Pinboard's v1 API puts your token in a query parameter, which means any unhandled network error can spill it into a log file — this server truncates and sanitises those errors on purpose, and validates tags and hex IDs with Zod before any request goes out. Everything else follows from being stdio-only: no port, no third party, and a full read-write surface over your own bookmarks.
A local server on the Pinboard API v1, written in TypeScript with Zod schemas. It reads and writes bookmarks, manages tags, and reads notes, over stdio only — it never opens an HTTP port, and talks solely to `api.pinboard.in`.
- `get_recent_posts` lists your latest bookmarks, filtered by up to 3 tags, `count` defaulting to 15 and capped at 100
- `get_posts` retrieves bookmarks by tag, by a `dt` date, or by exact `url`, with `meta` for the change-detection hash
- `get_all_posts` returns everything, paged with `start` and `results` and bounded by `fromdt` / `todt` — rate limited to once every 5 minutes
- `add_post` adds or replaces a bookmark (url and title required, tags starting with `.` are private, `shared` and `toread` control visibility and reading state); `delete_post` removes one permanently
- Tags: `get_tags` with usage counts, `suggest_tags` returning popular and recommended tags for a URL, `rename_tag` to rename or fold one into another, `delete_tag` to drop a tag without touching the bookmarks
- Notes: `list_notes` for the list, `get_note` for one note's full body — note creation and editing are outside the v1 API
- `get_last_update` returns the time of the most recent change, so you can tell whether anything moved since your last fetch
A Pinboard API token from Settings → Password on pinboard.in, in the form `username:HEXTOKEN`, passed as `PINBOARD_API_TOKEN`. Easiest path: download the `.mcpb` file from the repository's releases and drop it on your assistant. Otherwise Node.js 22 or newer, then `npm install` and `npm run build`, and point your client at `node` with the path to `dist/index.js`. The v1 API takes the token as a query parameter, so the server intercepts and sanitises network-level error messages to keep it out of your client's logs.