Connect AI to your notes.
Keep the boundaries clear.

MCP, the Model Context Protocol, lets an AI client use tools provided by another application. Virlow's connector gives it tools to search and read notes, and to create, update, organize or trash them when you ask.

Optional AI memories let an assistant store short facts and recall them in later sessions. They are encrypted notes in a Memories folder, where you can read, edit and delete them yourself.

The local connector runs on your computer. The hosted connector runs on Virlow's servers. They offer a similar workflow, but a different place for decryption. Read the security model before choosing.

1. Have your account ready. Sign in to Virlow and set up your master password if you have not already. It is separate from your sign-in password.
2. Choose a non-sensitive test note. Put it in a dedicated folder. Edit that folder, turn on Expose to MCP, and select Save. The switch is off by default and includes the folder's subfolders. Do not expose a broad parent folder just to test one note.
3. Leave memories off for your first test. If you later want an assistant to store and recall facts, use Settings → Security → AI memories. This separate setting is off by default; it is not required for ordinary note tools.

If a search reports hidden notes, check folder exposure. Notes outside any folder are not exposed. Turning on a parent includes its descendants; switching a child off does not override that parent.

You need Node.js 20 or later and an AI client that can launch a local MCP server over stdio. The connector derives the encryption key on your machine; your master password is not sent to Virlow's API.

1. In your client's MCP configuration, add a local server with command npx and arguments -y and virlow-mcp. The command is npx -y virlow-mcp; it fetches and runs the package. Configuration syntax depends on your client.
2. Let the client start the server, then ask it to call unlock. Complete the local browser form opened by the connector: sign in to your Virlow account, complete two-factor authentication if enabled, and enter your master password there.
3. Ask the assistant to call status. Check that the vault is unlocked as the account you intended, then try the read-only example below.

Never put your password in chat, a tool argument or the MCP configuration. The local browser form is the credential-entry path. Do not expose a local HTTP port to the internet as a shortcut to hosted setup.

Use a client that supports remote MCP servers with OAuth. This path does not require the local package. The Hosted AI connector is off by default; enabling it is a separate choice from connecting an app or unlocking a session.

1. In Virlow, open Settings → Security → Hosted AI connector. Read the disclosure, then turn it on only if you accept server-side decryption while the session is unlocked.
2. Add this remote MCP URL in your client's connection settings:

   https://api.virlow.com/api/connector/mcp

   Follow its OAuth sign-in flow. Client menus vary; a client that only accepts local commands cannot use this URL directly.
3. On Virlow's consent screen, check Application, Will send you back to, and the disclosure. Choose Connect only for the app you intended. Client names are supplied by the client, not proof that it is trusted.
4. Connecting does not unlock the session. Ask the assistant to call unlock and open the Virlow unlock page it provides. Enter your master password on that page, never in chat. This sends it to Virlow's server, which derives a key and can decrypt and read your notes while unlocked.
5. Under Lock after idle for, the default is 30 minutes; options extend to 72 hours. Connector activity restarts the idle clock, so this is not a fixed time limit from sign-in. Choose Unlock, then use status to check the session.

If the switch is unavailable or the OAuth flow cannot complete, do not paste credentials into your assistant as a workaround. Use the local path with a compatible client, or stop until the hosted connection can be verified.

Use only a non-sensitive test note, and review tool calls before approving them in your client. Replace the sample title below with your test note's title.

Call status first. If the vault is unlocked, use search_notes to find “Connector test”. Show me the matching titles and ask me which note to read. Only after I confirm, use read_note for that note and summarize it in three bullets. Do not create, update, move, archive, trash, or store memories.

This is a read-only request, not a read-only permission. The connector also has write tools. Use your client's approval controls, and do not treat an instruction in a prompt as an access restriction.

If no results appear, check the account in status, the note's folder and its Expose to MCP setting. Do not broaden access to your whole workspace just to make the test succeed.

Local connector

Ask the assistant to call lock, then status to confirm it reports locked. The standalone local connector also locks after 4 hours of inactivity. To stop using it, remove its MCP entry from your client and stop the running connector process.

Hosted connector

Return to the hosted unlock page and select Lock now. Check that the session is locked. Closing the page is not a substitute for locking, and locking is not the same as revoking a client's connection.

In Settings → Security, use the Disconnect control for the relevant client under Connected apps. To revoke them all, switch off Hosted AI connector and confirm Turn off and disconnect. This disconnects every connected app; each will need to connect again. Check the list after the change. If Virlow reports an error, do not assume access has stopped.

Locking or disconnecting does not erase content already received by an assistant. Its conversation history, logs and retention depend on the client and provider you chose.

Readable content leaves the connector

Even with the local connector, your connected assistant and its provider can receive plaintext note and memory content returned by the tools. Keeping the key on your computer does not keep those tool results there. Your provider's data policies apply; review them before sharing sensitive material.

Folder controls, not a per-note sandbox

Expose to MCP is a folder-level tool access control, not a per-note sandbox or a separate encryption key for each approved note. An exposed parent includes its subfolders. The Memories tree is exempt from folder exposure; memory tools have their own AI memories opt-in. Hiding a note removes it from list and search results, but an exposed hidden note can still be read by exact ID.

Hosted access changes the trust boundary

The hosted server can decrypt your notes while unlocked. Server-side access to the session key is part of that choice, not a zero-knowledge guarantee. A server memory disclosure or operator access to that process can reach the keys of users whose hosted sessions are currently unlocked. A folder filter does not remove this server-side trust.

Other features have other boundaries

Private note titles, bodies and files are encrypted on your device in the ordinary sync flow. Folder names and note tags are readable by the service. Publishing deliberately makes a note's title and content readable to people with its link.

Optional remote code execution is separate from the connector. Running code sends that code to the execution service through Virlow's API; that submission is not end-to-end encrypted against the executor. Do not run code containing secrets just to test a connection.

A compromised device or maliciously modified browser code can also capture information while you use it. Read the full security limits and privacy policy before deciding what belongs in an AI conversation.