PrivateNote MCP server

The handoff workflow#

1. 1
   The agent passes a local path and the requested access options to create_private_note.
2. 2
   PrivateNote prepares a preview of the exact file bytes, expiry, destruction settings, and optional delivery destination.
3. 3
   You approve. A supported host’s Accept dialog can complete creation immediately. Otherwise, the agent waits for your next message, then calls confirm_private_note with only confirmationId.
4. 4
   The local process verifies the bound file and encrypts it. The result includes secureUrl and safe metadata.

Example request#

Create a read-once PrivateNote from /absolute/path/to/project/demo.txt.
Expire it in 1 hour. Pass the path without reading the file into chat.
Show me the preview before creating the link.

Start with a dummy file inside your workspace. Keep a real secret out of your first acceptance test.

Creation and delivery approval#

Creating a link does not automatically authorize delivery. To request delivery approval, supply both sendChannel and sendRecipient so the preview names the exact destination.

Sending is authorized only when the host approval dialog returns Accept for that destination. A fallback text confirmation can create the link, but sendAuthorized remains false. The agent must not send it through another tool when that flag is false.

The MCP server itself does not send Slack messages, emails, or WhatsApp messages. An independently authorized delivery tool performs that step.

Allowed paths#

Files must be inside the working directory or an explicitly configured PRIVATENOTE_MCP_ALLOWED_ROOTS directory. A client launched from your home directory or the filesystem root needs explicit allowed roots before file operations can work.

Credential directories such as ~/.ssh and ~/.aws, cloud configuration, and the MCP session file remain blocked even with a broad allowlist. See setup for configuration.

Set up your client#

Install the local server or browse the tool reference.