mcp-cosense
Provides tools for reading, searching, and safely editing Cosense (Scrapbox) projects, including browsing pages, full-text and vector search, and a two-step preview-and-submit flow for edits.
Click on "Install Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@mcp-cosensesearch for roadmap in our Cosense project"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
mcp-cosense
An MCP server for reading, searching, and safely editing
Cosense projects through Helpfeel's official
@helpfeel/cosense-cli.
The server exposes a fixed set of MCP tools instead of a general shell. Project access is restricted by an exact URL allowlist, and writes use the official CLI's two-step, five-minute preview and submit flow.
Requirements
Node.js 24 or later, or Docker
A Cosense Personal Access Token or project Service Account
Related MCP server: Agentrim MCP
Authenticate
Credentials are stored by the official Cosense CLI under ~/.cosense. Pass the
Cosense origin to store a Personal Access Token, or an exact project URL to store a
Service Account for that project.
npx mcp-cosense login https://scrapbox.ioThe token is entered interactively and is not passed through MCP.
Local MCP over stdio
Set COSENSE_ALLOWED_PROJECTS to the exact project URLs the server may access. Separate
multiple projects with commas. An empty allowlist disables all Cosense operations.
{
"mcpServers": {
"cosense": {
"command": "npx",
"args": ["-y", "mcp-cosense"],
"env": {
"COSENSE_ALLOWED_PROJECTS": "https://scrapbox.io/example-project"
}
}
}
}Running mcp-cosense without arguments uses stdio. --stdio selects it explicitly.
Docker and Streamable HTTP
Copy .env.example to .env, configure the allowlist, authenticate into the dedicated
volume, and start the server:
cp .env.example .env
docker compose --profile setup run --rm login
docker compose up -d --build serverThe endpoint is http://127.0.0.1:8798/mcp by default. The published port binds only
to loopback unless COSENSE_BIND_ADDRESS is changed.
The image also runs directly:
docker build -t mcp-cosense .
docker run --rm --read-only -p 127.0.0.1:8798:8798 \
-e COSENSE_ALLOWED_PROJECTS=https://scrapbox.io/example-project \
-v mcp-cosense-credentials:/home/cosense/.cosense:ro \
mcp-cosenseTools
browse_pagebrowse_related_pagesread_pagesearch_full_textsearch_vectorpreview_editpreview_new_pagesubmit_edit
preview_edit and preview_new_page do not change Cosense. Only submit_edit mutates
a page. A preview expires after five minutes and can be submitted only once.
Configuration
Variable | Default | Description |
| empty | Comma-separated exact project URLs; empty disables access |
| current home | Home containing |
|
| Per-command timeout |
|
| Per-stream output limit |
|
| Maximum concurrent CLI processes |
|
| HTTP listen address; Docker sets |
|
| HTTP listen port |
| localhost values | Accepted HTTP Host headers |
Security
The Cosense CLI child process receives a minimal environment and no unrelated application secrets.
The Docker image is distroless, unprivileged, and contains neither npm nor a shell.
The Compose service uses a read-only root filesystem, drops all Linux capabilities, and mounts credentials read-only outside the interactive login job.
Input size, output size, execution time, process count, and concurrency are bounded.
Project URLs are checked against the operator-configured allowlist before the CLI is invoked.
Development
npm ci
npm testAvailable Tools
8 toolsbrowse_pageBRead-onlyIdempotent
Read one Cosense page in an agent-friendly format with metadata and links.
| Name | Required | Description | Default |
|---|---|---|---|
| page_url | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| content | Yes | |
| warnings | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true and idempotentHint=true, which covers the safety profile. The description adds that the output is agent-friendly with metadata and links, which is useful but not extensive. No contradiction with annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single sentence, concise, and front-loads the action ('Read') and the resource. Every word adds value with no redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
While the tool is simple and annotations plus output schema cover safety and return format, the description lacks any usage differentiation from sibling read tools. For an agent selecting among browse_page, read_page, and browse_related_pages, the context is not fully complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must compensate. The single parameter page_url is self-explanatory and the description's reference to 'Cosense page' implies what the URL points to, but no additional format or usage details are provided beyond the parameter name.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states a specific verb (Read), resource (one Cosense page), and the output format (agent-friendly with metadata and links). It distinguishes itself from sibling tools by implying a structured format, though it does not explicitly compare to read_page.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is given on when to use this tool versus siblings like read_page or browse_related_pages. The description implies a general read operation but lacks explicit context or exclusions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
preview_editA
Preview an explicitly requested edit without changing the page. First call read_page and use its top-level page ID and lines[].id values. Inspect the returned complete post-edit page before calling submit_edit.
| Name | Required | Description | Default |
|---|---|---|---|
| page_id | Yes | ||
| operations | Yes | ||
| project_url | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| content | Yes | |
| warnings | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Description explicitly states 'without changing the page', which clarifies the non-mutating nature of the operation despite readOnlyHint=false. It also discloses the need for prior read_page call and the complete post-edit page return, providing useful behavioral context beyond annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two tightly written sentences: the first states the core function, the second gives the essential workflow. No fluff or repetition; information is front-loaded and directly actionable.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the presence of an output schema and clear annotations, the description covers the critical workflow steps (read_page, preview, submit_edit). It lacks explicit error handling or edge-case guidance, but for the intended use it is sufficiently complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Despite 0% schema description coverage, the description adds meaning by explaining that page_id and line IDs come from read_page's top-level page and lines[].id. This helps agents understand how to populate parameters, though it doesn't detail operations structure beyond what schema already defines.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Description clearly states the tool's purpose with specific verb 'preview' and resource 'explicitly requested edit', and explicitly notes it does not change the page. This distinguishes it from related tools like submit_edit and preview_new_page.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Provides a clear workflow: first call read_page to get page ID and line IDs, then preview, then inspect before submit_edit. This gives strong usage context and sequencing, though it doesn't explicitly mention when not to use it versus sibling preview_new_page.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
preview_new_pageA
Preview creation of a new page without changing Cosense. Use this only for an explicitly requested write. The title and each item in lines represent one Cosense line. Inspect the preview before submitting it.
| Name | Required | Description | Default |
|---|---|---|---|
| lines | Yes | ||
| title | Yes | ||
| project_url | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| content | Yes | |
| warnings | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already indicate a non-read, non-destructive side effect, and the description adds that the tool only previews and does not change Cosense. This is useful behavioral context. It could still mention what the preview output looks like, but the non-mutating preview behavior is clearly conveyed.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three short sentences, all informative and front-loaded with the core purpose. There is no redundant repetition of schema fields; every sentence contributes meaning.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the output schema exists, the return format does not need explanation. The description covers what the tool does, when to use it, and the meaning of the inputs. A small gap is not naming the sibling preview_edit or submit_edit for the actual write, but the guidance is otherwise sufficient.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 0%, so the description must carry meaning for parameters. It explains that 'title' and each item in 'lines' represent one Cosense line, which adds real semantic value beyond the raw schema. project_url remains implicit, but it is reasonably inferable from the tool's purpose.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb and resource ('Preview creation of a new page'), and clarifies it does not change Cosense. It is distinguishable from siblings like preview_edit because it mentions creating a new page, though it does not name the sibling explicitly.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It says to use this only for an explicitly requested write, giving a clear condition. It could be improved by explicitly naming preview_edit or submit_edit as the actual-write alternative, but the usage context is clear enough.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
read_pageARead-onlyIdempotent
Read structured page JSON, including page ID and line IDs used for edits.
| Name | Required | Description | Default |
|---|---|---|---|
| page_url | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| data | Yes | |
| warnings | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true, idempotentHint=true, and destructiveHint=false, fully covering safety traits. The description adds the detail that the response includes page ID and line IDs, which is useful but not critical. No contradiction exists, and the description does not go beyond the annotations in behavioral disclosure.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, front-loaded sentence that conveys the core action and the relevant return content without any filler. Every word earns its place, making it highly concise and well structured.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple one-parameter read tool with rich annotations and an output schema, the description covers the essentials. The only gap is the lack of explicit comparison to browse_page, but the description's specificity about structured JSON and edit IDs mitigates this. Overall, it is sufficiently complete for an agent to call the tool correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
With schema description coverage at 0%, the description must compensate, but it does not explicitly explain the page_url parameter. However, the parameter name and the tool description make it obvious that page_url is the URL of the page to read. This implicit understanding keeps the semantics at an acceptable level, though explicit clarification would be better.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb ('Read') and resource ('structured page JSON'), and includes the key output elements ('page ID and line IDs used for edits'). This clearly distinguishes it from sibling tools like browse_page, which likely provides a rendered or navigable view rather than structured JSON.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The phrase 'used for edits' implies the tool is intended for getting identifiers needed before making edits, but it does not explicitly state when to choose this over browse_page or other siblings. No exclusions or alternative conditions are provided, so the guidance is only implied.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
search_full_textARead-onlyIdempotent
Search complete Cosense page text with AND or OR matching.
| Name | Required | Description | Default |
|---|---|---|---|
| sort | No | pageRank | |
| query | Yes | ||
| match_any | No | ||
| project_url | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| data | Yes | |
| warnings | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnly, idempotent, and non-destructive behavior. The description adds behavioral value by specifying the search scope ('complete page text') and the boolean matching behavior, which are not visible in the annotations or schema.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single, front-loaded sentence communicates the core behavior with no filler. Every word earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The output schema and annotations cover return shape and safety, and the schema documents sort enum values and defaults. However, the description lacks parameter-level explanations and explicit guidance on choosing this tool over search_vector, so an agent is left to infer important calling context.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must compensate, but it only adds meaning for query/match behavior via 'AND or OR matching'. It does not explain project_url or sort, leaving half the parameters underspecified for an agent.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb ('Search') with a clear resource ('complete Cosense page text') and a distinguishing mode ('AND or OR matching'). This clearly separates it from vector-based search and page-browsing siblings without needing to open the schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Usage is implied rather than explicit: the AND/OR matching language suggests use for boolean full-text search, but the description does not name alternatives or state when not to use it. An agent must infer the relationship to search_vector and browse_page.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
search_vectorBRead-onlyIdempotent
Semantically search Cosense titles and link notation.
| Name | Required | Description | Default |
|---|---|---|---|
| query | Yes | ||
| project_url | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| data | Yes | |
| warnings | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations cover read-only, idempotent, and non-destructive behavior, so the safety profile is clear. The description adds the search scope ('titles and link notation') but says nothing about result ordering, limits, or failure modes; this is acceptable because annotations carry the core behavioral guarantees.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single concise sentence that front-loads the action and scope. It uses no filler words, but its brevity sacrifices necessary parameter context. As pure conciseness, it is strong.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With an output schema present, return values do not need to be described. However, the description fails to explain the purpose of project_url and query or to relate the tool to its siblings, leaving the agent with insufficient context for correct invocation. Even though the tool is simple, these omissions make the description incomplete overall.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, and the description does not mention either required parameter. The agent has no clue whether 'query' is a free-text string and 'project_url' is a base URL, or whether any special encoding is expected. This is a critical gap.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb ('search') and identifies a clear resource ('Cosense titles and link notation'). The qualifier 'semantically' distinguishes it from full-text methods like search_full_text, making the purpose unambiguous. Even without naming a sibling, an agent can infer its role.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No explicit usage guidance is given. The only hint is 'semantic', which implies use when meaning-based matching is desired, but it does not state when to prefer this over search_full_text or how the tools complement each other. This leaves the decision to the agent’s inference.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
submit_editADestructive
Commit one inspected Cosense edit preview. This mutates Cosense. Call it only for the same explicit user write request that produced the preview. Never retry an ambiguous result before read_page confirms whether the intended change already landed.
| Name | Required | Description | Default |
|---|---|---|---|
| preview_id | Yes | ||
| project_url | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| content | Yes | |
| warnings | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description reinforces the annotations by stating the tool mutates Cosense, and adds useful behavior beyond them: the confirmation-before-retry rule and the need to verify with read_page. There is no contradiction with the annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three terse sentences with the core action and mutation warning front-loaded. The retry guidance is concise and valuable with no wasted words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the annotations, output schema, and sibling context, the description covers the important invocation constraints: when to call, what it mutates, and how to handle ambiguity. It could explicitly name preview_edit as the source of preview_id, but the phrase 'produced the preview' covers this adequately.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, and the description does not explain project_url or preview_id. The names are somewhat self-explanatory, but for a destructive tool the description should at least clarify that preview_id comes from a prior preview step and what project_url refers to.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb and resource: 'Commit one inspected Cosense edit preview'. It clearly indicates this tool mutates Cosense, distinguishing it from read-oriented siblings like read_page and from preview-creation tools like preview_edit.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It gives an explicit precondition: call it only for the same explicit user write request that produced the preview. It also states never to retry an ambiguous result before read_page confirms whether the change landed, which directly routes the agent to the correct fallback.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
TDQS
browse_page and read_page both read a single page, but their purposes are differentiated by output format and edit intent. The search tools, related-pages tool, and preview/submit tools are clearly distinct, so an agent can generally select correctly.
All tool names follow a consistent snake_case verb-first pattern such as browse_, read_, search_, preview_, and submit_. The naming conventions are uniform and predictable across the entire set.
Eight tools is a well-scoped count for a Cosense page server, covering browsing, reading, searching, previewing edits, and submitting writes without unnecessary duplication. Each tool has a clear role in the workflow.
Read, browse, search, edit-preview, and submit workflows are covered, and the preview-before-submit flow is well defined. The main gaps are the lack of explicit page deletion, page history, and a dedicated new-page submission tool, though the core page lifecycle is mostly functional.
Maintenance
Resources
Unclaimed servers have limited discoverability.
Looking for Admin?
If you are the server author, to access and configure the admin panel.
Related MCP Connectors
One MCP URL for all your connectors — scoped writes, enforced constraints, and a full audit trail.
Governed MCP gateway: one endpoint for your tools, with credential custody and audit log.
Read and write Mission Control state via MCP — projects, tasks, subtasks, templates, status updates.
OAuth-protected, read-only-by-default MCP server for provenance-labeled QuillCaddie project memory.
Related MCP Servers
- FlicenseNot gradedqualityBmaintenanceEnables reading and writing Productboard data via MCP tools, with Google OAuth login, per-user allowlist, and workspace binding for secure, audited access.
- AlicenseNot gradedqualityBmaintenanceA least-privilege enforcement proxy for MCP servers. It sits between MCP clients and upstream servers, enforcing tool policies, hiding denied tools, requiring human approval for risky actions, and providing a structured audit trail.MIT
- AlicenseBqualityBmaintenanceAn MCP server that enables agents to safely interact with CMS content, with deny-by-default write policies, type/field allowlists, and structured audit trails.5MIT
- AlicenseNot gradedqualityAmaintenanceProvides a governance proxy layer for MCP servers, enforcing per-tool allowlists, human approval for write operations, quotas, secret redaction, and a hash-chained audit log of all calls.MIT
Latest Blog Posts
- Who's Calling? MCP Hosts Are an Identity Blind Spot (And the Spec Knows It)By Om-Shree-0709 on .mcpAgent IdentityOAuth 2.1
- Your AI Chatbot Just Exposed Your CEO's Salary to an InternBy Om-Shree-0709 on .Agent IdentityMCP SecurityOAuth Delegation
- Why MCP Servers Need Execution Sandboxing (And Why Your Current Stack Isn't Enough)By Om-Shree-0709 on .Agentic AiPrompt InjectionWebAssembly
MCP directory API
We provide all the information about MCP servers via our MCP API.
curl -X GET 'https://glama.ai/api/mcp/v1/servers/mu373/mcp-cosense'
If you have feedback or need assistance with the MCP directory API, please join our Discord server