Virlow MCP connector core: encrypted note and memory access, folder exposure, and the memories opt-in. Shared by the local virlow-mcp CLI and the hosted connector.
The connector core behind Virlow's MCP integration:
encrypted note and memory access, folder exposure, and the memories opt-in.
Shared deliberately. The local virlow-mcp CLI and the hosted connector both
decide what an AI tool may read, and those rules — folders.mcpEnabled and the
account's memories setting — must have one implementation. Two copies of the
code that decides who can read what would drift, and drift there is a security
bug rather than an inconsistency.
Notes in a shared workspace are encrypted under that workspace's key, which
the connector does not hold, so it leaves them out of lists, search and
mention scans and says so, rather than failing the request.
What it does not contain: transports, the CLI, and the unlock user interface.
Those differ between local and hosted and belong to their hosts.
Virlow MCP connector core: encrypted note and memory access, folder exposure, and the memories opt-in. Shared by the local virlow-mcp CLI and the hosted connector.