ModelsAtlas
Explore
Atlas / MCP servers / opennote-org / opennote

opennoteBLOCK

mcp/opennote-org/opennote
MCP server by opennote-org · ai · anki · evernote · Audited 2026-10-10
⚑ Report / re-scanSource ↗

An AI native notebook app built with pure Rust and GPUI

Verdict
BLOCK
Grade
D
Trust score
69 /100
Exposed tools
1 0r · 1w · 0d
Transport
streamable-http
License
MIT
Stars
21
01

Overview

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

A minimalistic notebook app built purely in Rust.

Status: Heavy Development — APIs, architecture, and workflows are evolving quickly. Contributions, feedback, and experimental use are all welcome.

Features

  • Keyword and semantic search — find notes instantly, or let your documents answer your questions.
  • Fully local — everything runs on your machine. Your data stays private.
  • Self-host server — you can opt to run a self-hosted server to sync data across all of your devices with encrypted communications.
  • WYSIWYG Markdown Editor — editor and render your markdown in real-time.
  • Blazing fast — built for performance from the ground up.

Roadmap

  • [x] Self-hosted server for syncing documents across devices with encrypted communications
  • [x] WYSIWYG markdown editor integration
  • [ ] Advanced NLP features to simplify document management (e.g., automatic categorization by semantic similarity)
  • [x] Support both semantic and keyword search
  • [x] MCP server support
  • [x] Import files
  • [ ] Multi-modal support

Getting Started

  1. Visit the Releases page.
  2. Download the archive for your operating system.
  3. Unzip the archive.
  4. Double-click to launch the app.
  5. Enjoy!

For mac users: I don't have an Apple Developer Account yet, so I can't codesign the mac app. You may need to run the following command in Terminal, after pasting the app file to the Applications folder:

For first-time installation: The app will try downloading models--sentence-transformers--all-MiniLM-L6-v2 from https://huggingface.co by default. However, in case if the official site fails, it will switch to use a mirror site, which is https://hf-mirror.com.

sudo xattr -r -d com.apple.quarantine /Applications/opennote.app

Configure the Desktop App

You can configure OpenNote w

Read from source at commit d5bca35da44eOBSERVED · 2026-10-10
02

Connect

Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control.

claude-code
claude mcp add test_with_ts -- npx -y [email protected]
claude-desktop
{
  "mcpServers": {
    "test_with_ts": {
      "command": "npx",
      "args": [
        "-y",
        "[email protected]"
      ]
    }
  }
}
03

Exposed tools (1)

0 read · 1 write · 0 destructive.

ToolRiskDescription
addwrite
04

Trust audit

BLOCKgrade D · trust 69/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.

LayerWhat it checksResult
L0Provenance & inventoryFAIL
L1Static analysis of the codePASS
L2Instruction surface (what it tells the agent)PASS
L3Class-specific surfaceWARN
L4Behavioural (sandbox)SKIPPED

What the source does

Filesystem
declared (8 observation(s))
Network
none-observed
Shell
none-observed
Dependencies
not all pinned
Secrets in source
none-found

Findings (15)

HIGHInventory / provenance · inv.suspicious_name · CWE-1104
crates/opennote-core-logics/src/payload.rs
payload.rs
Why it matters. member named after an attack tool
Fix. remove or justify
HIGHInventory / provenance · inv.suspicious_name · CWE-1104
crates/opennote-models/src/payload.rs
payload.rs
Why it matters. member named after an attack tool
Fix. remove or justify
MEDIUMInventory / provenance · inv.binary · CWE-1104
assets/sqlite_extensions/sqlite_vector_linux.so
sqlite_vector_linux.so
Why it matters. a compiled or binary member cannot be reviewed from source
Fix. ship source, or explain the binary in the README
MEDIUMInventory / provenance · inv.binary · CWE-1104
assets/sqlite_extensions/sqlite_vector_macos_arm64.dylib
sqlite_vector_macos_arm64.dylib
Why it matters. a compiled or binary member cannot be reviewed from source
Fix. ship source, or explain the binary in the README
MEDIUMInventory / provenance · inv.binary · CWE-1104
assets/sqlite_extensions/sqlite_vector_macos_x86.dylib
sqlite_vector_macos_x86.dylib
Why it matters. a compiled or binary member cannot be reviewed from source
Fix. ship source, or explain the binary in the README
MEDIUMInventory / provenance · inv.binary · CWE-1104
assets/sqlite_extensions/sqlite_vector_windows.dll
sqlite_vector_windows.dll
Why it matters. a compiled or binary member cannot be reviewed from source
Fix. ship source, or explain the binary in the README
MEDIUMAuth / authz · mcp.remote_no_auth · CWE-287, CWE-862
streamable-http
Why it matters. a network transport with no auth environment variable found
Fix. require a token
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
crates/opennote-data/src/vector_database/sqlite.rs:24
include_bytes!("../../../../assets/sqlite_extensions/sqlite_vector_macos_arm64.dylib");
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
crates/opennote-data/src/vector_database/sqlite.rs:26
include_bytes!("../../../../assets/sqlite_extensions/sqlite_vector_macos_x86.dylib");
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
crates/opennote-data/src/vector_database/sqlite.rs:28
include_bytes!("../../../../assets/sqlite_extensions/sqlite_vector_linux.so");
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
crates/opennote-data/src/vector_database/sqlite.rs:30
include_bytes!("../../../../assets/sqlite_extensions/sqlite_vector_windows.dll");
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
crates/opennote-desktop/src/widgets/sidebar/tree.rs:434
true => include_bytes!("../../../../../assets/icons/file-open.svg").as_slice(),
LOWNetwork egress · net.raw_ip · CWE-200, CWE-319
crates/opennote-mcp-server/rmcp-actix-web/tests/test_authorization_forwarding.rs:424
let url = format!("http://127.0.0.1:{}", port);
LOWNetwork egress · net.raw_ip · CWE-200, CWE-319
crates/opennote-mcp-server/rmcp-actix-web/tests/test_with_js/streamable_client.js:4
const transport = new StreamableHTTPClientTransport(new URL(`http://127.0.0.1:8004/mcp/`));
LOWSupply chain · supply.unpinned · CWE-829, CWE-1357
crates/opennote-mcp-server/rmcp-actix-web/tests/test_with_js/package.json
@modelcontextprotocol/sdk
Why it matters. 1 dependency range(s) float
Fix. pin exact versions or ship a lockfile

Gates applied: no_behavioural_pass.

Audited 2026-10-10 · audit v0.4.1 · source sha d5bca35da44efull audit observations/trust-audit/mcp-server/opennote-org__opennote.json · Report an issue / request a re-scan
05

Audit history

Every audit this server has had. A grade with a past is a grade somebody is still checking.

DateSourceVerdictGradeScoreChange
2026-10-10d5bca35da44eBLOCKD69first audit
06

Questions

What is the opennote MCP server?

An AI native notebook app built with pure Rust and GPUI

What tools does opennote expose?

1 in total: 0 read-only, 1 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.

Is opennote safe to connect to an agent?

No — not without reading the findings first. The audit graded it D (69/100) and found 2 critical or high issues in the source. Each one is listed on this page with the file and line it is on.

What credentials does opennote need?

No credential environment variables were found in its source, so it appears to need none.

How does opennote run?

It speaks streamable-http, so it runs as a service you connect to over the network. It is published on npm as test_with_ts at 1.0.0.

How current is this page?

The grade is for one exact copy of the source (d5bca35da44e), read on 2026-10-10. The repository is watched and re-audited when it changes.

Advertisement