KnowNote's MCP server has no write tool on purpose

The install instructions start by warning you the build is unsigned

Most projects bury this. KnowNote puts it in the quick start, in bold: the builds are unsigned, there is no Apple Developer ID certificate in the packaging pipeline, so macOS refuses to launch the app on first run and Windows SmartScreen flags the installer. The README is explicit that neither warning means the download is broken, that both are one-time prompts, and that the steps to clear them are given. On macOS that means opening the .dmg, dragging KnowNote into Applications, and running one command once:

sudo xattr -rd com.apple.quarantine /Applications/KnowNote.app

Without it macOS reports that KnowNote is damaged and cannot be opened, or that Apple cannot check it for malicious software. The README adds a constraint on that command: run it only on an app taken from the repository's Releases page. On Windows the equivalent is choosing More info and Run anyway when SmartScreen shows Windows protected your PC. Platform coverage is narrow and stated in the same section: no Linux build exists, the macOS build is Apple Silicon only, and Intel Macs are not built at the moment. The last push to main was on 2026-09-28, the same day as the v1.5.0 tag, following v1.4.0 and v1.3.0 in the days before it.

Local means local, and the boundary is stated precisely

The application is a desktop program rather than a self-hosted stack: no Docker, no server, no account. Parsing, splitting, embedding and vector search all run inside the app, and the only thing that leaves the machine is the request sent to the model endpoint you configured. If that endpoint is a local server such as Ollama, the README says nothing leaves at all. That is a specific claim with a specific escape hatch, and the model side is bring-your-own: any OpenAI-, Anthropic- or Google-compatible endpoint, with no bundled chat model and no account anywhere in the flow. First run confirms the shape: nothing is configured out of the box, you open Settings, add at least one model connection under Models, and only then start asking questions. Notebooks, notes and embeddings stay local in every case.

Provenance is structural, not a post-hoc citation list

The retrieval path is built around the idea that an answer should be checkable. Text is split into passages of roughly 500 characters with about 50 characters of overlap, and each passage records its start and end offset in the extracted text. That offset is the mechanism behind the citations: an answer keeps the passages it was built from together with where each passage sat in the extracted text, so a claim points at a passage rather than at a file. Parsing preserves structure rather than flattening it, with pdfjs-dist for PDF, mammoth for Word, officeparser for PowerPoint and turndown for web pages, and each format keeping what it has, meaning page boundaries, headings and slides. A note on why that matters: a citation that says page 4 is useful, and a citation that says somewhere in this file is not. The application also keeps notes and mind maps beside the sources, so a conclusion you reached is stored next to the documents that produced it.

The agent surface is read-only by construction

KnowNote can serve a notebook to a local agent over MCP on stdio, read-only, so a coding agent can search the documents you already have rather than being handed pasted text. The client configuration is short:

{
  "mcpServers": {
    "knownote": {
      "command": "/path/to/knownote",
      "args": ["--mcp"]
    }
  }
}

Five tools are exposed: list_notebooks, search_notebook, get_source, read_document and search_notes. search_notebook returns passages with provenance, meaning a document id, a page and character offsets, rather than bare text, so a claim an agent makes can be checked. The security argument is in the README and it is specific: there is no write tool, no tool that calls a model, and no result that reports a filesystem path. That is what makes the surface safe to grant to an agent reading untrusted documents, since an agent cannot be persuaded by document contents to write a file or exfiltrate a path. By default the server uses the same library as the desktop app, and a different profile is selected with the KNOWNOTE_DATA_DIR environment variable.

The embedder is pinned, quantized and runs in the main process

The embedding model is specified tightly, which is the right way to keep a local vector store reproducible. It is Xenova/multilingual-e5-small running through ONNX in the Electron main process, at 384 dimensions, in q8 quantization, with the revision pinned and remote model loading disabled. It downloads once on demand and caches on disk. Three properties of that sentence matter. Multilingual means non-English documents embed properly rather than being approximated. Pinned revision plus disabled remote loading means the vectors in your library stay comparable over time, because a model that silently changes would invalidate every stored embedding. And q8 is a deliberate size and speed trade that costs some accuracy in exchange for running inside a desktop process without a GPU. Storage is SQLite with sqlite-vec accessed through Drizzle ORM.

One vector table per notebook avoids mixing embedding spaces

Each notebook gets its own vector table carrying its own width, and the stated reason is that vectors produced by different embedding spaces are never compared. That is a small design decision with a large consequence for a knowledge base: because a notebook's vectors live in a table sized for the model that produced them, a notebook built with one embedding space cannot be silently queried against another, and a change of model cannot produce nonsense results by matching across incompatible dimensions. Storage is SQLite through Drizzle ORM with sqlite-vec, so the whole knowledge base is files in a directory rather than a service, which follows from the local-first framing. The interface is a three-column layout of Knowledge Library, AI Q&A and Note Output, built on Electron with React, TypeScript and TailwindCSS bundled by electron-vite, with Tiptap as the note editor.

Where KnowNote is the wrong choice

Four cases. The first is a team or a household. There are no accounts, no sync and no collaboration, and the README describes the product as a single-user desktop tool, so two people editing the same notebook is not a scenario it supports. The second is Linux. There is no Linux build, which is a one-line answer to an evaluation question rather than a gap to work around. The third is anyone who needs the model and the documents to stay inside an organization boundary with a supported contract. The model endpoint is yours to choose, which is good, but the application itself is an unsigned binary you are told to strip the quarantine flag from, and for a regulated environment that combination needs an answer before it needs a feature comparison. The fourth is audio and generated artifacts. Audio upload and transcription, quiz generation and slide generation are listed as in development and explicitly absent from any published buildelease, so if your study material is recorded lectures rather than documents, this does not do that yet.

Editorial conclusion

KnowNote suits a single person who wants to question their own documents with citations, keep everything on their own machine, and let an agent read the same library read-only over MCP. It does not suit a team needing accounts, sync or collaboration, and not a Linux user. Before adopting, download the build for your platform, clear the macOS quarantine flag or the Windows SmartScreen prompt exactly as documented, and configure one model endpoint in Settings before anything else will answer a question.

Frequently asked questions

Official sources

1. License: GPL-3.0
2. mrsibe/KnowNote on GitHub
3. Project website
4. README
5. Releases