Scoped personal access tokens, a queryable agent activity log and an explicit confirm on deletes are the things you want when an agent is writing into your notes unattended. The context-first design is the other half: in strict mode a write is refused unless the same agent first built a context pack, which is a real guard against an agent editing a page it never read.
An open-source workspace — pages, databases, table, kanban and calendar views — with a first-class MCP server built in. Editors connect with one-click OAuth; headless agents use a scoped personal access token.
- 21 tools split into read and write scopes, over stateless Streamable HTTP
- Reading: `search_workspace`, `list_workspace`, `get_page`, `get_pages`, `get_database_schema`, `query_database`, `list_members`, `query_audit_log`
- Change tracking: `get_changes_since` returns a chronological feed from a timestamp or cursor, and `get_related_pages` returns parents, children, links, backlinks and database siblings
- Writing: `create_page`, `update_page`, `bulk_update_pages`, `move_item`, and `delete_page` which requires an explicit confirm
- Databases: `create_database`, `update_database_schema`, and view management through `create_database_view`, `update_database_view` and `delete_database_view`
- `prepare_context` builds a token-budgeted context pack ranked by relevance, freshness and trust, and returns a run id the stricter policy mode requires before any write
Self-host it: clone and run with npm after filling in `AUTH_SECRET` and OAuth credentials, or bring it up with Docker Compose, which persists the SQLite database in a volume. The first account to sign up becomes admin. Editors connect over OAuth with nothing to paste; CI and headless agents use a scoped read or write token sent as a bearer header. Licensed AGPL-3.0.
One command — claude mcp add --transport http --scope user remnus https://www.remnus.com/api/mcp