Anki AI TutorCAUTION
A Model Context Protocol (MCP) server that enables AI assistants to interact with Anki, the spaced repetition flashcard application.
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
[](https://github.com/ankimcp/anki-mcp-server/actions/workflows/test.yml) [](https://www.npmjs.com/package/@ankimcp/anki-mcp-server)
Seamlessly integrate Anki with AI assistants through the Model Context Protocol
Beta - This project is in active development. APIs and features may change.
A Model Context Protocol (MCP) server that enables AI assistants to interact with Anki, the spaced repetition flashcard application.
Transform your Anki experience with natural language interaction - like having a private tutor. The AI assistant doesn't just present questions and answers; it can explain concepts, make the learning process more engaging and human-like, provide context, and adapt to your learning style. It can create and edit notes on the fly, turning your study sessions into dynamic conversations. More features coming soon!
Examples and Tutorials
For comprehensive guides, real-world examples, and step-by-step tutorials on using this MCP server with Claude Desktop, visit:
[ankimcp.ai](https://ankimcp.ai) - Complete documentation with practical examples and use cases
See docs/ for supplementary documentation, including the reviewer setup guide and the sample Anki deck.
Example Use Cases
Three representative prompts showing the tool flows this server enables:
- "Help me review my Spanish deck." — The assistant offers to sync with AnkiWeb (
sync), fetches due cards (get_due_cardswith deck filter), presents each card (present_card), and records your rating (rate_card). Natural study conversa
d18a5b34f348OBSERVED · 2026-10-08Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.
claude mcp add anki-mcp-server -- npx -y @ankimcp/[email protected]
Exposed tools (52)
34 read · 12 write · 6 destructive. Blast radius: 6 tools can delete or overwrite — an agent that can be talked into calling a tool can be talked into calling this one.
| Tool | Risk | Description |
|---|---|---|
addModelField | write | Add a new field to an existing Anki note type (model). |
addTags | write | Add tags to specified notes. Tags is a space-separated string (e.g., |
anki_review | read | Guidelines for conducting Anki spaced repetition review sessions |
areSuspended | read | Check whether cards are suspended, without changing anything. Card IDs (not note IDs) — |
changeDeck | write | Move cards to a different deck. Target deck will be created if it doesn |
clearUnusedTags | destructive | Remove orphaned tags that are not used by any notes in the collection, across the whole collection at once. Removed tags disappear from Anki |
collection_stats | read | Get aggregated statistics across all decks in the collection including card counts, ease factor distribution, and interval distribution. |
createDeck | write | Create a new empty Anki deck. Use |
createModel | write | Create a new note type (model) in Anki with custom fields, card templates, and styling. |
deckStats | read | Get comprehensive statistics for a single deck including card counts, ease and interval distributions. Pass a deck name (e.g., |
deleteMediaFile | destructive | Remove a media file from Anki |
deleteNotes | destructive | Delete notes by their IDs. Permanently removes the notes and ALL their cards, including the cards |
findNotes | read | Search for notes using Anki query syntax. Returns an array of note IDs matching the query. |
forgetCards | destructive | Reset cards to the new queue, discarding their current scheduling (interval, due date, and ease factor). |
getMediaFilesNames | read | List media files in Anki |
getTags | read | Get all tags in the Anki collection. Use this to discover existing tags before creating notes to maintain consistency and prevent tag duplication (e.g., avoiding |
get_cards | read | Retrieve cards from Anki with flexible filtering by deck and card state. Reads the local collection as-is and does not sync with AnkiWeb, so reviews made on other devices since the last sync are not reflected. Answers are not included by default (include_answer=false), so a card |
get_due_cards | read | Retrieve cards that are due for review from Anki. Reads the local collection as-is and does not sync with AnkiWeb, so reviews made on other devices since the last sync are not reflected. Answers are not included by default (include_answer=false), so a card |
guiAddCards | write | Opens the Add Cards dialog in the Anki desktop app on the user |
guiBrowse | read | Opens the Card Browser window in the Anki desktop app on the user |
guiCurrentCard | read | Reads the card currently shown in the Anki desktop app |
guiDeckBrowser | read | Switches the Anki desktop app |
guiDeckOverview | read | Makes the named deck Anki |
guiEditNote | read | Opens the note editor window in the Anki desktop app on the user |
guiSelectCard | read | Changes the selection in the Card Browser window open in the Anki desktop app on the user |
guiSelectedNotes | read | Reads the IDs of the notes the user has selected in the Card Browser window of the Anki desktop app. Changes nothing on screen. |
guiShowAnswer | read | Flips the card on the Anki desktop app |
guiShowQuestion | read | Flips the card on the Anki desktop app |
guiUndo | read | Triggers Anki |
listDecks | read | List all Anki decks, optionally with per-deck study-queue statistics. |
modelFieldNames | read | Get the field names for a specific note type (model). Use this to know what fields are required when creating notes of this type. |
modelNames | read | Get a list of all available note type (model) names in Anki. Use this to see what note types are available before creating notes. |
modelStyling | read | Get the CSS styling for a specific note type (model). This CSS is used when rendering cards of this type. |
modelTemplates | read | Get the card templates (Front and Back HTML) for a specific note type (model). |
notesInfo | read | Get fields, tags, note type (model) name, card IDs and modification time for each note, by note ID (from findNotes). |
present_card | read | Returns a card |
rate_card | read | Records a real review of a card in Anki |
removeModelField | destructive | Remove a field from an existing Anki note type (model). |
removeTags | destructive | Remove tags from specified notes. Tags is a space-separated string (e.g., |
renameModelField | write | Rename a field in an existing Anki note type (model). |
replaceTags | write | Rename a tag across specified notes (e.g., |
repositionModelField | read | Change the position of a field within an Anki note type (model). |
retrieveMediaFile | read | Download a media file from Anki |
review_stats | read | Get review history analysis including temporal patterns, retention metrics, and study streak information. |
setDueDate | read | Reschedule cards to become due in a given number of days, without recording a review. |
storeMediaFile | write | Upload a media file to Anki |
suspend | read | Suspend cards so they |
system-info | read | Current system information and environment |
unsuspend | read | Unsuspend cards so they return to normal review. Card IDs (not note IDs) — use get_cards, |
updateModelStyling | write | Update the CSS styling for an existing note type (model). |
updateModelTemplates | write | Update the card templates (Front and Back HTML) for an existing note type (model). |
updateNoteFields | write | Update the fields of an existing note. The given fields |
Trust audit
CAUTIONgrade C · trust 78/100 Install with care. The audit found things worth knowing before you trust its output.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | WARN |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | WARN |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (2 observation(s))
- Network
- declared (2 observation(s))
- Shell
- none-observed
- Dependencies
- not all pinned
- Secrets in source
- none-found
Findings (25)
if ! curl -s http://127.0.0.1:3000 > /dev/null 2>&1; then
clearUnusedTags, deleteMediaFile, deleteNotes, forgetCards, removeModelField, removeTags
MCP Reviewer Demo.apkg
.mcpbignore
it("should reject non-media file paths (e.g., .ssh/id_rsa)", async () => {path: "/home/user/.ssh/id_rsa",
"/home/user/.ssh/id_rsa",
expect(() => validateMediaFilePath("/some/path/id_rsa")).toThrow(validateMediaFilePath("/photos/image\0.ssh/id_rsa.jpg"),const packageJsonPath = path.join(__dirname, "../../package.json");
const packageJsonPath = path.join(__dirname, "../../package.json");
readFileSync(join(__dirname, "../../package.json"), "utf-8"),
import { AppModule } from "../../../app.module";import { createMcpHttpServer } from "../../mcp-http.factory";it("blocks cloud metadata endpoint (169.254.169.254)", async () => {{ address: "169.254.169.254", family: 4 },url: "http://169.254.169.254/latest/meta-data/",
["169.254.169.254", "link-local (cloud metadata)"],
["64:ff9b::169.254.169.254", "rfc6052 / NAT64 wrapping cloud metadata"],
| `ALLOWED_ORIGINS` | HTTP mode: comma-separated allowlist of browser `Origin`/`Referer` patterns (wildcards supported, e.g. `https://*.ngrok.io`). | `http://localhost:*,http://127.0.0.1:*,https://loc
- **MCP endpoint**: `http://127.0.0.1:3000/` (root path)
- `ALLOWED_ORIGINS` - Comma-separated allowlist of browser `Origin`/`Referer` patterns; wildcards supported (e.g. `https://*.ngrok.io`). Default: `http://localhost:*,http://127.0.0.1:*,https://localho
"http://127.0.0.1:*",
@nestjs/common, @nestjs/config, @nestjs/core, @nestjs/microservices, @nestjs/platform-express, @rekog/mcp-nest, async-mutex, commander
- **Read-only errors carry a read-only hint.** A call blocked by read-only mode used to return the tool's generic hint (e.g. "Make sure Anki is running...") next to the read-only error. The hint now s
Gates applied: no_behavioural_pass.
d18a5b34f348full audit observations/trust-audit/mcp-server/anki-mcp__anki-ai-tutor.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-08 | d18a5b34f348 | CAUTION | C | 78 | first audit |
Questions
What is the Anki AI Tutor MCP server?
A Model Context Protocol (MCP) server that enables AI assistants to interact with Anki, the spaced repetition flashcard application.
What tools does Anki AI Tutor expose?
52 in total: 34 read-only, 12 that write, and 6 that can delete or overwrite (clearUnusedTags, deleteMediaFile, deleteNotes, forgetCards, removeModelField). Every one is listed on this page with its risk.
Is Anki AI Tutor safe to connect to an agent?
With care. The audit graded it C (78/100) and found 25 things worth knowing before you trust this server, listed below with the exact line each was found on. Separately from the audit: 6 of its tools can destroy data, so scope the token you give it to what you actually need.
What credentials does Anki AI Tutor need?
It reads ANKI_CONNECT_API_KEY and TUNNEL_AUTH_CLIENT_ID from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How does Anki AI Tutor run?
It speaks stdio and streamable-http, so it runs as a local process your client starts. It is published on npm as @ankimcp/anki-mcp-server at 0.27.0.
How current is this page?
The grade is for one exact copy of the source (d18a5b34f348), read on 2026-10-08. The repository is watched and re-audited when it changes.