Atlas / MCP servers / zainzaidi37 / kinjot-mcp

kinjot-mcpBLOCK

Name: kinjot-mcp
Author: zainzaidi37

mcp/zainzaidi37/kinjot-mcp

MCP server by zainzaidi37 · agent · mcp server · note taking · Audited 2026-10-11

⚑ Report / re-scan Source ↗

jotnow - Save useful agent outputs

Verdict

BLOCK

Grade

Trust score

69 /100

Exposed tools

11 9r · 2w · 0d

Transport

stdio

License

MIT

Stars

Overview

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

Keep what your AI coding agent figures out. Tell Claude Code or Codex to "jot that down", and the note lands in your Kinjot account, tagged and searchable.

Works with Claude Code, Codex and any other MCP client, plus a terminal CLI.
Free to sign up and use. Export every note as Markdown whenever you like.
Saves notes only when you ask. Agents can send brief Inbox notifications under the narrow rules below.

Documentation · Claude Code setup · Codex setup · MCP tool reference

Quick start

Sign up at kinjot.com (free) and confirm your email.
Open Settings > API keys and create a key.
Install the CLI and save your key:

npm install --global kinjot
kinjot key

kinjot key asks for the key, checks it, and saves it to ~/.kinjot/config.json. Only your user can read that file. It then prints the setup for your MCP client.

Connect your agent:

# Claude Code (add -s user to use it in every project)
claude mcp add kinjot -- npx -y kinjot

# Codex
codex mcp add kinjot -- npx -y kinjot

Tell your agent to "jot that down". Later, ask it to find your jots about

something, or to show your recent jots.

What your agent can do

Read from source at commit 39cd4ddd80c7OBSERVED · 2026-10-11

Connect

Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.

claude-code (npm)

claude mcp add kinjot --env KINJOT_API_KEY=${KINJOT_API_KEY} -- npx -y [email protected]

Exposed tools (11)

9 read · 2 write · 0 destructive.

Tool	Risk	Description
`append_to_jot`	read
`edit_jot`	write
`example`	read	A tool
`find_jots`	read
`get_jot`	read
`inbox`	read
`jot`	read
`list_recent_jots`	read
`notify`	read
`recall_jots`	read
`upload_image`	write

Trust audit

BLOCKgrade D · trust 69/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.

Layer	What it checks	Result
L0	Provenance & inventory	PASS
L1	Static analysis of the code	FAIL
L2	Instruction surface (what it tells the agent)	PASS
L3	Class-specific surface	PASS
L4	Behavioural (sandbox)	SKIPPED

What the source does

Filesystem: none-observed
Network: none-observed
Shell: declared (1 observation(s))
Dependencies: not all pinned
Secrets in source: none-found

Findings (13)

HIGHCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95

src/local/runtime.ts:80

exec(sql: string): void;

Why it matters. evaluates text as code

Fix. remove; use a parser or a dispatch table

LOWFilesystem / path · fs.traversal · CWE-22, CWE-59

src/package-boundary.test.ts:76

[`import { png } from '../../core/src/image-bytes-fixtures.js';`],

LOWFilesystem / path · fs.traversal · CWE-22, CWE-59

src/package-boundary.test.ts:77

[`export * from '../../core/src/index.js';`],

LOWFilesystem / path · fs.traversal · CWE-22, CWE-59

src/package-boundary.test.ts:78

[`const m = await import('../../../scripts/x.mjs');`],

LOWFilesystem / path · fs.traversal · CWE-22, CWE-59

src/package-boundary.test.ts:79

[`vi.mock('../../core/src/index.js', () => ({}));`],

LOWFilesystem / path · fs.traversal · CWE-22, CWE-59

src/package-boundary.test.ts:80

[`readFileSync(new URL('../../../docs/x.md', import.meta.url));`],