stillhome

Connect your agent

MCP · streamable http · oauth or bearer tokens

still exposes a remote MCP server — any MCP-capable agent can read and write your journal. This page is the honest, kept-in-sync statement of what that surface can and cannot do.

  • Endpoint — https://journal.crisislabs.dev/api/mcp (MCP Streamable HTTP, stateless)
  • Auth — OAuth if your client supports connectors (claude.ai, ChatGPT): nothing to paste. Otherwise a personal access token as a bearer header, created in self · tokens, shown once at creation and stored hashed.
  • Rate limit — 120 requests per minute per token.

claude.ai / ChatGPT connectors

Add a custom connector pointed at the endpoint above and pick OAuth when asked how to authenticate — no token pasting needed. The connector registers itself, sends you here to sign in, and shows a consent screen naming exactly what it may do (read your journal, write entries). Approve and you're connected.

Connected apps are listed at self · tokens — disconnect there any time; the app has to re-ask from scratch. Access granted to an app already holding a token ends within the hour.

Claude Code

claude mcp add --transport http still-journal https://journal.crisislabs.dev/api/mcp \
  --header "Authorization: Bearer YOUR_TOKEN"

Claude Desktop

Desktop launches stdio servers, so bridge the remote endpoint with mcp-remote in claude_desktop_config.json:

{
  "mcpServers": {
    "still-journal": {
      "command": "npx",
      "args": [
        "mcp-remote",
        "https://journal.crisislabs.dev/api/mcp",
        "--header",
        "Authorization: Bearer YOUR_TOKEN"
      ]
    }
  }
}

Any other MCP client

Anything that speaks MCP Streamable HTTP and can send a custom header works the same way: POST JSON-RPC to the endpoint with Authorization: Bearer YOUR_TOKEN and Accept: application/json, text/event-stream.

What the surface offers

Read tools — ping, get_daily_log (one day), query_entries (date-range + status/type/tag filters, capped at 100 with a truncated flag), search_entries (text search, up to 50 matches), get_monthly_log (the month's monthly-log entries), get_habits (streaks + done-date history), get_stats (aggregate counts by status/type/tag).

Write tools — create_entry, update_entry_status, update_entry_content, set_entry_signifiers, update_entry_tag, delete_entry (soft delete), migrate_entry (the carry-forward ritual). Every write accepts an optional clientMutationId making retries exactly-once. Migration in particular should always pass one: a blind retry duplicates the target.

Prompts — daily-review and weekly-reflection: guided daily and weekly rituals that surface as slash commands in clients that support MCP prompts.

What your agent can and can't see

Every entry sits in one of two zones: agent-visible or private. Agent-visible entries are readable in full. A private entry's content is encrypted under a key the server does not hold, so the surface cannot serve it to an agent even if asked — this is a property of the keys, not a filter that could be flipped off.

  • Listing reads (get_daily_log, query_entries, get_monthly_log) return private entries as structure only: content: null, private: true, plus a privateCount on the result. Date, type, status, signifiers, and tag are plaintext columns, so the shape of your day stays legible without the words.
  • search_entries never covers the private zone — the server can't match text it can't decrypt. It reports privateNotSearched so an agent can tell you it skipped entries rather than conclude you wrote nothing.
  • get_stats counts both zones, with privateCount naming the difference. "You wrote 3 private entries yesterday" is answerable; what they said is not.
  • Entries your agent creates are always agent-visible. It saw the text as it wrote it and the server sealed it — marking that private would be a false claim, and would hide the entry from the one reader who already has it.

The trade this encodes: sharing an entry with your agent means sharing it with the server. Agent search covering the visible zone only is the trust model, not a gap in it.

Limits, honestly stated

Tokens are full-access or read-only, chosen at creation — no finer scopes yet (OAuth mirrors the same two as journal:write / journal:read). Write tools refuse read-only tokens with a clear error. No habit writes. No collections access. Deletes are soft but irreversible via the API.