AnkiCAUTION
A Model Context Protocol (MCP) server that enables AI assistants to interact with Anki, the spaced repetition flashcard application.
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
[](https://github.com/ankimcp/anki-mcp-server/actions/workflows/test.yml) [](https://www.npmjs.com/package/@ankimcp/anki-mcp-server)
Seamlessly integrate Anki with AI assistants through the Model Context Protocol
Beta - This project is in active development. APIs and features may change.
A Model Context Protocol (MCP) server that enables AI assistants to interact with Anki, the spaced repetition flashcard application.
Transform your Anki experience with natural language interaction - like having a private tutor. The AI assistant doesn't just present questions and answers; it can explain concepts, make the learning process more engaging and human-like, provide context, and adapt to your learning style. It can create and edit notes on the fly, turning your study sessions into dynamic conversations. More features coming soon!
Examples and Tutorials
For comprehensive guides, real-world examples, and step-by-step tutorials on using this MCP server with Claude Desktop, visit:
[ankimcp.ai](https://ankimcp.ai) - Complete documentation with practical examples and use cases
See docs/ for supplementary documentation, including the reviewer setup guide and the sample Anki deck.
Example Use Cases
Three representative prompts showing the tool flows this server enables:
- "Help me review my Spanish deck." — The assistant syncs with AnkiWeb (
sync), fetches due cards (get_due_cardswith deck filter), presents each card (present_card), and records your rating (rate_card). Natural study conversation with
fd98695f3978OBSERVED · 2026-10-01Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.
claude mcp add anki-mcp-server -- npx -y @ankimcp/[email protected]
Exposed tools (51)
31 read · 14 write · 6 destructive. Blast radius: 6 tools can delete or overwrite — an agent that can be talked into calling a tool can be talked into calling this one.
| Tool | Risk | Description |
|---|---|---|
addModelField | write | Add a new field to an existing Anki note type (model). |
addTags | write | Add tags to specified notes. Tags is a space-separated string (e.g., |
anki_review | read | Guidelines for conducting Anki spaced repetition review sessions |
areSuspended | read | Check whether cards are suspended, without changing anything. Card IDs (not note IDs) — |
changeDeck | write | Move cards to a different deck. Target deck will be created if it doesn |
clearUnusedTags | destructive | Remove orphaned tags that are not used by any notes in the collection. CRITICAL: This is destructive and permanent - only run when the user explicitly asks to clean up tags. |
collection_stats | read | Get aggregated statistics across all decks in the collection including card counts, ease factor distribution, and interval distribution. |
createDeck | write | Create a new empty Anki deck. Use |
createModel | write | Create a new note type (model) in Anki with custom fields, card templates, and styling. |
deckStats | read | Get comprehensive statistics for a single deck including card counts, ease and interval distributions. Pass a deck name (e.g., |
deleteMediaFile | destructive | Remove a media file from Anki |
deleteNotes | destructive | Delete notes by their IDs. This will permanently remove the notes and ALL associated cards. |
findNotes | read | Search for notes using Anki query syntax. Returns an array of note IDs matching the query. |
forgetCards | destructive | Reset cards to the new queue, discarding their current scheduling (interval, due date, and ease factor). |
getMediaFilesNames | read | List media files in Anki |
getTags | read | Get all tags in the Anki collection. Use this to discover existing tags before creating notes to maintain consistency and prevent tag duplication (e.g., avoiding |
guiAddCards | write | Open Anki Add Cards dialog with preset note details (deck, model, fields, tags). Returns potential note ID. |
guiBrowse | read | Open Anki Card Browser and search for cards using Anki query syntax. Returns array of card IDs found. |
guiCurrentCard | read | Get information about the current card displayed in review mode. Returns card details (question, answer, deck, model, etc.) or null if not in review. |
guiDeckBrowser | read | Open Anki Deck Browser dialog showing all decks. |
guiDeckOverview | read | Open Anki Deck Overview dialog for a specific deck. Shows deck statistics and study options. Returns true if succeeded. |
guiEditNote | read | Open Anki note editor dialog for a specific note ID. Allows manual editing of note fields, tags, and cards in the GUI. |
guiSelectCard | read | Select a specific card in an open Card Browser window. Returns true if browser is open and card was selected, false if browser is not open. |
guiSelectedNotes | read | Get the IDs of notes currently selected in the Card Browser. Returns array of note IDs (empty if no selection). |
guiShowAnswer | read | Show the answer side of the current card in review mode. Returns true if in review mode, false otherwise. |
guiShowQuestion | read | Show the question side of the current card in review mode. Returns true if in review mode, false otherwise. |
guiUndo | read | Undo the last action or card in Anki. Returns true if undo succeeded, false otherwise. |
listDecks | read | List all Anki decks, optionally with per-deck study-queue statistics. |
modelFieldNames | read | Get the field names for a specific note type (model). Use this to know what fields are required when creating notes of this type. |
modelNames | read | Get a list of all available note type (model) names in Anki. Use this to see what note types are available before creating notes. |
modelStyling | read | Get the CSS styling for a specific note type (model). This CSS is used when rendering cards of this type. |
modelTemplates | read | Get the card templates (Front and Back HTML) for a specific note type (model). |
notesInfo | read | Get detailed information about specific notes including all fields, tags, model info, and CSS styling. |
present_card | read | Retrieve a card\ |
rate_card | write | Submit a rating for a card to update Anki |
removeModelField | destructive | Remove a field from an existing Anki note type (model). |
removeTags | destructive | Remove tags from specified notes. Tags is a space-separated string (e.g., |
renameModelField | write | Rename a field in an existing Anki note type (model). |
replaceTags | write | Rename a tag across specified notes (e.g., |
repositionModelField | read | Change the position of a field within an Anki note type (model). |
retrieveMediaFile | read | Download a media file from Anki |
review_stats | read | Get review history analysis including temporal patterns, retention metrics, and study streak information. |
setDueDate | read | Reschedule cards to become due in a given number of days, without recording a review. |
storeMediaFile | write | Upload a media file to Anki |
suspend | read | Suspend cards so they |
sync | write | Synchronize local Anki collection with AnkiWeb. IMPORTANT: Always sync at the START of a review session (before getting cards) and at the END when user indicates they are done. This ensures data consistency across devices. |
system-info | read | Current system information and environment |
unsuspend | read | Unsuspend cards so they return to normal review. Card IDs (not note IDs) — use get_cards, |
updateModelStyling | write | Update the CSS styling for an existing note type (model). |
updateModelTemplates | write | Update the card templates (Front and Back HTML) for an existing note type (model). |
updateNoteFields | write | Update the fields of an existing note. Supports HTML content in fields and preserves CSS styling. |
Trust audit
CAUTIONgrade C · trust 79/100 Install with care. The audit found things worth knowing before you trust its output.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | WARN |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | WARN |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (2 observation(s))
- Network
- declared (2 observation(s))
- Shell
- none-observed
- Dependencies
- not all pinned
- Secrets in source
- none-found
Findings (25)
if ! curl -s http://127.0.0.1:3000 > /dev/null 2>&1; then
clearUnusedTags, deleteMediaFile, deleteNotes, forgetCards, removeModelField, removeTags
MCP Reviewer Demo.apkg
.mcpbignore
it("should reject non-media file paths (e.g., .ssh/id_rsa)", async () => {path: "/home/user/.ssh/id_rsa",
"/home/user/.ssh/id_rsa",
expect(() => validateMediaFilePath("/some/path/id_rsa")).toThrow(validateMediaFilePath("/photos/image\0.ssh/id_rsa.jpg"),const packageJsonPath = path.join(__dirname, "../../package.json");
const packageJsonPath = path.join(__dirname, "../../package.json");
readFileSync(join(__dirname, "../../package.json"), "utf-8"),
import { AppModule } from "../../../app.module";import { createMcpHttpServer } from "../../mcp-http.factory";it("blocks cloud metadata endpoint (169.254.169.254)", async () => {{ address: "169.254.169.254", family: 4 },url: "http://169.254.169.254/latest/meta-data/",
["169.254.169.254", "link-local (cloud metadata)"],
["64:ff9b::169.254.169.254", "rfc6052 / NAT64 wrapping cloud metadata"],
| `ALLOWED_ORIGINS` | HTTP mode: comma-separated allowlist of browser `Origin`/`Referer` patterns (wildcards supported, e.g. `https://*.ngrok.io`). | `http://localhost:*,http://127.0.0.1:*,https://loc
- **MCP endpoint**: `http://127.0.0.1:3000/` (root path)
- `ALLOWED_ORIGINS` - Comma-separated allowlist of browser `Origin`/`Referer` patterns; wildcards supported (e.g. `https://*.ngrok.io`). Default: `http://localhost:*,http://127.0.0.1:*,https://localho
"http://127.0.0.1:*",
@nestjs/common, @nestjs/config, @nestjs/core, @nestjs/microservices, @nestjs/platform-express, @rekog/mcp-nest, async-mutex, commander
**Environment Configuration**: Config `process.env.*` reads go through `buildConfigInput()` in `src/config/config.factory.ts`. CLI args override env vars in memory (no `process.env` mutation). Service
Gates applied: no_behavioural_pass.
fd98695f3978full audit observations/trust-audit/mcp-server/ankimcp__anki-15.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-01 | fd98695f3978 | CAUTION | C | 79 | first audit |
Questions
What is the Anki MCP server?
A Model Context Protocol (MCP) server that enables AI assistants to interact with Anki, the spaced repetition flashcard application.
What tools does Anki expose?
51 in total: 31 read-only, 14 that write, and 6 that can delete or overwrite (clearUnusedTags, deleteMediaFile, deleteNotes, forgetCards, removeModelField). Every one is listed on this page with its risk.
Is Anki safe to connect to an agent?
With care. The audit graded it C (79/100) and found 25 things worth knowing before you trust this server, listed below with the exact line each was found on. Separately from the audit: 6 of its tools can destroy data, so scope the token you give it to what you actually need.
What credentials does Anki need?
It reads ANKI_CONNECT_API_KEY and TUNNEL_AUTH_CLIENT_ID from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How does Anki run?
It speaks stdio and streamable-http, so it runs as a local process your client starts. It is published on npm as @ankimcp/anki-mcp-server at 0.26.0.
How current is this page?
The grade is for one exact copy of the source (fd98695f3978), read on 2026-10-01. The repository is watched and re-audited when it changes.