feat(mcp): read-only MCP server (search_notes, list_notes, get_note)

[shahid-io]

What

Adds inode mcp — runs inode as a read-only Model Context Protocol server over stdio, so MCP-aware clients (Claude Code, Cursor, …) can read the knowledge base mid-task.

Three tools:

• search_notes — natural-language vector search → grounded answer + source notes
• list_notes — metadata-only listing, filterable by category/tag
• get_note — fetch one note by ID prefix

Safety model

• Read-only by design. Writing notes from an agent stays out of v1 — an agent silently filling or wiping the KB with no reviewable trail is a bad default.
• Sensitive notes are protected. By default they're excluded from search candidates entirely (the LLM can't quote secrets) and masked in get_note. Opt in with inode config set mcp.reveal_sensitive true.
• Tools advertise honest annotations (readOnly, idempotent, not destructive) so clients don't warn users about safe lookups.

Testing

• Unit tests cover masking, formatting, and the read-only annotations (internal/mcp).
• Smoke-tested live over stdio: initialize → tools/list → tools/call list_notes against a real local DB.
• search_notes requires Ollama (query embedding + grounded answer); list_notes/get_note are pure SQLite.

Wiring it up

claude mcp add inode -- inode mcp

or inspect interactively with npx @modelcontextprotocol/inspector inode mcp.

Commits

• feat(mcp) — server + three tools + tests
• fix(mcp) — advertise tools as read-only (mark3labs defaults were destructive=true)

🤖 Generated with Claude Code