Use it with Codex, Cursor and other clients

Clients that start a stdio server

Any client that starts a stdio MCP server works. On a machine where mindin setup saved the vault, the client starts mindin with no settings; the install script offers to add it to Codex and Cursor. To pass the vault in the client's own config instead, Codex:

codex mcp add vault --env VAULT_PATH=$HOME/vault -- uvx mindin

Cursor (.cursor/mcp.json), Claude Desktop's local config and most other clients take the same shape:

{
  "mcpServers": {
    "vault": {
      "command": "uvx",
      "args": ["mindin"],
      "env": { "VAULT_PATH": "/home/me/vault" }
    }
  }
}

For a bucket, pass the S3_* settings in place of VAULT_PATH (Storage). For a vault server, sign the machine in and pass VAULT_SERVER_URL:

codex mcp add vault --env VAULT_SERVER_URL=https://vault.example.com -- uvx mindin

The server's instructions carry the vault schema's rules, so a client without the CLAUDE.md snippet that init prints still picks kinds and statuses the same way.

The container image runs the same stdio server:

docker run --rm -i -e S3_ENDPOINT -e S3_ACCESS_KEY -e S3_SECRET_KEY -e S3_BUCKET ghcr.io/gronare/mindin:latest

Clients that connect to a URL

An MCP client that speaks OAuth takes the server's address, VAULT_PUBLIC_URL/mcp, or one vault's, VAULT_PUBLIC_URL/mcp?vault=<slug>, as a remote server and signs in through the browser.

VAULT_PUBLIC_URL/mcp works for every client too: a key reaches the vault it was made for, and a client signed in through the browser asks which vault it gets.

Clients that only take a header

  1. On the vault's page, make a key, named after where it will live, with read or read and write.
  2. Send Authorization: Bearer nvm_... to VAULT_PUBLIC_URL/mcp or to the vault's address.

The key reaches only its vault; another vault's address refuses it. Keys are shown once, show when they were last used, and are revoked on the vault's page.

kebbie

kebbie uses the vault for each task's note, through the task and log commands. For a vault server, sign the machine in once; the commands find the vault as every command does, so on a machine set up with mindin setup kebbie needs nothing else.