Ainote is a remote MCP server that gives an AI agent 35 tools, among them assumption_write, auth_key, delete_dev_doc. It answers at https://api.ainote.dev/api/mcp over streamable HTTP, and it listed its tools to an anonymous client, so no sign-in was needed for that. Our probes reached it 6 of 6 times since 11 September 2026; the last check, on 24 October 2026, succeeded.
Agent-native notes, tasks, dev-docs, vaults, sync & handoffs. MCP + OpenAPI dual surface.
Description as the publisher wrote it.
| Tool | What it does |
|---|---|
assumption_write | Create or update an assumption under a project (L2 intent layer). Omit `id` to create, pass it to update. There is no delete tool. 🔴 `verdict` is REJECTED with an error if passed — verdict is confirmed only through a human judgment decision Inputs: project_id, id, statement, criticality, evidence_condition, bmc_block |
auth_key | Obtain an MCP key. action: login | signup (consolidated surface — same handlers as the legacy tools) Required per action — login: email, password | signup: email, password. Inputs: action, email, password, name |
delete_dev_doc | Soft-delete a dev document by title or UUID. Reversible from trash. Pass `category` when multiple docs share the same title across subcategories (memory/claude/cursor/env/docs). Inputs: title, id, category |
delete_task | Soft-delete a task by ID. Destructive but reversible within 30 days (TaskCleanupJob purges trash daily at 2am KST). Returns 404 if the task does not exist or is not owned by the authenticated user. Inputs: id |
dev_doc_write | Create or update a dev doc (non-destructive). action: create | update. Deletion is a separate tool (delete_dev_doc). (consolidated surface — same handlers as the legacy tools) Required per action — create: title, content | update: content. Inputs: action, title, content, category, content_type, local_path |
dev_docs_read | Read dev docs. action: get | list | categories | pull (consolidated surface — same handlers as the legacy tools) Inputs: action, title, id, category, include_versions, search |
env_sync.secret_pull | Pull an encrypted secret blob. Response is ciphertext_b64 only — server never sees and never returns plaintext. Inputs: node_id, alias, device_id |
env_sync.secret_push | Push a new client-encrypted secret. Ciphertext only — server never sees plaintext. Recipients must include the pushing device's own pubkey. Inputs: alias, kind, ciphertext_b64, recipients, device_id, client_hlc |
env_sync.secret_rotate | Rotate a secret: soft-delete the old node, create a new live node with the same alias and the new ciphertext+recipients. 7-day grace before hard delete of old ciphertext bytes. Inputs: node_id, new_ciphertext_b64, new_recipients, device_id, client_hlc |
env_sync_read | Read env-sync state. action: devices | drift | status | txn_pull. Secret reads are a separate tool (env_sync.secret_pull). (consolidated surface — same handlers as the legacy tools) Inputs: action, include_stale, device_id, since_hlc, op, limit |
env_sync_txn_push | Ingest a batched envelope of client-recorded env_sync mutations. HLC-skew gated, partial-success on conflict. Inputs: operations, device_id |
env_sync_txn_rollback | Inverse-apply a prior env_sync transaction. Safety gates: ownership, idempotency, descendant-conflict (force opt-out). Inputs: txn_id, include_descendants, force, device_id |
env_sync_write | Non-destructive env-sync writes. action: enroll | request_share | heartbeat. Secret push/rotate are separate tools. (consolidated surface — same handlers as the legacy tools) Required per action — enroll: alias, age_pubkey, enrollment_token Inputs: action, alias, age_pubkey, enrollment_token, capabilities, device_id |
get_setup_guide | Get instructions for setting up AI Note MCP in Claude Desktop, Cursor, or other MCP clients. No authentication required. |
graph_read | Read knowledge-graph nodes. action: get | list (consolidated surface — same handlers as the legacy tools) Inputs: action, node_id, alias, node_type, device_id, updated_since_hlc |
graph_soft_delete | Soft-delete an env_sync graph node (sets deleted_at; .live scope hides it from reads). Idempotent — re-deleting a deleted node is a no-op success. Inputs: node_id, device_id, client_hlc |
graph_write | Add or update a graph entity (non-destructive). action: add | update. Deletion is a separate tool (graph_soft_delete). (consolidated surface — same handlers as the legacy tools) Required per action — add: node_type, alias, payload, device_i Inputs: action, node_type, alias, payload, device_id, client_hlc |
handoff_read | Read session handoffs. action: get | list (consolidated surface — same handlers as the legacy tools) Required per action — get: project, topic. Inputs: action, project, topic, date, time, limit |
handoff_save | Save a session handoff note for cross-device / cross-session continuation. Stored at handoffs/{project}-{topic}-{YYYY-MM-DD}.txt in the user's primary vault. Use the optional `time` param (HHMM, KST) to disambiguate multiple handoffs saved Inputs: project, topic, content, content_b64, date, time |
judgment_list | List the authenticated user's own judgments (L3 layer) — use this to check your own blocking status (risk_tier 1 pending = execution blocked). Default order matches the /command queue: risk_tier ascending, then arrival order. Inputs: decision, kind, risk_tier, project_id, subject_type, subject_id |
judgment_submit | Request a human judgment (L3 layer) by attaching evidence — approval, evidence, or verdict. This is the ONLY door an agent has into the judgment queue. 🔴 `decision` is REJECTED with an error if passed — judgments are always created with dec Inputs: kind, risk_tier, summary, evidence, project_id, subject_type |
list_papers | List notes/papers from AI Note. Supports keyword search across title and content, category filtering, pagination, and sorting. Returns id/title/content_preview/category_id/created_at. Use this when the user asks 'find my note about X', 'wha Inputs: search, category_id, paper_category_id, source_type, limit, offset |
memory_read | Read agent memory. action: get | search (consolidated surface — same handlers as the legacy tools) Required per action — get: source | search: query. Inputs: action, source, id, path, query, mode |
project_read | List the authenticated user's projects (L2 intent layer), or fetch one by id. Each entry includes riskiest_assumption — the single highest-priority unverified assumption (or, if all are verified, the highest-criticality one). Inputs: id, status |
project_write | Create or update a project (L2 intent layer). Omit `id` to create, pass it to update. There is no delete tool — use status: 'archived' to retire a project. Inputs: id, name, intent, success_criteria, status |
sync_audit_layer5 | Record the result of a client-side Layer 5 codex review (sync.py merge gate) as a vault_events row. Body of the review is NOT stored — only an HMAC digest of the summary so operators can correlate without exposing review content. Opt-in: se Inputs: path, verdict, summary, chunk_count, duration_ms |
sync_delete | Delete a file from the primary vault. Optional CAS via base_sha to detect concurrent multi-PC writes. Protected paths (global/memory/, global/skills/, global/planning/, global/intent/, global/claude-config/, handoffs/) require base_sha or e Inputs: path, base_sha, device_id, force |
sync_push | Push a markdown file into the primary vault. Optional CAS via base_sha to detect concurrent multi-PC writes (Layer 3 of multi-PC sync plan). WAF-bypass tip: large bodies (~10KB+) that get false-positive blocked at Cloudflare can be sent via Inputs: path, content, content_b64, base_sha, device_id, force |
sync_push_batch | Push MANY files into the primary vault in ONE call. Use this instead of looping sync_push whenever you have more than a couple of changed paths — the cost of sync_push is round trips, not bytes. Per-item semantics are identical to sync_push Inputs: items, idempotency_key, device_id, supports_superseded |
sync_read | Read-only vault sync operations. action: list | pull | diff | merge | conflicts. Writes (push/delete) are separate tools — they carry CAS semantics. (consolidated surface — same handlers as the legacy tools) Required per action — diff: path Inputs: action, path, limit, cursor, since, local_text |
task_write | Create or update a task (non-destructive). action: create | update. Deletion is a separate tool (delete_task). (consolidated surface — same handlers as the legacy tools) Required per action — create: content | update: id. Inputs: action, content, is_important, due_date, due_time, start_date |
tasks_read | Read tasks and task categories. action: tasks | categories (consolidated surface — same handlers as the legacy tools) Inputs: action, status, is_important, limit, offset, search |
vault_create | Create a new private vault as a GitHub repository under the user's account. Requires the user to have completed the GitHub App install flow first. Inputs: name, slug, description |
vault_read | Read vault metadata. action: list | clone | status (consolidated surface — same handlers as the legacy tools) Required per action — clone: name. Inputs: action, include_commit_sha, name, target_path |
vault_sync | Wrapper around vault file sync. action=list|pull|push to work against the primary vault. list/pull are paginated — narrow with `path`/`since` and follow `next_cursor` instead of pulling the whole vault. For push: WAF-bypass via `content_b64 Inputs: action, path, content, content_b64, since, limit |
Every block below points at https://api.ainote.dev/api/mcp. Pick your client and copy.
claude mcp add --transport http ainote https://api.ainote.dev/api/mcp
{
"mcpServers": {
"ainote": {
"command": "npx",
"args": ["-y", "mcp-remote", "https://api.ainote.dev/api/mcp"]
}
}
}{
"mcpServers": {
"ainote": {
"url": "https://api.ainote.dev/api/mcp"
}
}
}{
"servers": {
"ainote": {
"type": "http",
"url": "https://api.ainote.dev/api/mcp"
}
}
}{
"context_servers": {
"ainote": {
"url": "https://api.ainote.dev/api/mcp"
}
}
}{
"mcpServers": {
"ainote": {
"serverUrl": "https://api.ainote.dev/api/mcp"
}
}
}{
"mcpServers": {
"ainote": {
"url": "https://api.ainote.dev/api/mcp"
}
}
}name: Ainote
version: 0.0.1
schema: v1
mcpServers:
- name: Ainote
type: streamable-http
url: https://api.ainote.dev/api/mcp{
"mcpServers": {
"ainote": {
"httpUrl": "https://api.ainote.dev/api/mcp"
}
}
}{
"mcpServers": {
"ainote": {
"type": "http",
"url": "https://api.ainote.dev/api/mcp"
}
}
}{
"mcpServers": {
"ainote": {
"url": "https://api.ainote.dev/api/mcp"
}
}
}goose://extension?url=https%3A%2F%2Fapi.ainote.dev%2Fapi%2Fmcp&type=streamable_http&id=ainote&name=Ainote
It answered our last check on 24 October 2026 in 287 ms. Over 6 checks since 11 September 2026 it answered 6. Status here comes from Neuronto's own probes, not from the publisher.
35, as returned by the server's own tools/list on 21 September 2026: assumption_write, auth_key, delete_dev_doc, delete_task, dev_doc_write, dev_docs_read, env_sync.secret_pull, env_sync.secret_push, and 27 more.
It answered our last check on 24 October 2026 in 287 ms. Over 6 checks since 11 September 2026 it answered 6.
Put the server under mcpServers in ~/.cursor/mcp.json with the URL https://api.ainote.dev/api/mcp. The exact JSON is above, with the same setup for Claude Code, Claude Desktop, VS Code, Windsurf, Zed, Gemini CLI and the rest.
It listed its tools to an anonymous client, so reading the tool list needs no key. Individual tools can still ask for credentials in their own inputs.
Publisher: io.github.seunghan91. Endpoint host: api.ainote.dev. ARD identifier: urn:air:io.github.seunghan91:mcp:ainote.
First indexed 10 September 2026. The tools are exactly what the server returned; nothing on this page
is inferred from its name. Ranking in Neuronto search is never for sale.