virlow-mcp 3.18.0 → 3.68.0

package/LICENSE

@@ -1,21 +1,11 @@
-MIT License
+Copyright (c) 2026 Bata Labs LLC. All rights reserved.
 
-Copyright (c) 2025 Typelets Secure Notes
+This software and its source code are proprietary and confidential.
 
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
+No license, express or implied, is granted to any person to use, copy,
+modify, merge, publish, distribute, sublicense, or sell copies of this
+software, in whole or in part, except under a separate written agreement
+with Bata Labs LLC.
 
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.
+Unauthorized copying, distribution, or disclosure of this software is
+prohibited.

package/README.md

@@ -8,7 +8,7 @@ entire time.
 ## What it is
 
 virlow-mcp runs on your machine as a local process (`npx -y virlow-mcp`, launched by your
-AI client over stdio). It exposes 19 tools for two things:
+AI client over stdio). It exposes 24 tools for three things:
 
 - **Memories** — short, durable facts ("the user prefers TypeScript", "this repo's CI
   runs on self-hosted runners") that any AI tool can add, search semantically, and recall
@@ -16,7 +16,20 @@ AI client over stdio). It exposes 19 tools for two things:
   **Memories** folder, so you can read, edit, reorganise, and trash them in the Virlow
   app like anything else you have written.
 - **Notes** — full read/write access to your existing Virlow notes: search, list, read,
-  create, update, move, star, archive, and trash, plus folder management.
+  create, update, move, star, archive, and trash, plus folder management and
+  `get_backlinks` (notes that link to a note, from encrypted link records). `update_note`
+  also accepts `props` (property id to typed value) and `aliases` (alternative titles a
+  note answers to when linked).
+- **Properties**: typed fields on a folder's notes, the way a database column works:
+  `list_properties` reads a folder's definitions, `define_property` adds one (text, number,
+  select, multiSelect, date, checkbox, url, or relation), and `set_properties` sets values on
+  a note by property name, taking option names rather than ids. `list_folder_view` reads the
+  whole folder the way the app's table shows it, one row per note and one column per
+  property, with an optional `sortBy`; it answers "which of these is in review" or "what has
+  no owner" without reading a single note body. Definitions live in the folder's encrypted
+  schema and values in the note's encrypted attrs, so the server sees neither. Properties
+  ship in the Virlow app as of its epic 3, so what is written here is what the user sees in
+  the note, the table, the board and the calendar.
 
 Everything is **end-to-end encrypted, zero-knowledge**: the encryption key is derived
 from your Virlow master password inside this local process and never leaves it. Every
@@ -31,17 +44,17 @@ through a tool call, and never seen by the AI model.
 ### This is the local server, and that distinction is the whole security model
 
 Every claim above is about **this package**, running on **your machine**. Virlow also
-offers a **hosted connector** — the same 19 tools, served from Virlow's own servers, so a
+offers a **hosted connector**: the same 24 tools, served from Virlow's own servers, so a
 client can connect by URL with nothing installed. It is a genuinely different trust model,
 and the sentence "the key never leaves it" is the part that stops being true:
 
-| | this local server | the hosted connector |
-| --- | --- | --- |
-| where the key is derived | this process, on your machine | Virlow's API process |
-| who can read a decrypted note | this process | this process, and Virlow's server |
-| what an unlock sends | nothing; the password stays local | your master password, over HTTPS |
-| what it takes to run | Node on your machine | nothing |
-| session lifetime | 4 hours idle | 30 minutes idle |
+| | this local server | the desktop app | the hosted connector |
+| --- | --- | --- | --- |
+| where the key is derived | this process, on your machine | the Virlow app, on your machine | Virlow's API process |
+| who can read a decrypted note | this process | the app's process | this process, and Virlow's server |
+| what an unlock sends | nothing; the password stays local | nothing; the password stays local | your master password, over HTTPS |
+| what it takes to run | Node on your machine | the installed app | nothing |
+| session lifetime | 4 hours idle | follows the app's vault lock | 30 minutes idle |
 
 The hosted connector is **off by default** on every account and has to be switched on in
 Virlow's settings. If you are reading this page, you are looking at the option that keeps
@@ -122,6 +135,27 @@ Claude Desktop / Cursor:
 }
 ```
 
+### Connecting through the Virlow desktop app
+
+If you run the [Virlow desktop app](../desktop/README.md), it already hosts this server
+on your machine and unlocks with the app. Clients that can send a header connect to it
+directly; the app shows the exact snippet under Settings, This computer. Clients that can
+only spawn a command use this package as a pipe:
+
+```json
+{
+  "mcpServers": {
+    "virlow": {
+      "command": "npx",
+      "args": ["-y", "virlow-mcp", "--connect", "http://127.0.0.1:47821/mcp",
+               "--token-file", "<path the app shows you>"]
+    }
+  }
+}
+```
+
+In this mode nothing is decrypted in this process. It forwards to the app and back.
+
 ## First use
 
 1. Ask your AI client to run the **`unlock`** tool. This opens a browser window pointed
@@ -172,7 +206,7 @@ just give you two versions to keep in sync.
 ## Reaching your vault from a session that is not on this machine
 
 By default `virlow-mcp` speaks stdio, so your AI client spawns it as a child
-process and everything stays on one machine. `--http` serves the same 19 tools
+process and everything stays on one machine. `--http` serves the same 24 tools
 over HTTP instead, so a client that cannot spawn a local process — a cloud
 coding session, another laptop — can reach this vault:
 
@@ -266,7 +300,7 @@ npx -y virlow-mcp --no-memories
 
 Use it when you want a connector that structurally cannot touch memories,
 regardless of the account setting. Notes tools, `unlock`, `lock`, and `status`
-are unaffected either way (14 tools instead of 19).
+are unaffected either way (18 tools instead of 23).
 
 ## Suggested agent rules