Atlas / MCP servers / dawncr0w / Affine

AffineCAUTION

Name: Affine
Author: dawncr0w

mcp/dawncr0w/affine

MCP server by dawncr0w · affine · ai assistants · claude · Audited 2026-10-06

Model Context Protocol server for AFFiNE. Connect AI assistants to AFFiNE workspaces, documents, databases, and collaboration APIs over stdio or HTTP.

Verdict

CAUTION

Grade

Trust score

81 /100

Exposed tools

107 45r · 46w · 16d

Transport

sse · stdio · streamable-http

License

MIT

Stars

297

Overview

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

A Model Context Protocol (MCP) server for AFFiNE. It exposes AFFiNE workspaces and documents to AI assistants over stdio (default) or HTTP (/mcp) and supports both AFFiNE Cloud and self-hosted deployments.

[](https://github.com/dawncr0w/affine-mcp-server/releases) [](https://github.com/modelcontextprotocol/typescript-sdk) [](https://github.com/dawncr0w/affine-mcp-server/actions/workflows/ci.yml) [](LICENSE)

Overview
Choose Your Path
Quick Start
Compatibility Matrix
Tool Surface
Documentation Map
Verify Your Setup
Security and Scope
Development
Release Notes
License
Support

Overview

AFFiNE MCP Server is designed for three common scenarios:

Run a local stdio MCP server for Claude Code, Codex CLI, Cursor, or Claude Desktop
Expose a remote HTTP MCP endpoint for hosted or browser-connected clients
Automate AFFiNE workspace, document, database, organization, and comment workflows through a stable MCP tool surface

Highlights:

Supports AFFiNE Cloud and self-hosted AFFiNE instances
Supports stdio and HTTP transports
Coordinates concurrent writes per workspace through one shared MCP server; optional document revisions reject stale edits
Supports session-cookie and email/password authentication, plus compa

Read from source at commit 2d13eb0ca77aOBSERVED · 2026-10-06

Connect

Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.

claude-code

claude mcp add affine-mcp-server --env AFFINE_ADMIN_PASSWORD=${AFFINE_ADMIN_PASSWORD} --env AFFINE_MCP_HTTP_ALLOW_QUERY_TOKEN=${AFFINE_MCP_HTTP_ALLOW_QUERY_TOKEN} --env AFFINE_MCP_HTTP_ALLOW_UNAUTHENTICATED=${AFFINE_MCP_HTTP_ALLOW_UNAUTHENTICATED} --env AFFINE_MCP_HTTP_TOKEN=${AFFINE_MCP_HTTP_TOKEN} -- npx -y [email protected]

claude-desktop

{
  "mcpServers": {
    "affine-mcp-server": {
      "command": "npx",
      "args": [
        "-y",
        "[email protected]"
      ],
      "env": {
        "AFFINE_ADMIN_PASSWORD": "${AFFINE_ADMIN_PASSWORD}",
        "AFFINE_MCP_HTTP_ALLOW_QUERY_TOKEN": "${AFFINE_MCP_HTTP_ALLOW_QUERY_TOKEN}",
        "AFFINE_MCP_HTTP_ALLOW_UNAUTHENTICATED": "${AFFINE_MCP_HTTP_ALLOW_UNAUTHENTICATED}",
        "AFFINE_MCP_HTTP_TOKEN": "${AFFINE_MCP_HTTP_TOKEN}"
      }
    }
  }
}

Exposed tools (107)

45 read · 46 write · 16 destructive. Blast radius: 16 tools can delete or overwrite — an agent that can be talked into calling a tool can be talked into calling this one.

Tool	Risk	Description
`add_database_column`	write
`add_database_row`	write
`add_doc_to_collection`	write
`add_mindmap_node`	write
`add_organize_link`	write
`add_surface_element`	write
`add_tag_to_doc`	write
`analyze_doc_fidelity`	read
`append_block`	read
`append_markdown`	read
`append_semantic_section`	read
`cleanup_blobs`	read
`clear_doc_property`	destructive
`compose_database_from_intent`	read
`create_collection`	write
`create_comment`	write
`create_custom_property`	write
`create_doc`	write
`create_doc_from_markdown`	write
`create_folder`	write
`create_mindmap`	write
`create_semantic_page`	write
`create_tag`	write
`create_workspace`	write
`create_workspace_blueprint`	write
`current_user`	read
`delete_blob`	destructive
`delete_block`	destructive
`delete_collection`	destructive
`delete_comment`	destructive
`delete_custom_property`	destructive
`delete_database_row`	destructive
`delete_doc`	destructive
`delete_folder`	destructive
`delete_organize_link`	destructive
`delete_surface_element`	destructive
`delete_tag`	destructive
`delete_workspace`	destructive
`export_doc_markdown`	read
`export_with_fidelity_report`	read
`find_doc_by_title`	read
`get_capabilities`	read
`get_collection`	read
`get_doc`	read
`get_doc_icon`	read
`get_edgeless_canvas`	read
`get_folder_icon`	read
`get_mindmap`	read
`get_orphan_docs`	read
`get_workspace`	read
`inspect_template_structure`	read
`instantiate_template_native`	read
`list_children`	read
`list_collections`	read
`list_comments`	read
`list_doc_properties`	read
`list_docs`	read
`list_docs_by_tag`	read
`list_histories`	read
`list_notifications`	read
`list_organize_nodes`	read
`list_surface_elements`	read
`list_tags`	read
`list_workspace_tree`	read
`list_workspaces`	read
`move_block`	write
`move_doc`	write
`move_organize_node`	write
`publish_doc`	write
`read_all_notifications`	read
`read_database_cells`	read
`read_database_columns`	read
`read_doc`	read
`remove_doc_from_collection`	destructive
`remove_tag_from_doc`	destructive
`rename_folder`	write
`reparent_mindmap_node`	read
`replace_doc_with_markdown`	read
`resolve_comment`	read
`restore_doc`	read
`revoke_doc`	destructive
`search_docs`	read
`set_doc_journal`	write
`set_doc_property`	write
`set_mindmap_layout`	write
`set_mindmap_lock`	write
`set_mindmap_style`	write
`sign_in`	read
`trash_doc`	read
`update_block`	write
`update_collection`	write
`update_collection_rules`	write
`update_comment`	write
`update_database_row`	write
`update_doc_icon`	write
`update_doc_title`	write
`update_edgeless_block`	write
`update_folder_icon`	write
`update_frame_children`	write
`update_mindmap_node`	write
`update_profile`	write
`update_settings`	write
`update_surface_element`	write
`update_table_cell`	write
`update_table_column_widths`	write
`update_workspace`	write
`upload_blob`	write

Trust audit

CAUTIONgrade B · trust 81/100 Install with care. The audit found things worth knowing before you trust its output.

Layer	What it checks	Result
L0	Provenance & inventory	PASS
L1	Static analysis of the code	WARN
L2	Instruction surface (what it tells the agent)	PASS
L3	Class-specific surface	WARN
L4	Behavioural (sandbox)	SKIPPED

What the source does

Filesystem: declared (1 observation(s))
Network: declared (8 observation(s))
Shell: declared (2 observation(s))
Dependencies: not all pinned
Secrets in source: none-found

Findings (22)

MEDIUMInformation disclosure · disclose.log_secret · CWE-209, CWE-532

src/cli.ts:1369

if (summary.apiToken) console.log(`API token: ${summary.apiToken} (${summary.sources.apiToken})`);

MEDIUMInformation disclosure · disclose.log_secret · CWE-209, CWE-532

src/cli.ts:1383

console.log(`HTTP auth token: ${summary.http.authToken || "(unset)"} (${summary.sources.httpAuthToken})`);

MEDIUMNetwork egress · net.raw_ip · CWE-200, CWE-319

Dockerfile:44

CMD wget -qO- http://127.0.0.1:${PORT}/healthz || exit 1

MEDIUMNetwork egress · net.raw_ip · CWE-200, CWE-319

src/stdioHttpProxy.ts:6

const DEFAULT_ENDPOINT = `http://127.0.0.1:${process.env.PORT || "3000"}/mcp`;

MEDIUMFilesystem / path · mcp.destructive_tools · CWE-22, CWE-59

clear_doc_property, delete_blob, delete_block, delete_collection, delete_comment, delete_custom_property, delete_database_row, delete_doc, delete_folder, delete_organize_link, delete_surface_element,

Why it matters. 16 tool(s) can delete or overwrite

Fix. prefer a read-only mode or scoped tokens; the page states the blast radius

LOWInventory / provenance · inv.hidden_file · CWE-1104

.coderabbit.yaml

.coderabbit.yaml

Why it matters. hidden member outside the usual dotfiles

Fix. review its purpose

LOWInformation disclosure · disclose.log_secret · CWE-209, CWE-532

tests/test-database-creation.mjs:133

console.log(`Auth mode: email/password (sync login at startup)`);

LOWFilesystem / path · fs.traversal · CWE-22, CWE-59

tests/playwright/verify-properties-comments.pw.ts:10

import { connectWorkspaceSocket, joinWorkspace, loadDoc, wsUrlFromGraphQLEndpoint } from '../../dist/ws.js';

LOWFilesystem / path · fs.traversal · CWE-22, CWE-59

tests/test-live-test-safety.mjs:97

() => resolveTestRunId({ AFFINE_TEST_RUN_ID: '../../unsafe' }),

LOWNetwork egress · net.raw_ip · CWE-200, CWE-319

docs/client-setup.md:230

"AFFINE_MCP_HTTP_PROXY_URL": "http://127.0.0.1:3000/mcp"

LOWNetwork egress · net.raw_ip · CWE-200, CWE-319

docs/configuration-and-deployment.md:157

| `AFFINE_MCP_HTTP_PROXY_URL` | No | `http://127.0.0.1:${PORT:-3000}/mcp` | Loopback Streamable HTTP endpoint used by `affine-mcp-http-proxy` |

LOWNetwork egress · net.raw_ip · CWE-200, CWE-319

docs/configuration-and-deployment.md:343

`http://127.0.0.1:${PORT:-3000}/mcp` and accepts loopback URLs only.

LOWObfuscation / stealth · obf.homoglyph · CWE-506, CWE-94

tests/test-native-mindmap.mjs:43

f.mutate('update', { mindmapId: f.map.mindmapId, nodeId: c, text: 'Renamed\nЗадача', collapsed: true });

LOWObfuscation / stealth · obf.homoglyph · CWE-506, CWE-94

tests/test-native-mindmap.mjs:50

assert.equal(result.nodes.find(n => n.nodeId === c).text, 'Renamed\nЗадача');

LOWSupply chain · supply.unpinned · CWE-829, CWE-1357

package.json

@modelcontextprotocol/sdk, cors, express, form-data, jose, fractional-indexing, markdown-it, node-fetch

Why it matters. 19 dependency range(s) float

Fix. pin exact versions or ship a lockfile

LOWPrompt injection · prompt.credential_read · CWE-94, CWE-1427

README.md:54

> New in v3.2.1: Scripted cookie login now keeps session secrets out of process arguments, validates workspace access before saving credentials, and restores document pagination for ordinary workspace

Why it matters. asks the agent to read credentials

LOWPrompt injection · prompt.credential_read · CWE-94, CWE-1427

docs/configuration-and-deployment.md:15

config file. Some consumers intentionally read environment variables directly

Why it matters. asks the agent to read credentials

LOWPrompt injection · prompt.transfer_instruction · CWE-94, CWE-1427

CHANGELOG.md:95

- Added `login --save-credentials`, which stores the email/password used to sign in instead of the session cookie, so the server can sign in on its own and renew the session before it expires.