Atlas / MCP servers / tan-yong-sheng / TriliumNext

TriliumNextCAUTION

Name: TriliumNext
Author: tan-yong-sheng

mcp/tan-yong-sheng/triliumnext

MCP server by tan-yong-sheng · Audited 2026-10-07

⚑ Report / re-scan Source ↗

MCP server for TriliumNext Notes

Verdict

CAUTION

Grade

Trust score

86 /100

Exposed tools

9 4r · 3w · 2d

Transport

stdio · streamable-http

License

—

Stars

Overview

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

⚠️ DISCLAIMER: This is a prototype for https://github.com/TriliumNext/Notes/issues/705. Suggested only for developer use. Please backup your Trilium notes before using this tool. ⚠️

A model context protocol server for TriliumNext Notes. This server provides tools to interact with your Trilium Notes instance through MCP. You can use this MCP with triliumnext-skills.

Also, if you would like to back up your trilium instances to multiple cloud storage providers such as cloudflare R2, AWS S3 and google drive simultaneously, please visit: https://github.com/tan-yong-sheng/trilium-backup

Alternatives to suggest:

Quick Start

Make sure to set up your environment variables first:

TRILIUM_API_URL (default: http://localhost:8080/etapi)
TRILIUM_API_TOKEN (required, get this from your Trilium Notes settings)
PERMISSIONS (optional, default='READ;WRITE', where READ grants access to search_notes, get_note, resolve_note_id, and read_attributes, and WRITE grants access to create_note, update_note, delete_note, and manage_attributes)
VERBOSE (optional, default='false', which if true will print verbose debugging logs)

Installation

Below are the installation guide for this MCP on different MCP clients, such as Claude Desktop, Claude Code, Cursor, Cline, etc.

Claude Desktop

Add to your Claude Desktop configuration:

{
"mcpServers": {
"triliumnext-mcp": {
"command": "npx",
"args": ["triliumnext-mcp"],
"env": {
"TRILIUM_API_URL": "http://localhost:8080/etapi",
"TRILIUM_API_TOKEN": "",
"PERMISSIONS": "READ;WRITE"
}
}
}
}

Claude Code

Read from source at commit 44fc9c421191OBSERVED · 2026-10-07

Connect

Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.

claude-code

claude mcp add triliumnext-mcp --env TRILIUM_API_TOKEN=${TRILIUM_API_TOKEN} -- npx -y [email protected]

claude-desktop

{
  "mcpServers": {
    "triliumnext-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "[email protected]"
      ],
      "env": {
        "TRILIUM_API_TOKEN": "${TRILIUM_API_TOKEN}"
      }
    }
  }
}

Exposed tools (9)

4 read · 3 write · 2 destructive. Blast radius: 2 tools can delete or overwrite — an agent that can be talked into calling a tool can be talked into calling this one.

Tool	Risk	Description
`create_note`	write	Create a new note in TriliumNext with duplicate title detection. When a note with the same title already exists in the same directory, you
`delete_note`	destructive	Delete a note permanently. ONLY use this tool when the user explicitly requests note deletion (e.g.,
`get_note`	read	Get a note and its content by ID. Perfect for when someone wants to see what
`list_children_notes`	read	List all direct child notes of a given note using a deterministic Trilium search query. Returns child note summaries including noteId, title, type, mime, and dateModified, sorted by dateCreated desc then title.
`move_note`	write	Move a note to a new parent location in the note tree. IMPORTANT: In TriliumNext a note can exist in multiple locations (branches). If the note has only one parent it moves directly. If it has multiple parents you must specify
`patch_note`	write	Apply targeted patches to a note using one unified batch schema. WORKFLOW: 1) Call get_note to obtain current content and contentHash (blobId), 2) Design patches, 3) Call patch_note with expectedHash. Use mode=
`read_attributes`	read	Read all attributes (labels and relations) for a note. View existing labels (#tags), template relations (~template), and note metadata. This tool provides read-only access to inspect current attributes assigned to any note. Returns structured data with labels, relations, and summary information.
`resolve_note_id`	read	Resolves a note/folder name to its actual note ID for use with other tools. You MUST call this function when users provide note names instead of note IDs (e.g.,
`update_note`	destructive	Update note with support for title-only updates, content overwrite, content append, or file replacement. ⚠️ REQUIRED: ALWAYS call get_note first to obtain current hash. ⚠️ SIMPLER RULES: Note type and MIME type are IMMUTABLE - cannot be changed after creation. MODE SELECTION: Use

Trust audit

CAUTIONgrade B · trust 86/100 Install with care. The audit found things worth knowing before you trust its output.

Layer	What it checks	Result
L0	Provenance & inventory	WARN
L1	Static analysis of the code	PASS
L2	Instruction surface (what it tells the agent)	PASS
L3	Class-specific surface	WARN
L4	Behavioural (sandbox)	SKIPPED

What the source does

Filesystem: declared (1 observation(s))
Network: declared (5 observation(s))
Shell: none-observed
Dependencies: not all pinned
Secrets in source: none-found

Findings (14)

MEDIUMInventory / provenance · inv.symlink · CWE-1104

.agents

.agents

Why it matters. link not followed

MEDIUMInventory / provenance · inv.symlink · CWE-1104

.codex

.codex

Why it matters. link not followed

MEDIUMFilesystem / path · mcp.destructive_tools · CWE-22, CWE-59

delete_note, update_note

Why it matters. 2 tool(s) can delete or overwrite

Fix. prefer a read-only mode or scoped tokens; the page states the blast radius

LOWInventory / provenance · inv.symlink · CWE-1104

CLAUDE.md

CLAUDE.md

Why it matters. link not followed