Name: mindin
Author: gronare

mindin MCP

Indexed search, schema-checked writes and session hooks for a markdown notes vault

Grade A Local · stdio API key 23 tools v0.15.0 · 5 Nov 2026 MIT

No reviews yet by gronarePyPI Runs on your machine, nothing hosted

94/100

trust score

tools declared

local

runs on your machine

—

downloads a day

What it does

Indexed search, schema-checked writes and session hooks for a markdown notes vault

Quickstart

# 1 — add it to Claude Code
claude mcp add --scope user mindin-mcp '--' uvx mindin

# 2 — ask your agent for something these tools do
#   search, read_file, write_file and 20 more

mindin costs nothing on mcprush: there is no plan to choose here, no cap to set and nothing mcprush can bill you for.

Publishernot claimed

gronare2 servers

1 category

All 2 servers

Collected from a public index. Nobody has claimed this account, so nothing here was written by its author — claim it if it is yours.

Installation

Where are you running it?

Every route below installs the same thing and ends at the same approval screen. This one runs on your machine: your client starts mindin as a process under your own user, with your files and your network, so the tool surface below is what it can do to your computer rather than to a server somewhere else. Its scan result is on the Security tab — read the surface before you approve it.

Claude Codedeclared by this listing

This is a public server: you run it yourself and this marketplace is not in the path. You need uv (docs.astral.sh/uv): uvx comes with it. Claude Code registers it in one command; --scope user makes it available in every project. The '--' is in quotes so that PowerShell passes it on.

claude mcp add --scope user mindin-mcp '--' uvx mindin

Reconnect, or start a new session, and the tools appear in the model’s tool list.

Free on mcprush, and it runs from its publisher’s own package: this marketplace is not in the path, so there is no key of ours to hold and no card to add.

What it asks of you

Nothing is required, but it can take VAULT_PATH (Directory holding the vault. Set this or the four S3_* variables.), S3_ENDPOINT (S3 or MinIO endpoint URL holding the vault), S3_ACCESS_KEY (Access key for the vault bucket), S3_SECRET_KEY (Secret key for the vault bucket), S3_BUCKET (Bucket holding the vault), S3_PREFIX (Key prefix inside the bucket), S3_REGION (Region for the vault bucket), VAULT_CACHE_DIR (Where the SQLite index lives), VAULT_SCHEMA (Local schema file overriding the one in the vault), VAULT_STOP_HOOK (Set to off to disable the stop hook), VAULT_STOP_HOOK_COMMITS (Set to off to turn off the stop hook's unlogged-commit and stale-note checks alone), VAULT_STOP_HOOK_PROMPTS (Messages the user writes after the agent's last vault write before the stop hook asks it to save them (default 3), or off) if you want to set them.

What it writes

One config entry your client uses to start the process locally. A local server runs with your file system and your network, which is why it is priced without metering.

What you approve

23 tools, with what each one reads, writes and reaches shown before you agree — the same list on every route above. Read the tool surface.

Tool surface

What the model actually sees. Descriptions are diffed on every release — see version history.

Only tools that write or reach the network

Read from its source code. A server that builds its tool list when it starts can list more tools than this.

Parameter	Type	Required	Notes
query	string	yes	—
limit	integer	no	—
folder	string	no	—
status	string	no	—
tag	string	no	—
kind	string	no	—
area	string	no	—
include_archive	boolean	no	—
include_superseded	boolean	no	—
path_prefix	string	no	—
since	string	no	—

MODERATE — one round trip to storage. Returns the note with an etag: first line; pass that etag back to write_file to refuse a write over someone else's change. Search first. .vault/schema.yml reads the vault's schema.

Parameter	Type	Required	Notes
path	string	yes	—

WRITE — validates the frontmatter against the vault schema and refuses the write if it does not hold. Stamps updated with today and fills date when missing. Pass expected_etag from read_file to make the write conditional, or "*" to create a note that must not exist yet.

Parameter	Type	Required	Notes
path	string	yes	—
content	string	yes	—
expected_etag	string	no	—

WRITE — appends to an existing note and bumps updated; the note must still satisfy the schema. A missing note is refused: create it with write_file.

Parameter	Type	Required	Notes
path	string	yes	—
content	string	yes	—

WRITE — moves or renames a note; the note must satisfy the schema at the destination. Use close to archive finished work.

Parameter	Type	Required	Notes
source	string	yes	—
dest	string	yes	—

WRITE — deletes a note for good. Prefer close, which keeps it.

Parameter	Type	Required	Notes
path	string	yes	—

CHEAP — paths only, no metadata and no bodies. search answers context questions better.

Parameter	Type	Required	Notes
prefix	string	no	—

WRITE — changes a note's status without rewriting it: backlog (with a priority: urgent, high, medium, low) parks it, active picks it up again, draft. The triage list at session start is settled with this, append_file or close.

Parameter	Type	Required	Notes
path	string	yes	—
status	string	yes	—
priority	string	no	—
source	string	no	—

WRITE — finishes a note: sets status complete (or superseded with superseded_by when merged_into is given) and moves it into the archive. Run it in the same pass as the last commit of the work; a note left open is what makes the vault drift.

Parameter	Type	Required	Notes
path	string	yes	—
merged_into	string	no	—
status	string	no	—

WRITE — files an idea as a backlog note in the task folder: title, area (stem or [[stem]]), one line saying what and why, optional priority (urgent, high, medium, low) and source (who said it and when, or a sha). Call it the moment something is deferred, in so many words or in passing; picking the…

Parameter	Type	Required	Notes
title	string	yes	—
area	string	yes	—
line	string	yes	—
priority	string	no	—
source	string	no	—

CHEAP — the backlog sorted by priority then age. Filter by area (a stem, or the prefix a family of stems shares) and by priority.

Parameter	Type	Required	Notes
area	string	no	—
priority	string	no	—
limit	integer	no	—

WRITE — appends one dated line to the repo log, with the commits it produced. Run once at the end of a session per repo. Creates the log note when it is missing. repo is the main checkout's name, also from a worktree; branch is the branch the commits were made on. area is the stem of the system…

Parameter	Type	Required	Notes
repo	string	yes	—
line	string	yes	—
commits	array	no	—
area	string	no	—
branch	string	no	—

CHEAP — the session-start call. Returns the system notes covering the code at path, the open tasks for it, the reference notes and the tail of the repo log, in one answer. Use it before searching blind. format "json" adds the system notes' paths and dates and the triage keys, for hooks that read…

Parameter	Type	Required	Notes
path	string	no	—
repo	string	no	—
query	string	no	—
limit	integer	no	—
format	string	no	—

WRITE — the weekly lint for a scheduled job: parks stale open task notes in the backlog when park is set, and writes the findings as the note at write when given; answers the findings.

Parameter	Type	Required	Notes
write	string	no	—
park	boolean	no	—

WRITE — for tools that run agents on task notes, such as kebbie: writes which machine and task work on the note (frontmatter key kebbie), unless another machine holds it; force takes it over. An agent never calls it on its own. Answers JSON.

Parameter	Type	Required	Notes
path	string	yes	—
machine	string	yes	—
task	string	yes	—
repo	string	no	—
force	boolean	no	—

WRITE — for tools that run agents on task notes, such as kebbie: clears the note's claim (frontmatter key kebbie), only when machine holds it if machine is given; without a path, clears every claim of machine and task. Answers JSON.

Parameter	Type	Required	Notes
path	string	no	—
machine	string	no	—
task	string	no	—

CHEAP — for tools that draw a board from the vault, such as kebbie: every system and task note outside the archive and log folders with its metadata and claim, the opening paragraph of open tasks and the last lines of each repo log, under an etag. Pass since=<etag> to get only {"unchanged": true}…

Parameter	Type	Required	Notes
since	string	no	—

CHEAP — for the command line's human output: the data behind search, backlog or context (command), with the arguments that command takes. Answers JSON.

Parameter	Type	Required	Notes
command	string	yes	—
query	string	no	—
limit	integer	no	—
area	string	no	—
priority	string	no	—
path	string	no	—
repo	string	no	—

CHEAP — a repo's period page: its log lines, its commits and the notes dated in the period (YYYY-MM or YYYY). commits maps a day (YYYY-MM-DD) to its "sha subject" lines, read from the repo's git log by the caller; leave it out to show no commits. write stores the page as the period note instead of…

Parameter	Type	Required	Notes
repo	string	yes	—
period	string	yes	—
commits	object	no	—
write	boolean	no	—

CHEAP — who this connection signs in as and whether it may write. Answers JSON.

Takes no parameters.

MODERATE — reads every note to report drift: broken frontmatter, missing required fields, missing area, unresolved wikilinks, orphans, stale open tasks, archived notes still marked active, duplicate stems and superseded targets that do not exist.

Takes no parameters.

WRITE — sets a vault up: writes .vault/schema.yml and the Obsidian Bases views into the vault root. Run once per vault, right after installing. preset picks the layout of a vault without a schema: …; without it, the vault gets default. On a vault that has a schema, it only writes the views that…

Parameter	Type	Required	Notes
force	boolean	no	—
preset	string	no	—

WRITE — mints the personal token Obsidian's Remotely Save plugin uses to reach this vault over WebDAV, and shows it once. Issuing a new token revokes the previous one. The username is the email on your identity.

Takes no parameters.

Free

$0 forever

Every tool, no call limit
No card, and mcprush charges nothing for it
Source published under MIT
Runs on your machine — nothing of it reaches our gateway
Nothing to cap, because mcprush bills nothing

Nothing here is billable: mcprush charges nothing to install mindin or to call it, at any volume.

ATrust score 94 / 100

Release 0.15.0 · scanned 6 Nov 2026

Two independent axes, because powerful and malicious are different questions. The grade is threat only. The capability level is blast radius, and it is never a penalty on the grade — it is priced as one subtract-only term in the score, where you can see it.

Threat score100

Client score94

Findings10 threat · 16 capability

Capabilityhigh

Coveragesource

Verificationsource

Surface digestac8fa8220da2152c55981df6c11a96ca365d21743215f2d2c8d6c7929b5bc1fa

Score vectorthreat 100 → client 94

Term	Level	What it prices	Points
capability-exposure	high	capability blast radius (high) — client exposure if the model is manipulated	−6
verification-discount	source	publisher verification (provenance) — cryptographic build provenance ties the artifact to its source	−0
coverage-honesty	source	inspection depth (source) — how much of the target the scan could see	−0

score = clamp(round(threatScore − E_cap − E_ver − E_cov), 0, 100). No model, no opinion, no network call at scoring time: the same methodology version against the same bytes always produces this number, and every line above is a field of the report rather than a summary of it.

What the scan could actually read

A grade is only as meaningful as its coverage, so the scanner publishes its own depth before it publishes its result.

Tool surfaceread

Implementation sourceread

Package metadataread

Live transportnot available

Tools were statically extracted from the published source (23 recovered), not enumerated from a running server. Tool-poisoning, Unicode-smuggling, capability and toxic-flow analysis ran on this inferred surface, but a mis-parsed registration could be missed or mis-attributed, so tool-derived findings are capped below “confirmed”. To grade the real runtime surface, scan the running server: --command "npx -y <package>".

16 of the 23 recovered tools are registered only when isinstance(resolver, Unconfigured) is false (mindin/server.py:86) — typically when a key or option is configured. They are part of the server's surface and were analysed; a server started without that configuration exposes none of the recovered tools.

6 of the 23 recovered tools are registered only when machine_tools holds (mindin/server.py:305) — typically when a key or option is configured. They are part of the server's surface and were analysed; a server started without that configuration exposes none of the recovered tools.

1 of the 23 recovered tools are registered only when personal_tokens is not None holds (mindin/server.py:461) — typically when a key or option is configured. They are part of the server's surface and were analysed; a server started without that configuration exposes none of the recovered tools.

Capability — what it could do if the model were manipulated

Tags derived from each tool’s schema and the implementation, not from what the tool calls itself. high is the level these add up to.

No tool is registered unconditionally · (1) 16 only when isinstance(resolver, Unconfigured) is false (mindin/server.py:86) · (2) 6 only when machine_tools holds (mindin/server.py:305) · (3) 1 only when personal_tokens is not None holds (mindin/server.py:461) — typically when a key or option is configured. All 23 are in the table below and were analysed; the conditional ones are marked.

Tool	Capability tags	Why the tag was assigned
search conditional (1)	no tags
delete_file conditional (1)	file-write	file-write: keyword "delete_file" in tool name
list_files conditional (1)	sensitive-source	sensitive-source: keyword "list_files"
whoami conditional (1)	no tags
read_file conditional (1)	sensitive-source	sensitive-source: keyword "read_file"
write_file conditional (1)	file-write	file-write: keyword "write_file" in tool name
append_file conditional (1)	file-write	file-write: keyword "append_file" in tool name
move_file conditional (1)	file-write	file-write: keyword "move_file" in tool name
set_status conditional (1)	no tags
close conditional (1)	no tags
backlog_add conditional (1)	no tags
backlog conditional (1)	no tags
log_append conditional (1)	no tags
context conditional (1)	no tags
lint_and_park conditional (2)	no tags
claim conditional (2)	no tags
release conditional (2)	no tags
snapshot conditional (2)	no tags
view conditional (2)	code-exec	code-exec: parameter "command"
changelog conditional (2)	no tags
lint conditional (1)	no tags
init conditional (1)	no tags
obsidian_access conditional (3)	no tags

Toxic-flow graph

The lethal trifecta, checked as a graph rather than as a checklist: untrusted input, a sensitive source and an external sink have to meet before there is a path worth worrying about.

list_files → view

A sensitive-source → external-sink chain exists: list_files ⇒ view.

Supply chain and provenance

Integrityfirst-seen

Surface digestac8fa8220da2152c

Scanned2026-11-06

This is the first scan of this surface here, so there is nothing yet to compare it against.

Every result on this tab comes from one deterministic pass over the published package — offline, rule by rule, and auditable line by line above. Same methodology version, same bytes, same score.

mindin MCP

What it does

Quickstart

Where are you running it?

Tool surface

What counts against your monthly calls

What the scan could actually read

Capability — what it could do if the model were manipulated

Toxic-flow graph

Supply chain and provenance

Release history

See also