virlow-mcp 3.13.0 → 3.14.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (3) hide show
  1. package/README.md +23 -0
  2. package/dist/cli.js +1 -1
  3. package/package.json +4 -4
package/README.md CHANGED
@@ -28,6 +28,29 @@ Your account credentials and master password are just as protected from the AI:
28
28
  entered exclusively into a local browser form served by this process, never passed
29
29
  through a tool call, and never seen by the AI model.
30
30
 
31
+ ### This is the local server, and that distinction is the whole security model
32
+
33
+ Every claim above is about **this package**, running on **your machine**. Virlow also
34
+ offers a **hosted connector** — the same 19 tools, served from Virlow's own servers, so a
35
+ client can connect by URL with nothing installed. It is a genuinely different trust model,
36
+ and the sentence "the key never leaves it" is the part that stops being true:
37
+
38
+ | | this local server | the hosted connector |
39
+ | --- | --- | --- |
40
+ | where the key is derived | this process, on your machine | Virlow's API process |
41
+ | who can read a decrypted note | this process | this process, and Virlow's server |
42
+ | what an unlock sends | nothing; the password stays local | your master password, over HTTPS |
43
+ | what it takes to run | Node on your machine | nothing |
44
+ | session lifetime | 4 hours idle | 30 minutes idle |
45
+
46
+ The hosted connector is **off by default** on every account and has to be switched on in
47
+ Virlow's settings. If you are reading this page, you are looking at the option that keeps
48
+ the key on your own hardware — that is the reason to prefer it, and the reason this
49
+ package exists.
50
+
51
+ See `SECURITY.md` in the Virlow repository for what the hosted mode does and does not
52
+ guarantee.
53
+
31
54
  ## Install / configure
32
55
 
33
56
  virlow-mcp needs no separate install — `npx -y virlow-mcp` fetches and runs it directly.
package/dist/cli.js CHANGED
@@ -1873,7 +1873,7 @@ function startUnlockServer(api, vault, opts = {}) {
1873
1873
  }
1874
1874
 
1875
1875
  // src/version.ts
1876
- var VERSION = true ? "3.13.0" : "dev";
1876
+ var VERSION = true ? "3.14.0" : "dev";
1877
1877
 
1878
1878
  // src/server.ts
1879
1879
  function defaultEmbeddingCacheDir() {
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "virlow-mcp",
3
- "version": "3.13.0",
3
+ "version": "3.14.0",
4
4
  "description": "Local MCP server for Virlow Secure Notes: end-to-end-encrypted AI memories and notes for Cursor, Claude, Codex, and any MCP client.",
5
5
  "license": "MIT",
6
6
  "type": "module",
@@ -34,9 +34,9 @@
34
34
  "esbuild": "^0.25.0",
35
35
  "typescript": "^5.8.0",
36
36
  "vitest": "^3.0.0",
37
- "@batalabs/virlow-memory": "3.13.0",
38
- "@batalabs/virlow-mcp-core": "3.13.0",
39
- "@batalabs/virlow-crypto": "3.13.0"
37
+ "@batalabs/virlow-memory": "3.14.0",
38
+ "@batalabs/virlow-mcp-core": "3.14.0",
39
+ "@batalabs/virlow-crypto": "3.14.0"
40
40
  },
41
41
  "scripts": {
42
42
  "build": "node build.mjs",