · applock-mcp remote rotate · applock-mcp uninstall phone
Tools
Tool | Purpose | Needs unlock |
| Vault state, hidden count, extension connection | no |
| Visible Claude Code / Antigravity sessions | no |
| Encrypt a session into the vault ( | no |
| Web chats seen by the extension | no |
| Lock a web chat ( | no |
| Copy locked ChatGPT/Claude chats into the vault without deleting them (readable in the phone Vault) | no |
| Turn on ChatGPT archiving for locked chats so they leave the phone apps' lists | no |
| Touch ID prompt, local passphrase page, or (remote) a one-time unlock link | — |
| Lock now | no |
| Everything in the vault | yes |
| Read a hidden transcript | yes |
| Put a session back | yes |
Security model
Sessions are sealed to an X25519 public key (ephemeral ECDH + HKDF-SHA256 + AES-256-GCM), so hiding never needs the passphrase. The private key is wrapped with scrypt(passphrase); with Touch ID a copy lives in the macOS Keychain and a Swift helper releases it after
LAContextauthentication.The passphrase is never passed through the model: unlocking uses the Touch ID sheet or a one-time page on
127.0.0.1.The bridge on
127.0.0.1:47521accepts only browser-extension origins, pins the first extension that pairs, and is lock-only — nothing it sends can reveal a chat.The extension uses PBKDF2-SHA256 (600k) with lockout, and WebAuthn (platform authenticator) with local signature verification.
Locks and the password hash live in
chrome.storage.sync, so they follow your Chrome profile to your other computers; chat titles and the Touch ID key stay on each computer.Forgot the extension password? Forgot password? on the lock screen or popup resets it with Touch ID or the one-time recovery code (100 bits, stored hashed, rotated on use).
Not protected: the provider's servers, the ChatGPT/Claude/Gemini phone apps (use iOS Require Face ID on the app instead), removing the extension, malware running as you. The Claude desktop app keeps its own session title list.
Development
npm install
npm test # build + unit + MCP client tests (stdio and HTTP)
npx playwright install chromium
npm run test:e2e # extension on mocked ChatGPT/Claude/Gemini, bridge, websitedocs/REQUIREMENTS.md has the research notes and requirements.
License
MIT
Available Tools
12 toolsapplock_statusAppLock statusARead-only
Shows whether AppLock is set up, locked or unlocked, how many chats are hidden, and whether the browser extension is connected.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
readOnlyHint=true already tells the agent this is a safe, non-mutating call, so the description earns credit for going further by enumerating the specific state fields the caller will learn (setup, lock state, hidden count, extension connection). It does not discuss permissions, caching, or refresh behavior, so it falls short of full disclosure.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single front-loaded sentence that lists the returned state facts with no filler or redundancy. Every clause earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no output schema, the description must convey what the call returns, and it does so completely: setup status, locked/unlocked, hidden chat count, and extension connectivity. For a zero-parameter read tool, nothing an agent needs to invoke or interpret it correctly is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool takes zero parameters, which is the baseline-4 case; there is nothing to misinterpret, and the description correctly implies the call is parameterless by framing it as a global status query.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific read verb ('Shows whether') and the exact resource and facts reported: setup state, locked/unlocked, hidden chat count, and browser-extension connectivity. This is clearly separable from siblings like hide_session, unlock_vault, or list_hidden, which mutate or enumerate sessions rather than report AppLock state.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies a status-check use case (e.g., before locking/unlocking) but never says when to call it versus alternatives such as list_hidden or unlock_vault, nor any prerequisites. Usage is inferable from the intent but not spelled out.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
copy_to_vaultCopy web chats into the vaultA
Saves the full transcript of ChatGPT or Claude chats into the encrypted AppLock vault, WITHOUT deleting them anywhere, so they can be read in the AppLock Vault phone app or with read_hidden. Use chat_id "locked" for every locked ChatGPT/Claude chat. Needs the browser extension with that site signed in.
| Name | Required | Description | Default |
|---|---|---|---|
| site | No | Needed with a single chat id | |
| chat_id | No | "locked" for all locked chats, or one chat id | locked |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations only declare destructiveHint=false; the description adds real behavioral context beyond that – the transcript is copied 'WITHOUT deleting them anywhere', the destination is encrypted, and the browser-extension sign-in requirement is stated. It still doesn't say whether copying is idempotent or what happens on re-copy, so not a 5.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three compact sentences with the copy-vs-delete distinction front-loaded and the prerequisite placed last. Slightly dense, but every clause carries information.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
No output schema exists, so the description does need to orient the agent; it covers purpose, non-destructive behavior, destination, prerequisite, and where the result is consumed. It could be more explicit about sibling selection, but it is sufficient for a 2-parameter tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so both parameters (site enum, chat_id with default 'locked') are already documented, which sets the baseline at 3. The description's note about chat_id='locked' mostly restates the schema rather than adding new syntax or constraints.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ('Saves the full transcript of ChatGPT or Claude chats into the encrypted AppLock vault') and immediately distinguishes the operation from destructive siblings by asserting it copies rather than deletes. An agent can tell it apart from hide_session/hide_browser_chat without opening another schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Gives the operative condition ('Use chat_id "locked" for every locked ChatGPT/Claude chat') and a hard prerequisite ('Needs the browser extension with that site signed in'), plus a downstream use case pointing to read_hidden. It stops short of explicitly contrasting when to pick this over a hide/restore sibling, which keeps it at 4.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
hide_browser_chatLock a ChatGPT / Claude / Gemini web chatA
Tells the AppLock browser extension to lock a web chat: it disappears from the sidebar and shows a lock screen if opened, until unlocked with Touch ID or the password. Use chat_id "current" for the chat open in the browser.
| Name | Required | Description | Default |
|---|---|---|---|
| site | No | Needed only when chat_id isn't "current" and is ambiguous | |
| chat_id | Yes | Chat id from list_browser_chats, or "current" | |
| everywhere | No | ChatGPT only: also archive it in the user's ChatGPT account so it leaves the chat list in the ChatGPT phone and desktop apps |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden and does well: it discloses the visible effect (removed from sidebar, lock screen on open), the unlock path (Touch ID or password), and the reversibility implied by 'until unlocked'. It omits any statement about required permissions, failure modes, or what happens if the chat_id is stale.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences, front-loaded with the effect and followed by the one usage hint. No filler, no restating of the title.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a mutation tool with no annotations and no output schema, the description covers the effect, the unlock mechanism, and the special chat_id value, which is most of what an agent needs. Missing only permission/auth requirements and error behavior if the extension is absent or the chat is unknown.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so the baseline is 3, but the description adds genuine meaning by explaining that "current" refers to the chat open in the browser, which the schema only mentions as a literal value. It still leaves the `everywhere` ChatGPT archival flag entirely to the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description gives a concrete verb-plus-resource ('lock a web chat' via the AppLock browser extension) and names the target surfaces (ChatGPT/Claude/Gemini web chats), which separates it from sibling tools like hide_on_phone or hide_session. It stops short of explicitly naming the sibling it is not, so an agent must infer the browser-vs-other-platform boundary.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It gives one piece of usage guidance — use chat_id "current" for the chat open in the browser — but never states when to pick this tool over hide_session, hide_on_phone, or list_hidden, nor any exclusion or prerequisite. Usage is implied rather than declared.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
hide_on_phoneHide locked ChatGPT chats on the phone tooAIdempotent
Turns AppLock's 'Hide on your phone too' on or off. When on, locked ChatGPT chats are also archived in the user's ChatGPT account, so they disappear from the chat list in the ChatGPT iPhone/Android/desktop apps (still listed under ChatGPT's Archived chats). Removing a lock in the browser unarchives it. Claude and Gemini have no archive. Needs the AppLock browser extension.
| Name | Required | Description | Default |
|---|---|---|---|
| on | No | ||
| apply_to_locked | No | Also archive ChatGPT chats that are already locked |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations only cover idempotency and non-destructiveness; the description adds real behavioral context: chats are archived in the ChatGPT account, remain visible under Archived chats, unarchive when the lock is removed in the browser, and the feature is unavailable for Claude/Gemini. The extension prerequisite is also disclosed. It stops short of stating what the call returns or any failure modes.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Four compact sentences, front-loaded with the action and its effect, followed by the unarchive rule, platform limitation, and prerequisite. Every sentence carries information; the density is high but not padded.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a 2-parameter, no-output-schema toggle, the definition covers effect, side effects, platform limits, and the extension requirement, which is enough for an agent to call it correctly. Only a note on return/reporting behavior is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 50%: 'on' has no description, while 'apply_to_locked' is documented in the schema itself. The description's 'on or off' and 'locked chats are also archived' clarifies the on/apply behavior somewhat, but adds no syntax or default semantics beyond the schema. Baseline 3 fits.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a concrete verb and setting (turns AppLock's 'Hide on your phone too' on/off) plus the concrete effect: ChatGPT chats get archived and vanish from the chat list. It is specific about scope (ChatGPT only, Claude/Gemini have no archive) but never contrasts itself with close siblings like hide_session or hide_browser_chat.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Usage is implied through the behavioral explanation (turn on to archive locked chats, lock removal unarchives), and the prerequisite 'Needs the AppLock browser extension' is stated. However, there is no explicit when-to-use-this-vs-alternatives guidance against the many hide_*/lock_* siblings, leaving routing to inference.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
hide_sessionHide a chat sessionA
Encrypts a Claude Code or Antigravity session into the vault and removes it from the app's history. Works while locked. Use id "current" for the Claude Code session you are running in; it is hidden as soon as that session ends.
| Name | Required | Description | Default |
|---|---|---|---|
| id | Yes | Session id from list_sessions (a unique prefix of 6+ characters works), or "current" |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations only provide idempotentHint=false and destructiveHint=false; the description adds substantial context by explaining the session is encrypted into the vault, removed from history, and functions while locked. The deferred hide of 'current' until the session ends is a non-obvious behavioral trait that is well disclosed.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three tight sentences with the core operation front-loaded, followed by the locked-state capability and the 'current' special case. Every sentence carries distinct information with no redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the single required parameter, full schema coverage, and absence of an output schema, the description covers the operation, the special id value, and the timing edge case. It does not mention restorability, but that is handled by a sibling tool, leaving the definition essentially complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% and the schema already documents the id format, so the baseline is 3. The description adds meaning by clarifying that id='current' targets the running session and describing the deferred hiding behavior, going modestly beyond the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ('Encrypts a ... session into the vault and removes it from the app's history'), which distinguishes it clearly from sibling hide_browser_chat and the list/restore tools. An agent immediately understands this is a session-level hide-and-encrypt operation.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Provides clear context on when to pass id='current' and notes it works while locked, which is useful for invocation timing. It does not explicitly state when-not to use it or name restore_hidden as the inverse, so it falls short of full alternative routing.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_browser_chatsList web chats seen by the extensionBRead-only
Lists ChatGPT, Claude.ai and Gemini chats visible in the sidebar of the user's browser, as reported by the AppLock extension. Also says which chat is open right now.
| Name | Required | Description | Default |
|---|---|---|---|
| query | No | Filter by title text |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
readOnlyHint=true already tells the agent this is a safe read. The description adds genuine context beyond the annotation: the data originates from the AppLock extension's view of the browser sidebar, and the result includes the currently-open chat. No contradiction, but nothing about freshness, sync timing, or what happens when the extension is absent.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two tight sentences, front-loaded with what is listed and where it comes from. The final clause about the open chat earns its place by disclosing an extra payload field, though phrasing is slightly casual.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
A simple read-only, zero-required-param tool with full schema coverage and no output schema. The description adequately conveys the data source and the notable extra field (currently open chat), so an agent can call it correctly; only the filtering behavior is left implicit.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100% and there is a single optional 'query' param documented as 'Filter by title text'. The description never mentions filtering, so it adds no meaning beyond the schema; the baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb (lists) and resource (browser chats) and names the concrete sources: ChatGPT, Claude.ai and Gemini sidebars as reported by the AppLock extension. It also distinguishes the payload by noting it includes which chat is currently open. It stops short of explicitly contrasting with nearby siblings like list_sessions or list_hidden, but the resource is unambiguous.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no when-to-use guidance, no prerequisites, and no mention of when to prefer list_sessions, list_hidden, or hide_browser_chat instead. The agent must infer usage purely from the resource description.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_sessionsList visible chat sessionsARead-only
Lists local Claude Code and Antigravity chat sessions that are currently visible (not hidden), newest first, so you can find the one to hide.
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | ||
| query | No | Only sessions whose title contains this text (case-insensitive) | |
| source | No | Which app's sessions to list | all |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true, so the safety profile is covered. The description adds behavioral detail beyond the annotations: the result ordering (newest first) and the visibility filter that excludes hidden sessions. It still omits return shape/pagination behavior, but for a simple read-only list this is a modest gap.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single sentence that front-loads the resource and scope, then the ordering, then the reason to call it. No redundant or filler content.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no output schema and only three simple optional parameters, the description covers what an agent needs to select and call the tool. Minor omissions (how many results return by default / pagination behavior) prevent a 5.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 67%, with the query and source params documented in the schema and limit left undocumented there. The description adds no parameter-level meaning (nothing about limit, query, or source semantics), so it neither compensates for the gap nor exceeds the baseline.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource (lists chat sessions), scopes it precisely (local Claude Code and Antigravity sessions that are currently visible, not hidden), and names the ordering (newest first). It implicitly distinguishes itself from the sibling list_hidden by specifying 'visible (not hidden)' and from hide_session by stating its goal ('find the one to hide').
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The trailing clause 'so you can find the one to hide' gives clear context for when the tool is used — as a discovery step before hide_session. It doesn't explicitly name siblings or state when-not to use it (e.g., use list_hidden for hidden sessions), so it falls short of full routing guidance.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
lock_vaultLock the vault nowAIdempotent
Forgets the vault key immediately and re-locks web chats in the browser extension.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With annotations covering safety (readOnlyHint=false, idempotentHint=true, destructiveHint=false), the description still adds real value: it discloses that the key is 'forgotten immediately' and that web chats in the browser extension are re-locked, i.e., the session state the caller loses. It does not mention re-unlock requirements or rate limits, but coverage is solid.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single tight sentence with zero filler; the consequence (key forgotten) is front-loaded ahead of the secondary effect (re-locking chats). Nothing is wasted.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a zero-parameter, no-output-schema tool with annotations already declaring the safety profile, the description supplies the missing behavioral context of what state is lost. Only the absence of any when-to-use steering keeps it from being fully complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool takes zero parameters, so per the baseline there is nothing for the description to disambiguate; schema coverage is 100% and the empty object schema is self-explanatory. No meaningful gap exists here.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific action (lock the vault) plus its concrete effects: the vault key is forgotten and browser-extension web chats are re-locked. An agent can distinguish this from unlock_vault by the word 're-locks', though no sibling is named outright.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explains what happens but never says when to call this versus alternatives like hide_session, applock_status, or unlock_vault. The only usage signal is the tautological title 'Lock the vault now', which offers no conditional guidance or exclusions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
unlock_vaultUnlock the vaultARead-only
Unlocks hidden chats for a few minutes. Shows the Touch ID prompt on the user's Mac, or opens a local passphrase page in their browser. The user authenticates on their own device; never ask for the passphrase in chat. Waits up to 2 minutes.
| Name | Required | Description | Default |
|---|---|---|---|
| method | No | auto uses Touch ID when enabled, otherwise the passphrase page | auto |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
readOnlyHint=true declares the tool does not modify its environment, but the description explicitly describes a state change ('unlocks hidden chats for a few minutes'). The description also adds genuinely useful behavior (auth happens on the user's device, up to 2-minute wait), but it directly contradicts the annotation's read-only claim, so the contradiction rule applies.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Four short sentences, each front-loaded with an actionable fact: effect and duration, then authentication channel, then the security constraint, then the timeout. Nothing is padded or redundant.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a single-parameter, no-output-schema tool, the description covers the observable outcome, the authentication channel, the security constraint, and the wait bound. The one thing it leaves ambiguous is how the agent should behave if the unlock times out or fails, but that is a minor gap.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% with a documented enum and default, so the schema already carries the parameter meaning. The description adds indirect value by describing what the auth flow does (Touch ID prompt vs. browser passphrase page), but it never names or explains the 'method' parameter or the 'link' option, so it does not meaningfully exceed the baseline.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource (unlocks hidden chats) plus the scope of the effect ('for a few minutes'), which is the key differentiator from lock_vault and from read_hidden/list_hidden. An agent can tell immediately what this tool does without opening the schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Gives clear operational context: it triggers a Touch ID prompt on the user's Mac or a local browser page, the user authenticates on their own device, and the agent must never ask for the passphrase in chat. That covers when/how to use it, though it does not explicitly contrast itself with sibling tools like applock_status or read_hidden.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
4 tool updates
v0.6.3- Added
copy_to_vault - Changed
hide_browser_chat1 field changed- added
Input schema / properties / everywhereAdded value: +{ + "default": false, + "description": "ChatGPT only: also archive it in the user's ChatGPT account so it leaves the chat list in the ChatGPT phone and desktop apps", + "type": "boolean" +}
- Added
hide_on_phone - Changed
unlock_vault1 field changed- changed
Input schema / properties / method / enumPrevious value: -[ - "auto", - "touchid", - "passphrase" -]New value: +[ + "auto", + "touchid", + "passphrase", + "link" +]
10 tool updates
v0.2.0- First observed
applock_status - First observed
hide_browser_chat - First observed
hide_session - First observed
list_browser_chats - First observed
list_hidden - First observed
list_sessions - First observed
lock_vault - First observed
read_hidden - First observed
restore_hidden - First observed
unlock_vault
TDQS
Scored across 12 tools
The 'hide' family (hide_session, hide_browser_chat, hide_on_phone, copy_to_vault) and the 'list' family (list_hidden, list_sessions, list_browser_chats) could initially look overlapping, but descriptions clearly scope each to a distinct target (local session vs browser chat vs vault vs phone archive). read_hidden vs list_hidden vs restore_hidden are also well differentiated by their stated effects.
Names follow a consistent snake_case verb_noun pattern (list_hidden, hide_session, restore_hidden, lock_vault, unlock_vault), which makes the set predictable. The lone deviation is applock_status, a noun-first status tool, but it's a recognizable convention for a query tool.
12 tools sit comfortably in the well-scoped 3-15 range. Each tool maps to a concrete operation (hide, list, read, restore, lock/unlock, copy, status) with no filler.
The set covers the full lifecycle: hide, list, read, restore, copy, lock, unlock, and status, with per-surface variants for local sessions and browser chats. Minor gaps exist (e.g. no way to permanently delete/clear a vault entry or search within hidden items), but core workflows are covered.
Maintenance
Related MCP Connectors
Private persistent memory for Claude, ChatGPT & Gemini via MCP - semantic search, zero-code setup.
MCP-native notes and memory for ChatGPT, Claude, and other AI tools.
- mcpOAuthai.butlerbrain
Persistent memory for AI assistants. Save once; recall from Claude, ChatGPT, or any MCP client.
Encrypted Personal Neural Network & cross-LLM memory vault for Claude, Cursor, Windsurf & ChatGPT.
1
Related MCP Servers
- AlicenseAqualityDmaintenanceSecrets vault for Claude Code. Encrypt API keys, tokens and passwords with AES-256. Full audit logs, MCP access rules, and zero-knowledge mode. Secrets never appear in chat.17205 npm1MIT
- AlicenseAqualityDmaintenanceLocal MCP server for macOS that scans AI coding tool history (Claude Code, Cursor, Copilot, Cline, Codex, Gemini CLI) for leaked secrets. Finds API keys in chat transcripts, redacts with sieve:// placeholders, and runs commands with Keychain-injected secrets - no plaintext values ever returned.91MIT
- FlicenseAqualityDmaintenanceEncrypted token store for Claude Code sessions, providing MCP tools for secure secret management with macOS Keychain integration, per-project allowlists, and native dialog input.65 npm6-
- AlicenseNot gradedqualityCmaintenanceGives ChatGPT Web hands on your Mac — files, git, terminal, browser, and windows via MCP, with outbound-only tunnel and delete protection.1MIT