Skip to main content
Glama

secondbrain-mcp

Local-first personal knowledge base as MCP: Markdown vault + hybrid RAG retrieval + a safety-first gateway with hash locks, audit trail, privacy zones and rollback — so that AI agents can use your knowledge base without being able to wreck it.

状态:✅ v0.2 —— 14 个工具 · 单元+e2e 门禁全绿(含真实 stdio 协议端到端)· CI 门禁全过(semantic 门在 CI 口径外,见评测) | License: MIT

为什么做这个

2026 年的 AI agent 已经很会「读」,但很少被允许「写」用户的长期知识库——因为写没有安全边界。

本项目把一套在个人生产环境真实运行的知识库网关重写为单一 Python 核心,核心是四件事:

  1. 哈希锁写入:所有更新必须携带 expected_hash,且在锁内复验;冲突即拒绝并给出恢复指令。

  2. 无删除设计:归档 = 移动到 Archive 区并生成可回滚清单,清单在移动之前写入。

  3. 隐私分区:95_Private 在读取、写入、索引、检索四层拒绝,分区判定大小写无关。

  4. 全量审计:intent 与 outcome 分开记录,每条带前一条的哈希,形成可校验的链。

Related MCP server: repository-runtime

功能

  • MCP server:14 个窄工具(read / list / search / index / review / create / append / patch / meta / move / archive / restore / archive_list_batches)

  • 混合检索:BM25 倒排 + 向量余弦 + RRF 融合,两道防噪门禁

  • 增量索引:embed_state 显式跟踪,失败在下一轮自动重试

  • 模型指纹:换模型强制重建向量,杜绝向量空间混用

  • 正文编辑:note_patch 两阶段确认,先出 diff 再落盘

  • 隐私分区与待确认队列

  • 合成演示知识库(demo vault,无任何真实个人内容)

  • 单元测试 + 对抗性测试 + MCP stdio 端到端 + 可失败的检索门禁

  • 部署健康检查(暂存库跑全契约 + live 索引只读快照探针)

文档

快速开始

要求 Python 3.10+。两档安装:

git clone https://github.com/stone1524/secondbrain-mcp
cd secondbrain-mcp
pip install -e ".[semantic]"   # 完整混合检索(含 numpy + fastembed,推荐)
pip install -e .               # 纯词法模式(无需 numpy,mode=hybrid 自动降级并在返回中说明原因)

试用合成 demo vault(不接你自己的数据,仓库自带、全部为合成内容):

secondbrain-mcp          # 不设 SB_VAULT_ROOT 时默认服务仓库内 demo-vault/

接入自己的知识库 / MCP 客户端(Claude Code、Cursor 等任何支持 MCP 的客户端):

{
  "mcpServers": {
    "secondbrain": {
      "command": "python",
      "args": ["-m", "secondbrain_mcp.adapters.mcp_stdio"],
      "env": {
        "SB_VAULT_ROOT": "C:/path/to/your/markdown-vault",
        "SB_STATE_ROOT": "C:/path/to/state",
        "SB_AGENT_LABEL": "claude"
      }
    }
  }
}

环境变量:

变量

默认

说明

SB_VAULT_ROOT

仓库内 demo-vault/(按安装位置解析;wheel 安装找不到捆绑目录时回退 ./demo-vault)

vault 目录

SB_STATE_ROOT

<vault>/.secondbrain

索引、审计、锁的根目录

SB_RAG_DB

<state>/index.db

索引库路径

SB_AGENT_LABEL

无

审计归因标签,多客户端共用时区分写入者

SB_RAG_SEMANTIC

1

设为 0 走纯词法(纯词法模式无需 numpy)

SB_RAG_MODEL

BAAI/bge-small-zh-v1.5

嵌入模型

SB_RAG_MODEL_CACHE

无

模型缓存目录(离线场景必填,直通 fastembed)

SB_RAG_EMBED_BATCH

0(后端默认)

嵌入批大小,直通 fastembed

SB_SEMANTIC_FLOOR

0.55

语义命中相似度下限(查询与笔记同语言时)

SB_SEMANTIC_FLOOR_CROSS

0.42

跨中英语言对的语义命中下限(zh 调优模型跨语言余弦偏低,按语言对单独校准)

SB_SEMANTIC_MIN_TOKENS

20

语义命中最小 token 数,按整篇笔记计量(命中分块或全篇分块合计过线均可)

索引在首次 search 时按需自动构建或修复(大库首次调用会慢);index_rebuild 用于手动/强制重建(换嵌入模型后加 force=true)。note_read 才是取证。

安全模型

  • 写:note_create 默认只进 inbox 且重名加后缀(不覆盖);overwrite=true 提供带 expected_hash 哈希锁的受控覆盖(锁内复验);note_append / note_patch / note_meta / note_move 全部要求 expected_hash,并在文件锁内复验

  • 删:不存在。唯一移除路径是带批次回滚清单的归档,restore 可整批或按条恢复

  • 隐私:私有前缀在读、写目的地、索引、搜索四层拒绝,且大小写无关;泄漏探针在单元与线上两层测试

  • 审计:每次写落 intent 与 outcome 两条,带哈希链;AuditLog.verify() 可校验

  • 内容即数据:所有读取与检索结果带 trust: untrusted_note,提示调用方不得把笔记内容当作指令

评测

python -m secondbrain_mcp.eval.run --cases eval/cases-dev.json --semantic

五道门禁,每一道都能真的失败:recall@5 ≥ 0.85(标题派生用例口径;零重叠探针 no_shared_term 由下述 semantic 门与 by_category 读数单独承担,headline recall 仍计全量)、semantic rank-1 wins ≥ 1(仅在 --semantic 下生效,词法模式报告为 not-applicable 而不是静默通过;CI 无模型缓存、从不跑 --semantic,向量通道在 CI 口径中为 uncovered)、null vectors == 0、privacy leakage == 0(读侧四种拼写探测)、index_side_leak == 0(直接读库,抓读侧门禁看不见的入库泄漏)。CI 会先建 demo 索引,再跑门禁与部署契约检查,并再生成 eval/cases-dev.json 与提交版本比对(用例文件不得滞后 policy 变更)。 当前结果与旧系统的对照见 docs/evaluation.md。

License

MIT

Available Tools

13 tools
append_noteB

Append to a note under a per-file lock with optimistic-concurrency check on expected_hash.

NameRequiredDescriptionDefault
noteYes
contentYes
expected_hashNo

TDQS

B3.2/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full burden. It discloses meaningful non-obvious behavior: per-file locking and optimistic-concurrency checking on expected_hash. However, it does not explain failure behavior when the hash mismatches or what the response looks like, so it is not fully transparent.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, dense sentence that front-loads the action and adds the concurrency caveat without any filler. Every word contributes useful information.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

This is a mutation tool with no annotations and no output schema. The description omits error behavior, lock semantics in practice, whether the note must pre-exist, and how optimistic-concurrency failures surface. That makes it incomplete for safe use.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must compensate. It only clarifies expected_hash's role in the concurrency check, while note and content are left to name inference. It does not explain how to obtain or format expected_hash, which is critical for correct invocation.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the action ('Append to a note') and the resource, which distinguishes it from read/list/move/search operations. It does not explicitly name sibling alternatives, but the verb 'append' makes the core purpose unambiguous.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance is provided about when to use this tool versus alternatives like create_inbox_note or update_metadata. It also does not state prerequisites such as whether the note must already exist or how to obtain the expected_hash.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

archive_notesA

Archive notes by (note, hash, category) entries into the review area with a batch rollback manifest. Run dry_run first.

NameRequiredDescriptionDefault
dry_runNo
entriesYes

TDQS

A3.8/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the burden. It reveals batch behavior ('entries'), destination ('review area'), and safety/recovery mechanics ('batch rollback manifest', 'Run dry_run first'). It doesn't specify whether original notes are removed or how the manifest is consumed, but the key behavioral traits are present.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two short sentences, front-loaded with the action then the mandatory safety step; no filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given no output schema and no annotations, an agent lacks the return shape, the exact effect on original notes, and how the rollback manifest is used. The dry-run and manifest notes prevent this from being inadequate, but there are meaningful gaps for a batch mutating operation.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 0% and entries is an opaque object array, so the description's '(note, hash, category)' is the only definition of entries content. It also gives dry_run a purpose. It stops short of specifying required keys or value formats, but it compensates substantially for an empty schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States the verb 'Archive', the resource 'notes', and the destination 'review area'; the tuple '(note, hash, category)' defines scope. It is distinct in meaning from move_note, list_archives, and restore_archive, but it does not explicitly name an alternative to prevent confusion.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives a clear operational instruction: 'Run dry_run first.' It does not say when to choose archive_notes over move_note or other siblings, nor when not to use it. Selection context must be inferred from the word 'archive'.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

create_inbox_noteA

Create a note in an inbox directory (Web/Conversations/Files). Never overwrites an existing file.

NameRequiredDescriptionDefault
folderYes
contentYes
filenameYes

TDQS

A3.7/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description carries the full behavioral burden because no annotations are provided. It discloses the important non-overwrite guarantee, but does not explain what happens on a filename collision (error, no-op, rename), or whether permissions or directory creation are required. This is partial transparency.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

A single concise sentence with the operation and scope front-loaded. The non-overwrite safety warning earns its place as critical behavioral information. No filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a three-required-parameter create tool with no output schema, the description covers the core action and folder enumeration but omits conflict handling behavior and content/filename expectations. Since the 'never overwrites' statement immediately raises the collision question, some explicit error/return behavior is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema has no descriptions for the three required parameters (0% coverage), so the description must compensate. It adds useful semantics for the folder parameter by limiting values to Web/Conversations/Files, but content and filename are left to inference from the parameter names. No format or constraints are provided.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb ('Create') and resource ('a note') with the location ('inbox directory') and enumerates the possible directories (Web/Conversations/Files). This clearly separates it from sibling tools that read, list, move, search, append, update, or archive notes.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Does not name alternative tools or give explicit when-to-use versus when-not-to conditions. The clause 'Never overwrites an existing file' implies it is for new notes rather than modifying existing ones, but doesn't explicitly route to append_note, move_note, or other siblings.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

list_archivesB

List archive batches with their restore accounting.

NameRequiredDescriptionDefault
limitNo

TDQS

B3.3/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

There are no annotations, so the description carries the transparency burden. 'List' implies a read-only operation and 'with their restore accounting' hints at the returned data, but the description does not disclose pagination, ordering, or response details.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single concise sentence with the verb and resource front-loaded. There is no filler or redundant restatement.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description is adequate for a simple list operation, but it leaves 'archive batches' and 'restore accounting' undefined and does not mention the limit parameter. With no output schema, this leaves some gaps around expected results.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 0% and the description never mentions the 'limit' parameter. While the name and default value hint at a page size, the description adds no semantic value beyond what the schema already shows.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb ('List') and resource ('archive batches'), and adds that they are returned with their restore accounting. This makes the primary action clear and distinguishes it from list_notes at the resource level, though it does not explicitly name sibling alternatives.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No explicit when-to-use or when-not-to-use guidance is given. The resource name implies the tool is for listing archive batches and their restore accounting, but the agent must infer this usage context rather than being told directly.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

list_notesA

List note paths (private notes excluded), newest first; optional folder prefix and substring pattern.

NameRequiredDescriptionDefault
limitNo
folderNo
patternNo

TDQS

A3.8/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the transparency burden. It does add useful behavioral facts—private notes are omitted and ordering is newest-first—but it does not disclose side effects, pagination behavior, or whether returned paths are absolute or relative.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

A single, compact sentence front-loads the core operation and packs in the important qualifiers: private exclusion, ordering, and filter types. There is no filler or redundancy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple list operation, the description is largely sufficient: it states the output (note paths), the scope (private excluded), the order (newest first), and available filters. The missing limit semantics and exact return format are minor given the tool's simplicity.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, but the description partially compensates by interpreting folder as a prefix and pattern as a substring. The limit parameter is left unexplained, so the agent must rely on the name and default value.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description names a specific operation ('List note paths') and adds scope qualifiers: private notes are excluded and results are newest-first. This clearly distinguishes the tool from siblings like read_note (single-note retrieval) and search_notes (content search).

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description makes the tool's purpose evident, but it never explicitly states when to prefer list_notes over search_notes or rag_search. No alternatives or exclusions are named, so the agent must infer routing from the sibling names.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

move_noteA

Move a note within the vault (never into a private area); destination must not exist.

NameRequiredDescriptionDefault
noteYes
destinationYes
expected_hashNo

TDQS

A3.5/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden of behavioral disclosure. It does disclose two important constraints: moving into private areas is forbidden and the destination must not already exist. However, it does not describe side effects such as whether old paths are invalidated, error behavior, or reversibility, leaving the mutation behavior only partially transparent.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single efficient sentence that front-loads the core action ('Move a note within the vault') and then appends the two essential constraints. There is no filler or redundant restatement of the tool name.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a mutating tool with no annotations and no output schema, the description omits key context: what a successful move returns, what happens if the source note does not exist or the destination already exists, and how expected_hash interacts with the move. The two constraints are helpful but not enough for confident invocation.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must compensate, but it only clarifies the destination parameter ('destination must not exist,' 'never private'). It adds nothing about 'note' or 'expected_hash'; the optional hash parameter is entirely unexplained. Thus the description only partially compensates for the schema's lack of parameter documentation.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb and resource, 'Move a note within the vault,' which is unambiguous and immediately distinguishes this from the listed siblings such as append_note or archive_notes. The added constraint 'never into a private area' further refines the operation. No other sibling tool performs a move, so the purpose is fully clear.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies use when relocating a note inside the vault, but it does not state when to prefer this over alternatives or call out any when-not-to-use conditions. Constraints like 'destination must not exist' act as preconditions, not usage guidance. There is no explicit reference to alternatives among sibling tools.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

rag_reindexC

Incrementally re-index the vault into a rebuildable derived index.

NameRequiredDescriptionDefault
forceNo

TDQS

C2.4/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full burden of behavioral disclosure. It does not state whether re-indexing is destructive, whether it requires special permissions, how long it takes, whether it blocks other operations, or what the output/return value is. 'Incrementally' hints at non-destructive behavior but is not explicit.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single sentence with no wasted words, and the key action is front-loaded. However, it is so terse that it sacrifices useful context; it is concise but under-specified.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a tool with one parameter, no annotations, and no output schema, the description should explain the parameter's effect, the operation's side effects, and the expected result. It does none of these. The sibling context (rag_search, rag_status) suggests this is part of a RAG pipeline, but the description does not connect to that workflow.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must compensate for the undocumented 'force' parameter. It does not explain what 'force' does, when it should be true, or the difference between incremental and forced re-indexing. The description adds no parameter-level meaning beyond the schema's bare boolean type.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose3/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb ('re-index') and resource ('the vault'), and the word 'incrementally' adds some scope. However, it does not distinguish this from sibling tools like rag_search or rag_status, and 'rebuildable derived index' is somewhat jargon-heavy without explaining what the index is used for.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance is given on when to use this tool versus alternatives. The description does not mention prerequisites (e.g., whether the vault must already be indexed), when a force re-index is needed, or how this relates to rag_search or rag_status. An agent would have to infer usage from the name alone.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

rag_statusA

Index health metadata (document/chunk counts, schema version) without exposing note contents.

NameRequiredDescriptionDefault

No parameters

TDQS

A3.8/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden. It does disclose a key behavioral guarantee (no note contents are exposed) and implies a read-only status check, but it does not explicitly state side-effect-freeness, data freshness, or whether the metadata is cheap or expensive to compute.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

One sentence, front-loaded with the core function, followed by the most important privacy caveat. Every word earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a parameterless status tool, the description covers what it returns and what it deliberately omits. It is slightly thin on output format and error/edge behavior (e.g., empty or missing index), but the low complexity makes this a minor gap.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool has zero parameters, so the 0-param baseline applies. The description consequently has no parameter meanings to add; the empty schema is sufficient.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description identifies the exact resource (index health metadata), lists concrete examples (document/chunk counts, schema version), and contrasts itself with note contents, clearly distinguishing it from read_note, search_notes, and rag_search. The purpose is unmistakable.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance is given for when to call this tool versus rag_reindex or rag_search. The word 'health' implies diagnostics, but there are no stated conditions, exclusions, or alternative tools.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

read_noteA

Read a standard note by vault-relative path; returns the full-content hash. Private notes are never readable.

NameRequiredDescriptionDefault
noteYes
offsetNo
max_lengthNo

TDQS

A3.5/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the behavioral disclosure burden. It meaningfully reveals that private notes are never readable and that the tool returns the full-content hash, not raw note text. It does not cover error behavior, authentication, or how offset/max_length shape the response, but the core access and return semantics are disclosed.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two short sentences with the main action front-loaded. Every clause adds value — operation, addressing, return type, and a key restriction — with no redundancy or filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description covers the core read operation, path-based addressing, the private-note restriction, and the return type. However, with no output schema and no annotations, it omits the semantics of offset/max_length, behavior for missing or inaccessible notes, and what distinguishes a 'standard note' from other note types, leaving it minimally complete for a three-parameter tool.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must compensate for the bare parameter titles. It clarifies only the `note` parameter as a vault-relative path and hints at the output being a hash. The `offset` and `max_length` parameters are left entirely unexplained beyond their names and defaults, which is a significant gap.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly identifies the operation ('Read'), the resource ('a standard note'), and the addressing mechanism ('vault-relative path'). It also adds a key distinction — private notes are never readable — but it does not explicitly name or contrast sibling tools like search_notes or list_notes, so the differentiation from alternatives is not fully explicit.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies when to use the tool: when you have a known vault-relative path and need to read a standard note. It also states an exclusion ('Private notes are never readable'), but it gives no explicit guidance about when to prefer read_note over list_notes, search_notes, or rag_search, nor any alternative tool for private notes.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

restore_archiveB

Restore an archived batch back to its original paths; skips already-restored, missing, altered or occupied entries.

NameRequiredDescriptionDefault
onlyNo
dry_runNo
batch_idNolatest

TDQS

B3.3/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the behavioral burden and does add useful context by listing skipped cases: already-restored, missing, altered, or occupied entries. However, it omits other behavioral details such as return value, failure handling, permissions, and whether the archive entry is removed after a successful restore.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

A single front-loaded sentence states the primary operation first and then lists the exception cases compactly. There is no filler, repetition, or unnecessary detail.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a tool with no output schema and no annotations, the description is too sparse: it does not explain what 'only' or 'dry_run' do, what the default 'latest' batch means, or what the result of the operation looks like. The skip behavior is a good start, but important call-time context is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters1/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, and the description provides no meaning for the three parameters: only, dry_run, and batch_id. It only uses the word 'batch' generically, which does not clarify defaults or semantics, so the description fails to compensate for the schema gap.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states a specific verb and resource: 'Restore an archived batch back to its original paths.' It distinguishes the tool from siblings like archive_notes and list_archives by describing the reverse operation, so an agent can identify when restore_archive is applicable.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The use case is implied: call this when an archived batch needs to be returned to its original paths. However, it does not explicitly state when not to use it, name alternatives among the sibling tools, or mention prerequisites such as requiring an existing archive.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

search_notesA

Keyword search over indexed notes; falls back to a linear vault scan when the index is empty.

NameRequiredDescriptionDefault
limitNo
pathsNo
queryYes

TDQS

A3.7/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full burden of behavioral disclosure. It goes beyond a simple restatement by revealing the execution strategy (index search) and the fallback to a linear vault scan when the index is empty, which is valuable operational behavior. It does not mention read-only status, but 'search' reasonably implies non-mutating behavior, and no side effects are relevant for this tool.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, front-loaded sentence with no filler. It packs the core purpose and a key behavioral nuance into the smallest possible space, earning every word.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a tool with three parameters, no parameter descriptions in the schema, no annotations, and no output schema, the description is too sparse. It omits any explanation of what 'paths' controls, how 'limit' behaves, or what the result shape is. The fallback detail is nice, but it does not fill the major gaps an agent needs to call the tool correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must compensate for the lack of parameter documentation. It only implies the 'query' parameter through 'keyword search' and leaves 'limit' and 'paths' completely unexplained. Without additional parameter context, an agent cannot infer how to scope or paginate results.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb-resource pair ('Keyword search over indexed notes') and distinguishes itself from the sibling rag_search by explicitly labeling the search as keyword-based. The fallback behavior is an additional specific detail that further clarifies scope.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Usage context is implied by the phrase 'keyword search' — it signals when to prefer this tool over a semantic search tool like rag_search — but there is no explicit when-to-use/when-not-to-use guidance or mention of alternatives. The fallback text hints at behavior, not usage conditions.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

update_metadataA

Update an allowlisted set of frontmatter fields (status/tags/agent_generated/...); other keys are dropped.

NameRequiredDescriptionDefault
noteYes
fieldsYes
expected_hashNo

TDQS

A3.5/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden of behavioral disclosure. It explicitly states a destructive side effect: 'other keys are dropped,' meaning any keys not in the allowlist will be discarded. This is valuable beyond simply saying 'Update.' However, it does not mention behavior around expected_hash, permissions, or reversibility, but the dropping detail is the most critical.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, front-loaded sentence with no filler. Every phrase carries information: 'allowlisted set' scopes the operation, enumerates example fields, and the final clause discloses the destructive behavior. There is zero redundancy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a 3-parameter mutation tool with no annotations and no output schema, the description is too sparse. It does not clarify what 'note' refers to (ID, path, content), the purpose or format of 'expected_hash,' or the exact semantics of the allowlisting (e.g., are existing allowlisted fields preserved if absent from 'fields'?). An agent would need to make assumptions to call this correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must compensate. It provides some semantics for the 'fields' parameter by listing example allowlisted keys (status/tags/agent_generated) and noting non-allowlisted keys are dropped. But it does not explain the 'note' parameter or the 'expected_hash' parameter (likely a concurrency guard), leaving the agent to guess their meaning and use.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb ('Update') and resource ('frontmatter fields'), and clarifies the scope with 'allowlisted set' and 'other keys are dropped.' This clearly distinguishes it from siblings like move_note, append_note, or archive_notes, which operate on different aspects of a note.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description does not provide any guidance on when to use this tool versus alternatives, does not mention prerequisites, and offers no explicit exclusions or alternative tool names. It only states what the tool does, leaving the agent to infer when it is appropriate.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

  1. 13 tool updatesv0.1.0
    • First observedappend_note
    • First observedarchive_notes
    • First observedcreate_inbox_note
    • First observedlist_archives
    • First observedlist_notes
    • First observedmove_note
    • First observedrag_reindex
    • First observedrag_search
    • First observedrag_status
    • First observedread_note
    • First observedrestore_archive
    • First observedsearch_notes
    • First observedupdate_metadata

TDQS

B3.4/5.0

Scored across 13 tools

Disambiguation4/5

Most tools are clearly separated by action and resource, and the archive/restore group is unambiguous. However, search_notes and rag_search both offer retrieval over notes, and list_notes' substring filter partially overlaps with search_notes, so an agent could occasionally pick the wrong one.

Naming Consistency5/5

Tool names follow a consistent snake_case verb_noun pattern: read_note, list_notes, move_note, append_note, update_metadata, archive_notes, restore_archive. The rag_* tools use a domain prefix but still read predictably, so the naming convention is coherent throughout.

Tool Count5/5

Thirteen tools is a well-scoped count for a note-management server covering capture, retrieval, organization, metadata, and archiving. Each tool has a clear role and none feel redundant or extraneous.

Completeness4/5

The core note lifecycle is well covered: create via inbox, read, list, search, move, append, metadata update, archive, and restore. The main gaps are the lack of a direct content-replacement operation and a permanent delete/purge, though append and archive/restore mitigate most practical needs.

Maintenance

ActivityMaintained
ResponsivenessNo issues

Related MCP Connectors

Related MCP Servers