ReadwiseBLOCK
MCP server for Readwise
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
[](https://smithery.ai/server/@IAmAlexander/readwise-mcp) [](https://cursor.com/install-mcp?name=readwise-mcp&config=eyJ0eXBlIjoiaHR0cCIsInVybCI6Imh0dHBzOi8vc2VydmVyLnNtaXRoZXJ5LmFpL0BJQW1BbGV4YW5kZXIvcmVhZHdpc2UtbWNwL21jcCJ9) [](https://vscode.dev/redirect/mcp/install?name=readwise-mcp&config=%7B%22type%22%3A%22http%22%2C%22url%22%3A%22https%3A//server.smithery.ai/%40IAmAlexander/readwise-mcp/mcp%22%7D) [](https://smithery.ai/server/@IAmAlexander/readwise-mcp) [](https://www.npmjs.com/package/readwise-mcp)
A Model Context Protocol (MCP) server for Readwise, allowing AI assistants to access your saved articles, books, highlights, and documents.
Features
- Books & Articles: Browse your collection of saved books and articles
- Highlights: Access all your highlighted passages
- Search: Find content across your entire Readwise library
- Recent Content: Quickly retrieve your latest saved items
- Tag Management: Organize and filter content with tags
- Advanced Search: Powerful filtering by author, date, tags, and more
- Reading Progress: Track your reading status and completion percentage
- Bulk Operations: Efficiently manage multiple documents at once
- Content Management: Save, update, and delete content in your library
- Video Support: Access and interact with videos saved in your Readwise
ac22eb43f49dOBSERVED · 2026-10-09Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.
claude mcp add readwise-mcp -- npx -y [email protected]
Exposed tools (1)
1 read · 0 write · 0 destructive.
| Tool | Risk | Description |
|---|---|---|
echo | read | A simple tool that echoes back the input message |
Trust audit
BLOCKgrade D · trust 69/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | WARN |
| L1 | Static analysis of the code | FAIL |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (5 observation(s))
- Network
- declared (7 observation(s))
- Shell
- declared (5 observation(s))
- Dependencies
- not all pinned
- Secrets in source
- found
Findings (23)
atob( ... new Function(
agent-skills
console.log(`API key provided: ${apiKey ? 'Yes' : 'No (lazy loading enabled)'}`);this.logger.info(`✓ Health check: http://0.0.0.0:${this.port}/health`);"GITHUB_PERSONAL_ACCESS_TOKEN": "github_pat_11AAYB2NI0z5MO2milE9Xb_OY1tGivsazjwhOJUGKUuF7ZrrThc0iN3a
.eslintrc.cjs
.what-is-this.md
.what-is-this.md
4. **Code Execution** - eval() with user input, unsafe deserialization
import { ValidationResult, validationSuccess } from '../../types/validation.js';import { Logger } from '../../utils/logger.js';import { ValidationResult, validationSuccess } from '../../types/validation.js';import type { MCPToolResult } from '../../types/index.js';import type { Logger } from '../../utils/logger-interface.js';@modelcontextprotocol/sdk, axios, body-parser, cors, express, serverless-http, yargs, zod
+ // Send token to our callback endpoint
+ // Send token to our callback endpoint
ption":"Unauthorized - Invalid token"},"500":{"description":"Server error"}}}},"/bulk/save":{"post":{"operatption":"Unauthorized - Invalid token"},"500":{"description":"Server error"}}}},"/bulk/save":{"post":{"operat.smithery/shttp/module.js.map
.specstory/history/2025-03-20_00-23-codebase-review-for-mcp-server-compliance.md
==> Checking for `sudo` access (which may request your password)...
cd /Users/alex/Developer/readwise-mcp && cat .env
Gates applied: critical_finding, no_behavioural_pass.
ac22eb43f49dfull audit observations/trust-audit/mcp-server/iamalexander__readwise.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-09 | ac22eb43f49d | BLOCK | D | 69 | first audit |
Questions
What is the Readwise MCP server?
MCP server for Readwise
What tools does Readwise expose?
1 in total: 1 read-only, 0 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.
Is Readwise safe to connect to an agent?
No — not without reading the findings first. The audit graded it D (69/100) and found 1 critical or high issue in the source. Each one is listed on this page with the file and line it is on.
What credentials does Readwise need?
It reads READWISE_API_KEY and READWISE_API_TOKEN from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How does Readwise run?
It speaks sse, stdio and streamable-http, so it runs as a local process your client starts. It is published on npm as readwise-mcp at 1.0.1.
How current is this page?
The grade is for one exact copy of the source (ac22eb43f49d), read on 2026-10-09. The repository is watched and re-audited when it changes.