These tools are exposed by the local privatenote-mcp server. Prefer path arguments so plaintext remains outside the agent conversation.
create_private_note
Prepares a preview by default. A supported host’s approval dialog can accept and complete creation during the same tool call. On hosts without that dialog, creation remains pending until a later confirm_private_note call.
{
"contentFilePath": "/absolute/path/to/project/demo.txt",
"expiresIn": "1h",
"burnAfterReading": true
}- contentFilePath · string
- Absolute path to a UTF-8 file to use as the body. Prefer over content.
- filePath · string / filePaths · string[]
- Local attachments. Sign-in required. Combined maximum is 20; account limits still apply.
- passwordFilePath · string
- File whose first line supplies the reveal passphrase. Prefer over password.
- expiresIn · string
- Default 24h. Values: 5m, 10m, 15m, 30m, 1h, 2h, 8h, 24h, 1d, 3d, 7d, 14d, 15d, 30d. Plan limits apply.
- burnAfterReading · boolean
- Default true. False requests two reads and requires a paid account.
- title · string
- Optional text prepended to the body before encryption.
- content / password · string
- Last-resort plaintext arguments. Anything placed here is visible to the model.
- requireRecipientVerification · boolean
- Requires sign-in, a paid plan, and recipientEmail. Adds an ownership check before reveal; does not send the link.
- recipientEmail · string
- Email address used for the recipient-verification gate.
- notifyOnOpen · boolean
- Requires sign-in, a paid plan, and a verified sender email. Emails the account on opening.
- label · string
- Activity label, stored outside encrypted content. Requires sign-in.
- sendChannel / sendRecipient · string
- Exact delivery channel and destination bound to the preview. Channels: email, slack, discord, teams, whatsapp. Neither field sends a message.
confirm_private_note
Accepts only the confirmationId from the pending preview. It cannot change the path, destination, expiry, or destruction settings.
{
"confirmationId": "cnfg_…"
}Tokens expire after five minutes and are single-use. They are consumed when confirmation starts, including when file validation or upload fails. If a file changes, start a new preview and approve it again.
Creation result
- secureUrl
- Full recipient link, including the decryption key in its fragment. Treat as sensitive.
- noteId / expiresAt / burnAfterReading
- Creation metadata describing the note and access settings.
- True only when the approved host dialog authorized the bound destination. False means return the link to the user without sending through another tool.
sign_in, whoami, sign_out
sign_in opens a browser approval page locally. The agent receives neither the device code nor the approval URL. After you click Approve in that browser, the agent calls sign_in again with no arguments.
whoami checks the current MCP session. sign_out revokes that app session and removes its local token. Website cookie sessions are separate.
The local session file is mcp-session.json. On macOS and Linux it is ~/.config/privatenote/mcp-session.json. On Windows it is %APPDATA%\privatenote\mcp-session.json. Do not share this file or pass it as note content.
list_sent_notes and revoke_sent_note
Both require sign-in and a paid plan. list_sent_notes returns events and lifecycle metadata, including openedAt, rather than content. revoke_sent_note revokes an unopened note. Use it only for the specific note the user wants to revoke.
There is no push webhook into the agent. Check list_sent_notes to observe opening, or use notifyOnOpen for an email notification.