Trina Drive

Why Trina Drive

• 📁 Your folders already are the knowledge base. Point Trina Drive at the NAS or shared drive you have. Your AI searches inside the files themselves (PDF, Word, Excel, PowerPoint, HWP), always the current version. Nothing to upload, no embeddings to rebuild, no consultants.

• 🔒 Each person's AI sees only what they may. Choose, folder by folder, whose AI may read it. A folder you may not read doesn't show up at all, not even its name. Tokens can narrow it further: one folder, read-only, seven days.

• 🧾 Safe to hand to the whole team. Through Trina Drive, AI writes drafts, never your originals; each draft remembers which folders it came from, and a person approves before it reaches a wider audience. Every file an AI opens lands in a hash-chained audit log.

Related MCP server: Safe MCP Server

What you can ask

Everyone asks in the AI app they already use, and every answer names the files it came from.

Screenshots

Quickstart

Managed · Self-host on a Mac mini · Docker on Linux · Try the demo locally

Managed (we set it up)

We install and run Trina Drive on a Mac mini in your office, connect your folders and your team's AI apps, and keep it updated, backed up and monitored. From $99/month; every security feature is also free to self-host.

Book a setup call →  ·  See plans

Managed storage: Trina Cloud

No NAS? Let Trina Drive own the folders. In managed storage your team uploads, renames, moves and deletes files in the web app (drag and drop, folders, large files, version history, trash), with the same per-person rules and the same audit, and agents read it exactly like a NAS folder. We host it per team in Trina Cloud, or run it yourself: tdrive init --managed, then make team folders on the Folders page (or tdrive folder create <name>). Details: docs/ARCHITECTURE.md.

• Mount as a drive. Open the team folders in Finder or Windows Explorer over WebDAV (https://<server>/dav/, an app password from Settings). Same rules, versions, trash and audit as the web. How

• Import from Google Drive. Pick files in the Google Picker; Docs, Sheets and Slides come in as docx, xlsx and pptx, and importing again updates them as new versions. Set GOOGLE_CLIENT_ID, GOOGLE_CLIENT_SECRET and GOOGLE_API_KEY to turn it on. How

Self-host on a Mac mini

The v0.1 path: a release folder and an installer that sets up service accounts, LaunchDaemons, pinned tools and encrypted daily backups (docs/INSTALL.md).

bun scripts/build.ts                   # builds the release folder (signed releases are coming)
cd dist/trina-drive-*-darwin-arm64
./install-macos.sh --dry-run           # see what it would do
sudo ./install-macos.sh                # install; prints the one-time web setup token

Docker on Linux

v0.2: one container, document and shell workers isolated with bubblewrap. NAS shares are mounted read-only (docs/DOCKER.md).

git clone https://github.com/potenlab/trina-drive && cd trina-drive
docker compose build
docker compose run --rm trina-drive init   # prints the one-time web setup token
docker compose up -d                       # web app and MCP on 127.0.0.1:8787

Try the demo in two minutes

Needs Bun 1.3, ripgrep and poppler (brew install ripgrep poppler, or your distro's packages).

git clone https://github.com/potenlab/trina-drive && cd trina-drive
bun install && bun run build:web
alias tdrive="bun run $PWD/src/cli.ts --data $PWD/.trina-drive"
docs/assets/src/seed.sh .trina-drive     # the sample company from the GIF; prints MINA, SAM and SETUP tokens
tdrive serve                             # web app at http://127.0.0.1:8787/, MCP at /mcp

tdrive sh --token <MINA token> -c 'ls /'   # in another terminal (with the same alias)

Open the web app and paste the setup token to sign in as the admin (alex). tdrive demo seed on an empty data directory gives a Korean sample company instead.

Connect your AI

On each person's own computer:

tdrive mcp add claude --server http://files.office.lan:8787 --login mina     # or: codex, cursor

It signs in, makes a personal token, keeps it in the macOS Keychain (or a 0600 file) and registers the server in your user settings, never in a repository's .mcp.json. --scope, --read-only and --ttl narrow the token.

More: docs/CONNECT-CLIENTS.md.

How it works

%%{init: {"theme": "base", "themeVariables": {"primaryColor": "#e7f6ef", "primaryBorderColor": "#0a7a53", "primaryTextColor": "#0a0b0d", "lineColor": "#0a7a53", "clusterBkg": "#f7fbf9", "clusterBorder": "#0a7a53"}}}%%
flowchart LR
  A["Claude Code · Codex · Cursor<br/>personal token · today"] -->|MCP| M
  B["Claude app · ChatGPT<br/>OAuth connector · v0.2"] -->|MCP| M
  P["People<br/>web app"] -->|web| G
  subgraph S["Trina Drive server · Mac mini or Linux + Docker, in your office"]
    M["MCP endpoint<br/>shell · read · write · promote"] --> G{{"One permission check<br/>person's rules ∩ token scope"}}
    G --> X["Sandboxed workers<br/>text of PDF · Office · HWP"]
    G --> D[("Draft box<br/>remembers sources")]
    G --> L[("Audit log<br/>hash-chained")]
  end
  G -->|read-only| F[("Your existing folders<br/>NAS · shared drive")]

Every way in (the shell, file tools, search, the web app) asks the same permission check. Agents get a small shell (ls, cat, grep -r, pipes; built on just-bash, with ripgrep) over a virtual tree that holds only what that person may read. Static diagram: docs/assets/architecture.svg. Details: docs/ARCHITECTURE.md.

Security model

• One decision point. Shell, file tools, search, the web app and drafts all ask the same function; the token's scope is applied inside it, so names outside the scope never leak.

• Hidden means nonexistent. Same output, error text and exit code as a path that does not exist.

• An agent never exceeds its person. Admins and folder managers set AI rules per folder; a token can only narrow them. "No AI" folders are closed to every agent.

• Fail closed. Links, NAS system folders, look-alike names and anything moved since the last scan stay closed until judged. Without OS isolation, shell commands and document parsing are refused.

• Writes are drafts. Through Trina Drive, agents cannot write, rename or delete originals. Promoting a draft creates a new file; if more people would see it, a person approves with a passkey or authenticator app.

• Audit you can check. Hash chain, secrets redacted, signed anchors sent off the server, tdrive audit verify.

What we do not promise: what an AI reads goes to the AI company its person uses, and copies made outside Trina Drive (someone opening the NAS directly) aren't tracked. The full picture and known limits: docs/SECURITY-MODEL.md. Found a vulnerability? SECURITY.md.

How it compares

Based on public documentation as of October 2026. Something out of date? Open an issue.

Roadmap

• v0.1: read shell, draft box, audit. Per-person permissions over existing folders, MCP for Claude Code, Codex and Cursor, tdrive mcp add, web admin, alerts, macOS installer with encrypted backups.

• v0.2: any AI, approved promotion (built, rolling out). OAuth 2.1 connectors for the Claude app, claude.ai and ChatGPT; passkeys and TOTP; draft promotion with approvals; web file browser; Linux Docker image.

• Managed storage (built): the server owns the team folders; upload, folders, rename, move, trash, versions and quota from the web app; promote may overwrite there as a new version.

• v0.3 (shaped with users): Google Drive as a source · OCR for scanned PDFs · semantic search · WebDAV · OIDC sign-in · more extractors. Tell us what you need in Discussions.

FAQ

The files stay on your server and are read in place. What an AI reads to answer a question goes to the AI company that person uses (Anthropic, OpenAI, Cursor), under that company's terms. Mark folders that must never leave as No AI: people can still open them in the web app, no agent can.

No. Point Trina Drive at the folders you already have. The AI searches inside the documents themselves (the text of PDF, Word, Excel, PowerPoint and HWP files) and reads the ones it needs, the way a colleague would. New files are there as soon as they're saved. There are no embeddings to rebuild; semantic search is on the roadmap as an addition.

Claude Code, Codex (CLI and app) and Cursor connect today with a personal token. The Claude app, claude.ai and ChatGPT connect as custom connectors in v0.2, which is built and rolling out. Anything that speaks MCP over HTTP works too.

Not through Trina Drive. Agents write only to their own draft box, and each draft remembers which folders it came from. A draft reaches a team folder only as a new file, in folders an admin has opened for it; if that would let more people see it, someone who can read the sources approves it first. Someone opening the NAS directly is outside Trina Drive's control.

Self-hosting is free, with every security feature. We charge for running it for you (from $99/month, pricing). The whole project is open source under Apache-2.0; see License.

Contributing

Issues and pull requests are welcome. Start with CONTRIBUTING.md (setup, tests, what a good PR looks like) and the good first issues. Contributions are accepted under Apache-2.0 with a DCO sign-off (git commit -s). Please follow the Code of Conduct.

Community

• 💬 GitHub Discussions: questions, ideas, show and tell

• 🐛 Issues: bugs and feature requests

• 🔐 Security reports: SECURITY.md (please don't open a public issue)

• ✉️ contact@trina.app for setup and managed plans

License

Apache-2.0 — see LICENSE. This covers the whole repository: server, CLI, web app and website. Copyright 2026 Trina Inc.; required notices are in NOTICE, and third-party components and their licenses are listed in docs/THIRD-PARTY.md. "Trina" and "Trina Drive" are trademarks of Trina Inc. and are not licensed by Apache-2.0.

Star history

Contributors