virlow-mcp 3.13.0 → 3.14.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +23 -0
- package/dist/cli.js +1 -1
- package/package.json +4 -4
package/README.md
CHANGED
|
@@ -28,6 +28,29 @@ Your account credentials and master password are just as protected from the AI:
|
|
|
28
28
|
entered exclusively into a local browser form served by this process, never passed
|
|
29
29
|
through a tool call, and never seen by the AI model.
|
|
30
30
|
|
|
31
|
+
### This is the local server, and that distinction is the whole security model
|
|
32
|
+
|
|
33
|
+
Every claim above is about **this package**, running on **your machine**. Virlow also
|
|
34
|
+
offers a **hosted connector** — the same 19 tools, served from Virlow's own servers, so a
|
|
35
|
+
client can connect by URL with nothing installed. It is a genuinely different trust model,
|
|
36
|
+
and the sentence "the key never leaves it" is the part that stops being true:
|
|
37
|
+
|
|
38
|
+
| | this local server | the hosted connector |
|
|
39
|
+
| --- | --- | --- |
|
|
40
|
+
| where the key is derived | this process, on your machine | Virlow's API process |
|
|
41
|
+
| who can read a decrypted note | this process | this process, and Virlow's server |
|
|
42
|
+
| what an unlock sends | nothing; the password stays local | your master password, over HTTPS |
|
|
43
|
+
| what it takes to run | Node on your machine | nothing |
|
|
44
|
+
| session lifetime | 4 hours idle | 30 minutes idle |
|
|
45
|
+
|
|
46
|
+
The hosted connector is **off by default** on every account and has to be switched on in
|
|
47
|
+
Virlow's settings. If you are reading this page, you are looking at the option that keeps
|
|
48
|
+
the key on your own hardware — that is the reason to prefer it, and the reason this
|
|
49
|
+
package exists.
|
|
50
|
+
|
|
51
|
+
See `SECURITY.md` in the Virlow repository for what the hosted mode does and does not
|
|
52
|
+
guarantee.
|
|
53
|
+
|
|
31
54
|
## Install / configure
|
|
32
55
|
|
|
33
56
|
virlow-mcp needs no separate install — `npx -y virlow-mcp` fetches and runs it directly.
|
package/dist/cli.js
CHANGED
|
@@ -1873,7 +1873,7 @@ function startUnlockServer(api, vault, opts = {}) {
|
|
|
1873
1873
|
}
|
|
1874
1874
|
|
|
1875
1875
|
// src/version.ts
|
|
1876
|
-
var VERSION = true ? "3.
|
|
1876
|
+
var VERSION = true ? "3.14.0" : "dev";
|
|
1877
1877
|
|
|
1878
1878
|
// src/server.ts
|
|
1879
1879
|
function defaultEmbeddingCacheDir() {
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "virlow-mcp",
|
|
3
|
-
"version": "3.
|
|
3
|
+
"version": "3.14.0",
|
|
4
4
|
"description": "Local MCP server for Virlow Secure Notes: end-to-end-encrypted AI memories and notes for Cursor, Claude, Codex, and any MCP client.",
|
|
5
5
|
"license": "MIT",
|
|
6
6
|
"type": "module",
|
|
@@ -34,9 +34,9 @@
|
|
|
34
34
|
"esbuild": "^0.25.0",
|
|
35
35
|
"typescript": "^5.8.0",
|
|
36
36
|
"vitest": "^3.0.0",
|
|
37
|
-
"@batalabs/virlow-memory": "3.
|
|
38
|
-
"@batalabs/virlow-mcp-core": "3.
|
|
39
|
-
"@batalabs/virlow-crypto": "3.
|
|
37
|
+
"@batalabs/virlow-memory": "3.14.0",
|
|
38
|
+
"@batalabs/virlow-mcp-core": "3.14.0",
|
|
39
|
+
"@batalabs/virlow-crypto": "3.14.0"
|
|
40
40
|
},
|
|
41
41
|
"scripts": {
|
|
42
42
|
"build": "node build.mjs",
|