Trunkbase speaks the Model Context Protocol (MCP), so any MCP-capable AI client can read your vault once you expose it. Clients connect one of two ways.
How clients connect
- Connector bundle (`.mcpb`) — for Claude Desktop, which talks to local servers over stdio. Trunkbase generates a
.mcpbbundle; opening it registers Trunkbase with Claude in a couple of clicks. - Localhost Streamable HTTP — for Claude Code and other HTTP-capable clients, which connect straight to the local server endpoint at
127.0.0.1.
Either way the server is bound to 127.0.0.1 only — it never listens on the network — and every request's origin is checked before it's answered.
What an AI can do
Read access ships today; write access is a separate, opt-in layer. The gate is always the vault, not the client.
| Capability | Who can use it | The gate |
|---|---|---|
| Read notes, search, follow connections | Any connected client | Per-vault read exposure — off by default |
| Add tags, write or update notes | Clients on a writable vault | Per-vault write exposure — off by default, requires read first |
| Delete or move files | No one, ever | Not built into the AI surface at all |
The read tools are deliberately scoped: list vaults, search a vault, get a note, list folders, find similar notes, and read the connections between them. That's enough to answer questions about your documents — and nothing more.
Write is all-or-nothing per vault. When you enable write on a vault, any connected client can write to it. There's no per-client write ladder — the vault is plain files on your disk, so the meaningful control is the vault toggle itself. Every AI write is still labelled with its author and snapshotted before it overwrites, so it's always reversible.
What's coming
- More clients. LM Studio, Gemini CLI, Cursor, VS Code and others are on the research list.
- Bring-your-own-key models and local model options are planned for a later release.
- macOS is the next operating system in line.
Remote access — reaching your vault from another machine — is deliberately not offered yet; it's reserved for a dedicated, security-first design down the road. For now, everything stays local, which is the whole point.