virlow-mcp 3.81.0 → 3.81.1

package/README.md

@@ -7,8 +7,8 @@ entire time.
 
 ## What it is
 
-virlow-mcp runs on your machine as a local process (`npx -y virlow-mcp`, launched by your
-AI client over stdio). It exposes 24 tools for three things:
+virlow-mcp runs on your machine as a local process (`npx -y virlow-mcp@latest`, launched by your
+AI client over stdio). It exposes tools for four things:
 
 - **Memories** — short, durable facts ("the user prefers TypeScript", "this repo's CI
   runs on self-hosted runners") that any AI tool can add, search semantically, and recall
@@ -30,6 +30,16 @@ AI client over stdio). It exposes 24 tools for three things:
   schema and values in the note's encrypted attrs, so the server sees neither. Properties
   ship in the Virlow app as of its epic 3, so what is written here is what the user sees in
   the note, the table, the board and the calendar.
+- **Attachments**: files on a note. `list_attachments`, `add_attachment`,
+  `read_attachment`, `rename_attachment`, `move_attachment`, `delete_attachment` and
+  `restore_attachment`. Files are encrypted in this process before upload, the same way the
+  app does it. `add_attachment` takes `text` or `content_base64` (up to 2 MB), or `path`, an
+  absolute path to a file on this machine (up to 35 MB). `read_attachment` returns text and
+  small files inline, and with `save_to` writes the decrypted file to disk instead; it never
+  replaces an existing file unless `overwrite` is true. `delete_attachment` moves a file to the
+  note's Recently deleted, where `restore_attachment` can bring it back for 30 days. `path` and
+  `save_to` exist only when this server runs on your machine over stdio (or `--http` on
+  loopback); the hosted connector and a non-loopback `--http` take inline content only.
 
 Everything is **end-to-end encrypted, zero-knowledge**: the encryption key is derived
 from your Virlow master password inside this local process and never leaves it. Every
@@ -44,7 +54,7 @@ through a tool call, and never seen by the AI model.
 ### This is the local server, and that distinction is the whole security model
 
 Every claim above is about **this package**, running on **your machine**. Virlow also
-offers a **hosted connector**: the same 24 tools, served from Virlow's own servers, so a
+offers a **hosted connector**: the same tools, served from Virlow's own servers, so a
 client can connect by URL with nothing installed. It is a genuinely different trust model,
 and the sentence "the key never leaves it" is the part that stops being true:
 
@@ -66,15 +76,25 @@ guarantee.
 
 ## Install / configure
 
-virlow-mcp needs no separate install — `npx -y virlow-mcp` fetches and runs it directly.
+virlow-mcp needs no separate install: `npx -y virlow-mcp@latest` fetches and runs it directly.
 Add it to your client's MCP config:
 
 ### Claude Code
 
 ```
-claude mcp add virlow -- npx -y virlow-mcp
+claude mcp add virlow -- npx -y virlow-mcp@latest
 ```
 
+On Windows, `npx` is a batch script, so wrap it in `cmd /c`:
+
+```
+claude mcp add virlow -- cmd /c npx -y virlow-mcp@latest
+```
+
+Run that from PowerShell or cmd. Git Bash rewrites `/c` into a path; there, edit
+`~/.claude.json` so the server's `"command"` is `"cmd"` and its `"args"` are
+`["/c", "npx", "-y", "virlow-mcp@latest"]`.
+
 ### Claude Desktop
 
 Add to your `claude_desktop_config.json`
@@ -86,7 +106,7 @@ Windows: `%APPDATA%\Claude\claude_desktop_config.json`):
   "mcpServers": {
     "virlow": {
       "command": "npx",
-      "args": ["-y", "virlow-mcp"]
+      "args": ["-y", "virlow-mcp@latest"]
     }
   }
 }
@@ -101,7 +121,7 @@ Add to `~/.cursor/mcp.json` (global) or `.cursor/mcp.json` (project-local):
   "mcpServers": {
     "virlow": {
       "command": "npx",
-      "args": ["-y", "virlow-mcp"]
+      "args": ["-y", "virlow-mcp@latest"]
     }
   }
 }
@@ -114,7 +134,7 @@ Codex's MCP config is TOML, not JSON. Add to `~/.codex/config.toml`:
 ```toml
 [mcp_servers.virlow]
 command = "npx"
-args = ["-y", "virlow-mcp"]
+args = ["-y", "virlow-mcp@latest"]
 ```
 
 ### Self-hosting Virlow
@@ -128,7 +148,7 @@ Claude Desktop / Cursor:
   "mcpServers": {
     "virlow": {
       "command": "npx",
-      "args": ["-y", "virlow-mcp"],
+      "args": ["-y", "virlow-mcp@latest"],
       "env": { "VIRLOW_API_URL": "https://api.your-domain.com" }
     }
   }
@@ -147,7 +167,7 @@ only spawn a command use this package as a pipe:
   "mcpServers": {
     "virlow": {
       "command": "npx",
-      "args": ["-y", "virlow-mcp", "--connect", "http://127.0.0.1:47821/mcp",
+      "args": ["-y", "virlow-mcp@latest", "--connect", "http://127.0.0.1:47821/mcp",
                "--token-file", "<path the app shows you>"]
     }
   }
@@ -156,6 +176,15 @@ only spawn a command use this package as a pipe:
 
 In this mode nothing is decrypted in this process. It forwards to the app and back.
 
+### Staying up to date
+
+With `virlow-mcp@latest` in the command, your client gets the newest release each time it
+starts the server, so restarting the client (or opening a new session) is the whole update.
+Without `@latest`, `npx` can keep running a copy it downloaded earlier; add `@latest` to an
+existing config to fix that. Pin an exact version (`virlow-mcp@3.81.0`) only if you want
+updates to wait for you. The desktop app updates itself and its built-in server, and the
+hosted connector is updated on Virlow's side.
+
 ## First use
 
 1. Ask your AI client to run the **`unlock`** tool. This opens a browser window pointed
@@ -206,13 +235,13 @@ just give you two versions to keep in sync.
 ## Reaching your vault from a session that is not on this machine
 
 By default `virlow-mcp` speaks stdio, so your AI client spawns it as a child
-process and everything stays on one machine. `--http` serves the same 24 tools
+process and everything stays on one machine. `--http` serves the same tools
 over HTTP instead, so a client that cannot spawn a local process — a cloud
 coding session, another laptop — can reach this vault:
 
 ```bash
-npx -y virlow-mcp --http                 # loopback, random port
-npx -y virlow-mcp --http --port 8787     # pick the port
+npx -y virlow-mcp@latest --http                 # loopback, random port
+npx -y virlow-mcp@latest --http --port 8787     # pick the port
 ```
 
 It prints the URL and the path to a bearer token, generated on first run and
@@ -295,12 +324,12 @@ account cannot be reached, the tools refuse rather than assume consent.
 unregistered, so they do not appear in `tools/list` at all:
 
 ```bash
-npx -y virlow-mcp --no-memories
+npx -y virlow-mcp@latest --no-memories
 ```
 
 Use it when you want a connector that structurally cannot touch memories,
 regardless of the account setting. Notes tools, `unlock`, `lock`, and `status`
-are unaffected either way (18 tools instead of 23).
+are unaffected either way.
 
 ## Suggested agent rules
 

package/dist/cli.js

@@ -4742,7 +4742,7 @@ function startUnlockServer(api, vault, opts = {}) {
 }
 
 // src/version.ts
-var VERSION = true ? "3.81.0" : "dev";
+var VERSION = true ? "3.81.1" : "dev";
 
 // src/server.ts
 function defaultEmbeddingCacheDir() {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "virlow-mcp",
-  "version": "3.81.0",
+  "version": "3.81.1",
   "description": "Local MCP server for Virlow Secure Notes: end-to-end-encrypted AI memories and notes for Cursor, Claude, Codex, and any MCP client.",
   "license": "UNLICENSED",
   "type": "module",
@@ -34,9 +34,9 @@
     "esbuild": "^0.25.0",
     "typescript": "^5.8.0",
     "vitest": "^3.0.0",
-    "@batalabs/virlow-crypto": "3.81.0",
-    "@batalabs/virlow-mcp-core": "3.81.0",
-    "@batalabs/virlow-memory": "3.81.0"
+    "@batalabs/virlow-crypto": "3.81.1",
+    "@batalabs/virlow-mcp-core": "3.81.1",
+    "@batalabs/virlow-memory": "3.81.1"
   },
   "scripts": {
     "build": "node build.mjs",