Connect your assistants with MCP

What an assistant can do

• search_knowledge, list_projects and get_project_history — read what the assistant’s role allows.
• read_source — read the original messages behind knowledge. By default the text is pseudonymized; you can switch to “nothing” or “full text” in Settings → Members.
• propose_memory — suggest a new item for you to review in Review.
• save_memory / update_memory — for editor roles; items are always stored as “proposed” and assistants can never confirm them.

Set it up

1. In AI Vault, open Settings → Members & assistants, add an assistant identity (for example “Claude Desktop”) with the role it needs — Contributor (proposes) is a good start.
2. Create an MCP access token for that identity and copy it (it is shown once).
3. In Settings → Storage, download an encrypted backup (.aivault).
4. Install Node.js 22 or newer and download the server file ai-vault-mcp.mjs from the link below.
5. Add the server to your assistant’s configuration (example below) with the backup path, the token and the backup passphrase as environment variables.
6. Restart the assistant. Proposals it makes are written to the backup file; restore that backup in AI Vault (Settings → Storage) to review them. Restoring replaces the vault in the browser, so do it before making other changes there.

Claude Desktop example (claude_desktop_config.json)

                {
  "mcpServers": {
    "ai-vault": {
      "command": "node",
      "args": ["/path/to/ai-vault-mcp.mjs", "--vault", "/path/to/my-vault.aivault"],
      "env": {
        "AI_VAULT_TOKEN": "avt_…",
        "AI_VAULT_PASSPHRASE": "your backup passphrase"
      }
    }
  }
}
              

Other local clients (Claude Code, Cursor, VS Code, Windsurf, Gemini/Antigravity CLI) use the same command and environment variables in their own MCP settings. VS Code can prompt for the token and the passphrase instead of storing them (inputs with "password": true).

Useful options

• --read-only: the backup file is never modified and the write tools are not offered.
• --http: serves several assistants at http://127.0.0.1:8765/mcp; each one sends its own token as Authorization: Bearer avt_….
• To use it from another machine, keep it on 127.0.0.1 and publish it through an HTTPS reverse proxy with --allowed-host your.domain. Never expose the plain HTTP port.
• The token and the passphrase are only accepted as environment variables, never as arguments, so other programs cannot read them from the process list.

What is not supported (yet)

Status as of October 2026; assistant vendors change their MCP support frequently, so check their documentation.

How it stays safe

• Each assistant has its own revocable, expiring token bound to one workspace; only a hash is stored.
• Every call is checked against the assistant’s role and project restrictions; items outside its reach are reported as “not found”.
• Writes require an idempotency key, so a retried call never creates duplicates.
• Every call is recorded in the audit log (ids and outcomes only, no content).
• Remember: whatever the assistant reads is sent to that assistant’s provider as part of your conversation.

Related guides

• Pseudonymization vs anonymization
• How to export your ChatGPT history
• How to export your Claude conversations

Open AI Vault