Caliu Notes MCP — Watchlist

MCP100 Assessment

Watchlist / Tracking

Why we’re tracking it

Follow-up value is specific to Caliu note, reminder, tag and attachment operations: Does the local API-key path retain equivalent account scope to the separately hosted OAuth connector?

Reviewed Oct 5, 2026 · Documentation review; complete setup workflow not independently tested

Best fit

Search, organize and edit personal/team notes with tags, reminders and attachments.

What we know

Hosted-notes MCP adapter for notes, tags, reminders, attachments, backlinks and authenticated profile data, available locally by API key or hosted OAuth.

Maintenance / activity evidence

@caliu-notes/mcp 1.7.3 published 2026-09-13T15:51:12.491Z

Tracking evidence observed Oct 5, 2026. These dated signals do not establish current maintenance. Reviewed enrichment confidence: high.

Verification gaps / watch-outs

Installation and comprehensive security have not been independently audited.
Authenticated notes/attachments/reminders/profile access. Writes: Create/update/delete/restore/archive notes; Change tags/reminders; Upload/delete attachments.
API key or OAuth.
Sensitive access: Private notes, Attachments, Reminders, Account profile

Personal knowledge store with broad mutation and attachment access; use scoped credentials.

Full authority, access and evidence limits are available in Review context and Access & risk.

All limitations / Review context

Does the local API-key path retain equivalent account scope to the separately hosted OAuth connector?

The bounded review of the publisher's documented Caliu note, reminder, tag and attachment operations and release notices identified no disclosed material condition preventing an accurately scoped public tracking entry. The resource's operational permissions remain uncertainty; this assessment does not certify installation safety.

Personal knowledge store with broad mutation and attachment access; use scoped credentials.
Authenticated notes/attachments/reminders/profile access.
API key or OAuth.
Notes, attachments, reminders and tags are sent to Caliu API.
Reviewed write actions: Create/update/delete/restore/archive notes; Change tags/reminders; Upload/delete attachments
Sensitive access: Private notes, Attachments, Reminders, Account profile
Installation, client compatibility and comprehensive security have not been independently audited. Authentication and access depend on the configured services.
Runtime behavior, dependencies and undisclosed vulnerabilities were not independently audited.
Documented tool authority and any remote data handling must be checked before installation or use.
Tool inventory, client matrix and permissions completeness were not requirements for this Radar tracking review.
privacy/retention
pricing
Local mode requires API key.
The package is an API adapter, not a local datastore.
Writes mutate hosted note data.
Privacy/retention/pricing were not established.

Original activity observations

@caliu-notes/mcp 1.7.3 published 2026-09-13T15:51:12.491Z

Technical identity

npm/@caliu-notes/mcp

Exact implementation source: https://www.npmjs.com/package/@caliu-notes/mcp ↗
Reviewed resource type: MCP Server
Repository identity: marctorrelles/caliu
Package identity: npm:@caliu-notes/mcp
Service endpoint: https://api.caliuapp.com/mcp

Evidence & Sources

Evidence basis: Recorded source evidence
Setup runtime verification: Not independently runtime-tested by MCP100 for this setup workflow.

Reviewed Oct 5, 2026 · Latest source observation Oct 8, 2026

Package registry ↗
@caliu-notes/mcp
Recorded package identity, distribution or download evidence.
Includes references whose attribution is not established.
Evidence source ↗
caliuapp.com/docs
Source material retained for this review.
Includes references whose attribution is not established.
GitHub repository ↗
marctorrelles/caliu
Repository reference; implementation attribution is not established for every document.
Includes references whose attribution is not established.

Setup · Watchlist

Install & Agents

Publisher instructions.

Source evidence observed Oct 14, 2026.

Additional setup details required — see the specific gaps below.

Warning

Local stdio JSON with CALIU_API_KEY; Claude web can use hosted https://api.caliuapp.com/mcp with OAuth 2.1 and no npm install.
Never confuse OAuth hosted account sign-in with local API-key config.
Earlier review note retained for provenance; the V3 verified fields take precedence: Targeted 2026-10-13 re-research: Publisher mcpServers stdio example requires CALIU_API_KEY.
Publisher mcpServers stdio example requires CALIU_API_KEY.
MCP100 normalized publisher npm README command/config; placeholders are NOT real secrets; no client/runtime validation.
Prior reviewed safety note: Do not place orders, spend tokens, modify infrastructure or upload confidential files as a test.
Prior reviewed safety note: Do not invent a one-line reversal command.
Earlier review note retained for provenance; the V3 verified fields take precedence: Second-pass 2026-10-14 could not retrieve full current publisher npm README; preserve baseline, do not promote source-specific claims or run commands until documentation is rechecked.
Direct npm README reviewed 2026-10-14; client registration still required.
Client unregister, package uninstall, data deletion, and OAuth/API token/wallet permissions are distinct.

Install / connect
Publisher instructions
Local stdio JSON with CALIU_API_KEY; Claude web can use hosted https://api.caliuapp.com/mcp with OAuth 2.1 and no npm install.
publisher documented mcp stdio launch · Publisher instructions
npx -y @caliu-notes/mcp
Configure / authenticate
MCP100 setup guide
Local MCP: register `npx -y @caliu-notes/mcp` with CALIU_API_KEY. Remote OAuth alternative: add `https://api.caliuapp.com/mcp` as Claude.ai custom connector and complete browser sign-in.
claude desktop or cursor mcpServers json · MCP100 composed guide
{ "mcpServers": { "caliu": { "args": [ "-y", "@caliu-notes/mcp" ], "command": "npx", "env": { "CALIU_API_KEY": "YOUR_CALIU_API_KEY" } } } }
Check connection
Suggested check
After sign-in check visible tools and a read-only notes listing; do not create or edit notes.
Remove / uninstall / revoke
MCP100 setup guide
For a Claude Code registration named `caliu-notes-mcp`, run `claude mcp remove caliu-notes-mcp`; otherwise remove the exact entry in the chosen MCP client settings and restart/reconnect. This client-host removal command is MCP100-composed from Claude Code lifecycle documentation, not a vendor-authored uninstall. With `npx`, a separate global package uninstall normally is unnecessary. Do not delete provider data or credentials by default.
Client unregister, package uninstall, data deletion, and OAuth/API token/wallet permissions are distinct.
Remove client registration · Claude Code only · MCP100 composed guide
claude mcp remove caliu-notes-mcp

Official Documentation & Sources

What it does

Hosted-notes MCP adapter for notes, tags, reminders, attachments, backlinks and authenticated profile data, available locally by API key or hosted OAuth.

Capability: Files & Knowledge
Resource type: MCP Server
Best fit: Search, organize and edit personal/team notes with tags, reminders and attachments.

Representative uses

Search/retrieve notes
Create/update/delete/restore/archive notes
Manage tags/reminders
Upload/get attachments

Limitations

Local mode requires API key.
The package is an API adapter, not a local datastore.
Writes mutate hosted note data.
Privacy/retention/pricing were not established.

Reviewed access

Access & risk

Review the exact access boundary before connecting this MCP to accounts, credentials, or sensitive data.

Authentication: API key or OAuth.
Permissions: Authenticated notes/attachments/reminders/profile access.
Data handling: Notes, attachments, reminders and tags are sent to Caliu API.
Cost: unknown
Risk and cautions: Personal knowledge store with broad mutation and attachment access; use scoped credentials.

Access scope and cautions

Write actions: Create/update/delete/restore/archive notes Change tags/reminders Upload/delete attachments
Sensitive access: Private notes Attachments Reminders Account profile
Risk level: high

FAQ

Based on reviewed evidence as of 2026-10-08. Watchlist tracking is not a recommendation or a security certification.

Which tasks are documented for this implementation?

The reviewed tasks include: Search/retrieve notes; Create/update/delete/restore/archive notes; Manage tags/reminders; Upload/get attachments.

What setup and authentication are documented?

Recorded installation/entrypoint step: npx -y @caliu-notes/mcp. Recorded endpoint: https://api.caliuapp.com/mcp. Recorded transport: stdio, streamable_http. Recorded environment-variable notes: CALIU_API_KEY (local); CALIU_API_URL (optional). No configuration values are supplied here. Prerequisites: Caliu account; MCP client. These are the documented setup details, not a claim that installation or client compatibility was independently tested. Authentication: Local API key or hosted OAuth 2.1.

Can it modify data or perform write operations?

Documented write actions include: Create/update/delete/restore/archive notes; Change tags/reminders; Upload/delete attachments. Recorded permission boundary: Authenticated notes/attachments/reminders/profile access.

What data-handling boundary should I consider?

Notes, attachments, reminders and tags are sent to Caliu API. Recorded sensitive-access context: Private notes; Attachments; Reminders; Account profile.

What limitations and risks should I check before use?

Personal knowledge store with broad mutation and attachment access; use scoped credentials. Local mode requires API key. The package is an API adapter, not a local datastore. Writes mutate hosted note data. Privacy/retention/pricing were not established. Runtime behavior, dependencies and undisclosed vulnerabilities were not independently audited. Documented tool authority and any remote data handling must be checked before installation or use.

Is this an official MCP?

Caliu / marctorrelles is listed as First-party MCP in MCP100’s current evidence.