siyuan-note-mcp
Provides tools for interacting with the SiYuan note-taking application, enabling search, read, write, and management of notebooks, documents, and content blocks through the MCP server.
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@siyuan-note-mcpsearch my notes for 'MCP setup'"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
siyuan-note-mcp
把 思源笔记(SiYuan)接入任何 MCP 客户端——Claude Desktop、Cursor、Cline、DeepSeek Harness 等。装上后,你的 agent 就能直接搜索、读取和写入思源里的笔记本、文档与内容块。
特性
13 个工具覆盖日常读写:笔记本、文档、内容块、全文搜索、SQL 查询
零配置起步 — 默认连本机
http://127.0.0.1:6806,本地思源免 token按 ID 或路径寻址 — 文档既可用 ID,也可用
/笔记/我的文档这样的人类可读路径只读 SQL 保护 —
sql_query只放行SELECT/WITH/EXPLAIN错误可自愈 — 内核报错原文回传给模型,附带修正建议
Related MCP server: SiYuan MCP Server
安装
需要 Node.js ≥ 20,且思源笔记正在运行。
免安装,用 npx 直接跑:
npx -y siyuan-note-mcp或全局安装:
npm install -g siyuan-note-mcp
siyuan-note-mcp注意:npm 上已有的
siyuan-mcp是另一个项目,本包名是siyuan-note-mcp。
开发或想改代码时,从源码构建:
git clone https://github.com/Miles1994/siyuan-mcp.git
cd siyuan-mcp
npm install && npm run build从源码运行必须执行
npm run build——仓库不包含lib/构建产物,不构建就没有可运行的文件。(npm 上发布的包里已经带好了lib/。)
客户端配置
推荐:npx 免安装
{
"mcpServers": {
"siyuan": {
"command": "npx",
"args": ["-y", "siyuan-note-mcp"]
}
}
}连接远程或开启鉴权的内核时,再加环境变量:
{
"mcpServers": {
"siyuan": {
"command": "npx",
"args": ["-y", "siyuan-note-mcp"],
"env": {
"SIYUAN_API_URL": "http://192.168.1.5:6806",
"SIYUAN_TOKEN": "你的 API token"
}
}
}
}从源码运行
把 args 换成你 clone 下来的实际路径(Windows 下用正斜杠 /):
{
"mcpServers": {
"siyuan": {
"command": "node",
"args": ["/path/to/siyuan-mcp/lib/cli.js"]
}
}
}API token 在思源的 设置 → 关于 里查看。
Windows 上用 npx 报 spawn ENOENT:部分客户端不解析
npx.cmd包装。把command改为cmd、args改为["/c", "npx", "-y", "siyuan-note-mcp"]即可。
配置项
环境变量 | 默认值 | 说明 |
|
| 思源内核地址,别名 |
| 无 | API token,仅在开启鉴权时需要 |
|
| 单次请求超时(毫秒) |
思源默认只监听 127.0.0.1 且不校验 token。把内核暴露到局域网时请务必在设置里开启鉴权并配置 SIYUAN_TOKEN。
工具一览
工具 | 作用 |
| 列出所有笔记本及 ID、开关状态。需要笔记本 ID 时先调它 |
| 全文搜索,返回块 ID 与文档路径。支持 |
| 按最近更新列出文档,可按笔记本过滤 |
| 读取文档全文(Markdown)。接受文档 ID 或 |
| 读取单个块: |
| 用 Markdown 创建文档,父文档不存在会自动创建 |
| 追加/插入内容块到指定父块或某个块之后 |
| 替换某个块的内容 |
| 删除块(连同子块) |
| 重命名文档 |
| 移动文档到别的父文档或笔记本 |
| 删除文档(进回收站,可从「数据历史」恢复) |
| 对思源索引执行只读 SQL。主表 |
设计说明
为什么 sql_query 只能读
思源的 /api/query/sql 虽然文档上叫查询接口,但内核实际允许通过它执行写入——实测 3.8.4:DELETE FROM blocks WHERE 1=0 正常返回 code: 0。
原样暴露的话,模型就能绕过所有块级写工具直接改索引。因此本项目在本地拦截写操作,且用词法分析而非关键字正则:注释和字符串字面量里的关键字会被忽略,所以 WHERE content = 'please delete this' 能过,SELECT 1; DROP TABLE blocks 会被拒。
索引延迟
思源的 SQL 索引和全文索引是异步更新的,实测写入后约 2 秒才可见;而文档路径解析走文档树接口(getIDsByHPath),立即可见。所以:
刚创建的文档,用路径或 ID 读取立刻可用
list_documents、search_notes、sql_query这类走索引的结果,可能要等一两秒
这是内核的最终一致性设计,不是 bug。测试中的对应处理见 tests/e2e.spec.ts 的 waitFor。
DeepSeek Harness (DSH)
DSH 通过 @deepseek-ai/dsh-mcp-client 挂载外部服务器,配置在 ~/.dsh/profiles/<profile>/cordis.patch.yml。
装了 dsh-skill-mcp-panel 的话,该文件中的 MCP 区块由它托管,不要手改区块内内容(会被覆盖),改用它的 CLI:
dsh-panel mcp add --name siyuan --stdio --command npx \
--args -y --args siyuan-note-mcp --profile web
dsh-panel mcp test siyuan --profile web # 验证连通性
dsh-panel mcp list --profile web # 查看启用状态
--args每次只吃一个值,多个参数要重复写;mcp子命令必须显式给--profile。
否则手动插入这段(cordis.patch.yml 顶层是一个数组):
- insert:
- id: mcp-siyuan
name: "@deepseek-ai/dsh-mcp-client"
config:
serverName: siyuan
transport: stdio
command: npx
args:
- "-y"
- siyuan-note-mcp
env:
SIYUAN_API_URL: http://127.0.0.1:6806
cwd: ""工具会以 mcp__siyuan__search_notes、mcp__siyuan__get_document 这样的名字出现。
args里的路径不要加引号。stdio 直接传参数数组、不经过 shell,写成'"/path/to/cli.js"'会把引号当成文件名的一部分,spawn 时报 ENOENT。
开发
npm run build # 构建到 lib/
npm test # 单元测试
npm run typecheck # 类型检查端到端测试会直接连你本机的思源,创建并删除一个临时文档;检测不到内核时自动跳过:
npx vitest run tests/e2e.spec.ts发布(维护者)
package.json 里的 publishConfig 已把发布目标钉在 registry.npmjs.org——本机 npm 源即使配成镜像站也不会发错地方。
npm 现在强制要求发布者启用 2FA,账号没 2FA 时 npm publish 会直接 403:
Two-factor authentication or granular access token with bypass 2fa enabled is required to publish packages.注意:npm login 拿到的登录 token 不能发布,必须走下面两条之一。
A. 交互发布 — 在 https://www.npmjs.com/settings/~/tfa 启用 Authenticator app(TOTP),然后每次发布带上当次的验证码:
npm publish --otp=<6 位验证码>B. 自动化发布 — 在 https://www.npmjs.com/settings/~/tokens 建 Granular Access Token,权限给 Read and write,并勾选 Bypass 2FA,用环境变量传入(不要写进 .npmrc 提交):
# macOS / Linux
NPM_TOKEN=npm_xxx npm publish "--//registry.npmjs.org/:_authToken=$NPM_TOKEN"# Windows PowerShell
$env:NPM_TOKEN = 'npm_xxx'
npm publish "--//registry.npmjs.org/:_authToken=$env:NPM_TOKEN"完整流程:
npm test && npm run typecheck # 先过测试
npm version patch # 或 minor / major
npm publish --otp=<验证码> # prepare 钩子会自动构建 lib/发布前建议先 npm pack --dry-run 确认打包内容(应只有 lib/、README.md、LICENSE、package.json,共 8 个文件)。
长期建议迁到 trusted publishing (OIDC):npm 计划从 2027 年 1 月起收紧 Bypass-2FA token 的直接发布能力。 npm 页面上的 README 取自发布时的 tarball,改完 README 要发新版本才会同步。
许可
MIT
Available Tools
13 toolscreate_documentCreate documentA
Create a document from Markdown. path is the human-readable path, e.g. /Notes/Idea; missing parent documents are created automatically. An existing path is not overwritten — a new document is created alongside it.
| Name | Required | Description | Default |
|---|---|---|---|
| path | Yes | Document path starting with `/`, e.g. `/Notes/Idea`. | |
| markdown | No | Initial Markdown content. | |
| notebook | Yes | Notebook ID or exact notebook name. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations the description carries the full burden, and it delivers two meaningful behaviors: missing parent documents are auto-created, and an existing path is not overwritten so duplicates are created instead. It stops short of stating permission/auth requirements or what the call returns, but the side-effect disclosure is genuinely useful.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three tight sentences with zero filler; the core action is front-loaded and the path convention and collision behavior follow in order of importance.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a three-parameter write tool with no annotations and no output schema, the description covers action, path format, parent-creation side effect, and collision behavior — enough to call it correctly. Only permission/return-value context is absent, which is a minor gap.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already documents all three parameters including the `/Notes/Idea` example. The description largely repeats the path semantics rather than adding new syntax or constraints, and says nothing about `notebook` or `markdown`, so baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb+resource ('Create a document from Markdown') and immediately qualifies the key input (Markdown source). It is clearly distinguishable from siblings like rename_document, move_document, or insert_block without opening any schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Usage is implied by 'Create a document' — this is the tool for making a new document. It notes the collision case (existing path is not overwritten, a new document is created alongside), which shapes when the agent should/shouldn't rely on it, but it never names alternatives such as get_document for checking existence or list_documents for browsing.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
delete_blockDelete blockA
Delete a block (and its children) by ID. Deleting a document block removes the whole document. Use get_document or search_notes first to confirm the target.
| Name | Required | Description | Default |
|---|---|---|---|
| id | Yes | Block ID to delete. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full disclosure burden. It usefully reveals the cascade behavior (children deleted, document-level deletion) that the name alone would not convey, but it never states that deletion is permanent/irreversible, whether any auth or permission is required, or whether the operation can be undone.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three tight sentences, zero filler, with the destructive cascade warning front-loaded before the advisory prerequisite. Every sentence carries distinct, actionable information.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a one-parameter destructive tool with no annotations and no output schema, the description covers the critical behavioral surprise (cascade deletion) and the recommended pre-check. The main remaining gap is the absence of any statement about permanence or recovery.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Only one parameter, and the schema already documents it at 100% coverage ('Block ID to delete'). The description's 'by ID' adds no format or source-of-ID information beyond what the schema provides, so the baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb+resource ('Delete a block') and adds the non-obvious scope 'and its children', which an agent needs to know before calling. The additional note that deleting a document block removes the whole document further sharpens what the tool actually operates on.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly recommends confirming the target via `get_document` or `search_notes` first, naming concrete siblings. It does not, however, say when not to use this tool (e.g. use `remove_document` instead for full-document removal) or distinguish it clearly from the parallel `remove_document` sibling.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_blockGet blockA
Read one block by ID. kramdown returns the source including block attributes (IDs, made useful for locating nested blocks to edit); children lists direct child blocks.
| Name | Required | Description | Default |
|---|---|---|---|
| id | Yes | Block ID. | |
| format | No | `kramdown` (default) returns source; `children` returns direct child blocks. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden, and it does disclose what each format returns. However, it says nothing about behavior on an invalid/missing ID, permission requirements, or whether the read has side effects (it does not explicitly state this is a read-only, safe operation).
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two tightly packed sentences with zero filler; the core action and the format distinction are front-loaded, and no sentence is redundant.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no output schema and no annotations, the description adequately covers both parameters and the differing return shapes for each format. It is slightly short of complete because error handling and the read-only nature of the operation are left unstated.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the baseline is 3, but the description adds real meaning beyond the schema by explaining why to pick kramdown (it surfaces block attribute IDs for locating nested blocks to edit), a use case the schema does not convey.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ('Read one block by ID'), making it easy to pair with insert_block/update_block/delete_block siblings. It does not explicitly name an alternative such as get_document or a traversal tool, so sibling differentiation is implied rather than stated.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Usage is only implied: the reader infers this is for fetching a single known block ID. There is no guidance on how to obtain a block ID, no when-not-to-use (e.g. listing many blocks), and no pointer to the block-editing tools, other than the indirect hint about 'locating nested blocks to edit'.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_documentGet document contentA
Read a document as Markdown. Accepts a document ID or a human-readable path such as /Notes/My doc. This is the primary way to read note content.
| Name | Required | Description | Default |
|---|---|---|---|
| doc | Yes | Document ID, or a path like `/Notes/My doc`. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden, and it does disclose the return format (Markdown) and accepted identifier forms. It does not describe failure behavior for an unknown ID/path, permission requirements, or whether content is truncated for large documents.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three short sentences, front-loaded with the core action and return type, then the argument format, then the role. No filler or redundant clauses.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a single-parameter read tool with no output schema, the description covers what it returns (Markdown) and how to identify the document, which is most of what an agent needs. Error/edge-case behavior on invalid identifiers is the only notable omission.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% and the single 'doc' parameter already documents both the ID and the `/Notes/My doc` path form, so the description largely restates it. Baseline 3 is appropriate when the schema does the heavy lifting; the description adds no extra format or escaping detail.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description gives a specific verb and resource ('Read a document as Markdown') and states the return format and identity that content reading is its role ('primary way to read note content'). It implies a contrast with get_block but never names an alternative sibling, so it stops short of full sibling differentiation.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Saying it is 'the primary way to read note content' implies when to reach for it, but there is no explicit when-not guidance and no mention of get_block, search_notes, or list_documents as alternatives. Usage is inferable but not spelled out.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
insert_blockInsert blockA
Append Markdown as new blocks. With parent_id the content is appended inside that block (use a document ID to append to a document); with previous_id it is inserted directly after that block. Provide exactly one of them.
| Name | Required | Description | Default |
|---|---|---|---|
| data | Yes | Markdown content to insert. | |
| parent_id | No | Parent block/document ID to append into. | |
| previous_id | No | Insert immediately after this block ID. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full behavioral burden: it discloses the two insertion modes and the exactly-one constraint, which is useful. However it says nothing about write permissions, behavior on invalid/missing IDs, or the response, leaving meaningful behavioral gaps for a mutation tool.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two tight sentences; the core action is front-loaded and each clause (parent_id, previous_id, exclusivity) earns its place with no filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple 3-param tool with no annotations and no output schema, the description covers the essential operation and placement semantics. Only secondary details (permissions, error/response behavior) are absent, which is a minor gap.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so the baseline is 3, but the description adds value beyond the schema by explaining the semantic relationship between parent_id and previous_id and the 'exactly one' exclusivity rule, which the per-field schema descriptions do not express.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb+resource (append Markdown as new blocks) and disambiguates the two placement modes. It clearly differs from update_block/delete_block/get_block by operation type, but names no sibling explicitly, so it falls just short of 5.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Gives concrete invocation guidance: parent_id appends inside a block (document ID for documents), previous_id inserts after a block, and 'provide exactly one of them' states the mutual-exclusion rule. It covers how to use the tool but offers no comparison to alternative insertion/edit siblings.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_documentsList documentsA
List documents in the workspace or in one notebook, most recently updated first. Useful for browsing what exists before searching.
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | Maximum documents to return. Defaults to 50. | |
| notebook | No | Notebook ID or exact notebook name. Omit to list across all notebooks. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations exist, so the description carries the full behavioral burden. It does disclose the deterministic sort order ('most recently updated first'), which is a genuinely useful trait, but says nothing about pagination, result caps, or truncation behavior for a listing tool.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two tight sentences with the primary purpose front-loaded and no filler. Every clause (scope, ordering, use case) earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple zero-required-param list tool with 100% schema coverage and no output schema, the description covers scope, ordering, and intent adequately. Only minor gaps remain, such as pagination or how results are shaped when listing across all notebooks.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% with only 2 params, so the baseline is 3. The description reinforces the notebook-scoping concept ('in one notebook' / 'workspace') but adds no syntax or format detail beyond what the schema's parameter descriptions already provide, including the default limit.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ('List documents') plus scope ('in the workspace or in one notebook') and ordering ('most recently updated first'). This clearly separates it from mutation siblings like create_document/rename_document, though it doesn't explicitly contrast with the read sibling search_notes beyond the word 'searching'.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The phrase 'Useful for browsing what exists before searching' implies when to use it relative to searching, but it never names search_notes as the alternative nor states exclusions. Usage is suggested rather than prescribed.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_notebooksList notebooksA
List every notebook (思源笔记本) in the workspace with its ID, name and open state. Call this first when you need a notebook ID for other tools.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden, and it does meaningful work: it discloses that the result is exhaustive ('every notebook') and names the returned fields, which matters because there is no output schema. It does not mention pagination or sorting behavior, which is the remaining gap.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences, zero filler. The scope and returned fields are front-loaded and the usage instruction follows immediately; every clause earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a zero-parameter, read-only listing with no output schema, the description correctly compensates by naming the returned fields and stating the workspace-wide scope. Only the absence of any note on result size or ordering keeps it from being fully complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool takes zero parameters, which is the baseline-4 case; there is nothing for the description to clarify beyond confirming that the listing is unfiltered and workspace-wide.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb+resource ('List every notebook') and even enumerates the returned fields (ID, name, open state), with a parenthetical gloss of the domain term (思源笔记本). It does not explicitly distinguish itself from the similarly named sibling list_documents, so it stops short of a 5.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The second sentence gives explicit when-to-use guidance and an ordering hint: 'Call this first when you need a notebook ID for other tools.' No alternatives exist among siblings for this resource and no exclusions are stated, so it is clear context without full when/when-not coverage.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
move_documentMove documentA
Move a document under a different parent document, or into a different notebook. to may be a parent document ID/path, or a notebook ID/name to move it to that notebook's root.
| Name | Required | Description | Default |
|---|---|---|---|
| to | Yes | Destination parent document ID/path, or notebook ID/name. | |
| doc | Yes | Document ID or path to move. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full behavioral burden. It does disclose non-obvious destination semantics (a notebook target places the document at that notebook's root), which goes beyond a bare 'move'. But it is silent on permissions, whether descendants move with the document, collision/overwrite behavior, and reversibility of a mutation.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two compact sentences, zero filler, and the core purpose is front-loaded before the parameter clarification. Every clause earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a two-parameter tool with full schema coverage and no output schema, the description covers purpose and destination semantics adequately. Against zero annotations, though, it leaves the safety and side-effect profile entirely unstated, which is thin for a mutating operation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100% and both parameters are documented in the schema, so the baseline is 3. The description restates the `to` parameter's dual meaning and adds the 'notebook's root' detail, which is a marginal value-add over the schema text rather than new syntax or format guidance.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb plus resource ('Move a document') and immediately disambiguates the two modes of the operation: reparenting under another document vs. relocating into a notebook. This is clearly separable from siblings like rename_document, remove_document, and create_document, which do different things to a document.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Usage is implied by the action ('move a document' when you want it elsewhere), and the description usefully clarifies what each destination type means. However, it names no alternatives, no preconditions (e.g. needing write access to both source and destination), and no cases where the move would fail or should be avoided.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
remove_documentRemove documentB
Delete a document. Accepts a document ID or a path. The document is moved to the workspace trash (数据历史) and can be recovered from SiYuan.
| Name | Required | Description | Default |
|---|---|---|---|
| doc | Yes | Document ID or path. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden, and it does disclose the important trait that deletion is soft: the document goes to the workspace trash (数据历史) and is recoverable. It omits permission requirements, idempotency, and what happens when the ID/path is invalid.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two short sentences, front-loaded with the action, and the recoverability detail is placed where it is most useful. The 'Accepts a document ID or a path' clause is redundant with the schema and could be cut.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a one-parameter mutation tool with no output schema, the description covers the essential behavioral fact (soft delete with recovery), which is what an agent most needs to act safely. Remaining gaps are permission and failure-mode details that are secondary at this complexity.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% with the single 'doc' parameter already documented as 'Document ID or path', and the description repeats exactly that. Baseline 3 applies since the schema does the heavy lifting and the description adds no format or syntax detail.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ('Delete a document') and clarifies accepted identifier forms. It does not explicitly contrast with the nearby delete_block or move_document siblings, so an agent must infer that this targets whole documents rather than blocks.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no when-to-use guidance or mention of alternatives such as move_document for relocation versus deletion. The recoverability note implies the operation is safe-ish, but the description never says when an agent should choose this over other mutation tools.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
rename_documentRename documentC
Change the title of a document. Accepts a document ID or a path.
| Name | Required | Description | Default |
|---|---|---|---|
| doc | Yes | Document ID or path. | |
| title | Yes | New title. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full behavioral burden. It mentions the operation is a rename but says nothing about permissions required, reversibility, whether renaming preserves the document identity, or failure behavior for a mutation tool.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two short sentences with the purpose front-loaded and no filler. Efficient, though the second sentence duplicates schema information rather than earning its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
A simple two-parameter mutation with fully documented params and no output schema, so little is strictly needed. It is adequate, but the absence of any behavioral or usage context leaves real gaps for an agent deciding how and when to invoke it.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already documents both 'doc' and 'title'. The description's note that 'doc' accepts an ID or a path marginally reinforces the schema but adds no new syntax or constraint detail. Baseline 3.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb+resource ('Change the title of a document'), which is immediately clear. However, it offers no differentiation from siblings like move_document or update_block, which an agent might confuse with renaming.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to use this versus alternatives, prerequisites, or exclusions. The description only restates the operation, leaving usage entirely to inference.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
search_notesSearch notesA
Full-text search across the workspace and return matching blocks with their IDs and document paths. Use this to locate content before reading or editing it. Supports SiYuan search syntax, e.g. foo bar (AND), "exact phrase", foo OR bar, -exclude, * wildcard.
| Name | Required | Description | Default |
|---|---|---|---|
| page | No | Page number, 1-based. Defaults to 1. | |
| query | Yes | Search keywords. | |
| pageSize | No | Results per page, 1-50. Defaults to 10. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the disclosure burden, and it does state what comes back (matching blocks, IDs, document paths) — useful because there is no output schema. It never states the read-only nature or result paging behavior, but for a search tool the safety profile is clear from the wording.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three sentences, all load-bearing: purpose and return shape first, usage context second, syntax third. No filler and the most important information is front-loaded.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Covers what the tool does, when to reach for it, what it returns, and how to form queries — enough to call it correctly given no annotations and no output schema. Only minor gaps (result ordering, paging guidance) remain, and paging is already partly covered by the schema.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so the baseline is 3, and the description adds genuine value beyond the schema by documenting SiYuan query syntax (AND, quoted phrases, OR, negation, wildcard) that an agent could not infer from 'Search keywords.'
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb+resource ('Full-text search across the workspace') and goes further by describing the result shape ('matching blocks with their IDs and document paths'). This distinguishes it clearly from retrieval siblings like get_document, get_block, and sql_query.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
'Use this to locate content before reading or editing it' gives a clear when-to-use context that positions it ahead of the read/edit siblings. It stops short of naming an explicit alternative (e.g. sql_query for structured queries) or stating when-not to use it, so it falls just short of the top score.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
sql_queryRun SQL queryA
Run a read-only SQL query against the SiYuan index to answer questions the other tools cannot, e.g. counting blocks or filtering by tag/attribute. Main table: blocks (id, parent_id, root_id, box, path, hpath, type, subtype, content, tag, ial, created, updated). Only SELECT/WITH/EXPLAIN are allowed; results are capped at 64 rows by the kernel.
| Name | Required | Description | Default |
|---|---|---|---|
| stmt | Yes | A single read-only SQL statement. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden and does well: it discloses read-only semantics, the permitted statement classes (SELECT/WITH/EXPLAIN), and the kernel's 64-row result cap. It omits permission/auth requirements and what happens if a forbidden statement is submitted, so it is strong but not exhaustive.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Front-loads purpose and routing, then packs table schema and hard limits into two tight sentences with no filler. Every clause carries actionable information.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a raw SQL tool with no output schema, the description covers the query surface and row cap well, but does not describe the shape of returned results (columns/rows) beyond the cap, leaving the agent to infer the output format.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% (baseline 3), and the description adds meaningful constraints beyond the schema's 'single read-only SQL statement': the allowed statement types and the primary `blocks` table with its column list. That extra context helps the agent construct a valid `stmt`.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ('Run a read-only SQL query against the SiYuan index') and explicitly positions it against siblings by scoping it to 'questions the other tools cannot' with concrete examples (counting blocks, filtering by tag/attribute). An agent can distinguish it from search_notes/get_block without opening any schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Gives a clear selection condition — use this when the other tools cannot answer, with examples of such cases. It does not name a specific sibling as the preferred alternative or state explicit exclusions (e.g. 'do not use for full-text search'), so it stops short of full when/when-not routing.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
update_blockUpdate blockA
Replace the content of an existing block with new Markdown. The block type may change (e.g. a paragraph into a heading) unless lock_type is true. Get the ID from get_block or search_notes first.
| Name | Required | Description | Default |
|---|---|---|---|
| id | Yes | Block ID to replace. | |
| data | Yes | New Markdown content for the block. | |
| lock_type | No | When true, refuse the update if the parsed block type differs from the original. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden. It usefully discloses that the block type can change and that lock_type guards against that, which is real mutation semantics. It stops short of stating permissions required, reversibility, or what a failed update returns.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three short sentences, front-loaded with the core action, then the type-change caveat, then the ID-sourcing prerequisite. No filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For an unannotated mutation tool with no output schema, the description covers purpose, the type-change behavior, the lock_type safety path, and where to get the ID. Missing only side details like permission requirements and error semantics, which is a minor gap.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so the schema already documents all three parameters, including lock_type's refusal behavior. The description reframes lock_type behaviorally ('unless lock_type is true') but adds no syntax or format detail beyond the schema, so baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ('Replace the content of an existing block with new Markdown'), making the mutation contract immediately clear. It is cleanly distinguishable from insert_block, delete_block, and get_block, which appear as siblings.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly gives the prerequisite for obtaining the required id ('Get the ID from get_block or search_notes first'), naming the alternative tools. It does not, however, state when to choose this over insert_block or when an update is inappropriate.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
13 tool updates
v0.1.0- First observed
create_document - First observed
delete_block - First observed
get_block - First observed
get_document - First observed
insert_block - First observed
list_documents - First observed
list_notebooks - First observed
move_document - First observed
remove_document - First observed
rename_document - First observed
search_notes - First observed
sql_query - First observed
update_block
TDQS
Scored across 13 tools
Most tools target distinct resource+action pairs and descriptions explicitly distinguish reading vs editing. However, delete_block (which can delete a whole document) overlaps with remove_document, and get_document vs get_block require reading descriptions to separate. These are minor and well-clarified.
Nearly every tool follows a clean verb_noun pattern (list_notebooks, get_document, insert_block, update_block, delete_block, create_document, rename_document, remove_document, move_document). The only outlier is sql_query, which is a conventional, idiomatic exception.
13 tools is well within the ideal range and each earns its place across document, block, search, and query operations. No redundant or filler tools.
Document lifecycle (create/read/rename/move/remove) and block CRUD (get/insert/update/delete) are fully covered, plus search and SQL escape hatch. The main gap is notebook-level management — notebooks can only be listed, not created/renamed/deleted.
Maintenance
Related MCP Connectors
Search your AI chat history (ChatGPT, Claude, Codex) from any MCP client. Remote, private, read-only
Connect AI to your flomo notes. Search, create, edit notes and manage tags via MCP.
Read and write your Fresh Jots notes from Claude, Cursor, and any MCP client.
Search your Glasp web and Kindle highlights, notes, and AI memories from any MCP client. Read-only.
Related MCP Servers
- AlicenseNot gradedqualityNot gradedmaintenanceAn MCP server for SiYuan Note that enables comprehensive management of notebooks, documents, and blocks through AI integration. It supports advanced operations like SQL querying, OCR, multi-format exports, and automated content searching for intelligent knowledge management.21 npm5-
- AlicenseNot gradedqualityDmaintenanceA Model Context Protocol server that enables AI assistants like Claude and Cursor to interact seamlessly with SiYuan Note through 15 specialized tools. It supports comprehensive note operations including unified search, document management, daily notes, and tag manipulation.42 npmApache 2.0
- AlicenseNot gradedqualityDmaintenanceMCP server for SiYuan Note, enabling AI integration and smart knowledge management with note, block, search, template, export, asset, SQL, and file operations.21 npmMIT
- AlicenseNot gradedqualityCmaintenanceProvides a local MCP stdio server that enables AI clients to read, search, create, update, and delete notes in SiYuan through its Kernel HTTP API, with configurable notebook and tool permissions.MIT