Letting an AI agent use your vault

Pellet can open a small connection on your own computer that lets an AI assistant or a script work with your notes, tasks and calendar.

It is off until you turn it on, and it never leaves your machine.

The connection speaks MCP, a standard several AI tools already know, so what you point at it is your choice. Everything in this picture is on your own computer: the tool, the connection and your files. Nothing is sent to us or to anyone else.

What this is for

Things like: “add these six tasks from the meeting notes”, “find every note mentioning the Monterrey site and summarize them”, “make a task for each unticked checkbox in this week’s dailies”, “what’s overdue that I haven’t skipped?”.

Work that’s tedious by hand and easy to describe.

Turning it on

Settings → AI & MCP. You get an address to give to the tool you’re using, and optionally a token it must present.

Some tools connect to an address; others want to launch a command instead. Settings shows you both — copy whichever your tool asks for.

Underneath them is a Status line. If it says Not running, it tells you why — almost always that something else already has the port, in which case change the port number and it’ll come straight up. (If you also run the Obsidian task-manager plugin, note that it listens on 27123, which is why Pellet defaults to 27124.)

It needs a license

While Pellet is unlicensed — the trial has run out and no key is in — the server doesn’t listen at all. A tool pointed at the address gets connection-refused, which is the honest answer: better than a server that connects and then fails every write.

The Status line reads License required, and nothing you configured is lost. Your port, your token and your per-operation switches are all kept, and the server comes back the moment a key goes in. No relaunch. See Trial and license.

What it can reach

Around fifty operations, and the list grows. The ones you’ll notice:

• Tasks — list, read, create, update, delete, complete. Completing understands repeats, so an agent finishing a recurring task does the right thing rather than just ticking it.
• Search — real search inside your note bodies, not just titles. Plus the same question-asking the Table does: what’s overdue, what’s due this week, what’s due in the next ten days.
• Notes — list, read, create, update, delete, rename, tags. Reading a note gives its content plus what links to it.
• Boards, subtasks and checklists — including turning a loose - [ ] line into a real task.
• Your calendar — list, create, change and delete events, across the accounts you’ve connected.
• Daily notes, templates, the archive and the trash — including restoring something an agent deleted by mistake.
• Attachments and canvases — read a file, write one, add cards to a board and join them up.

There’s also a read-only view of device sync status, and deliberately nothing that can change a sync setting.

Deciding what it may do

You don’t have to hand over the whole vault. Three switches in Settings → AI & MCP:

• Read-only — the agent can read everything and change nothing. Writing operations aren’t just refused, they’re hidden, so it won’t waste your time planning around them.
• Folder allowlist — name the folders it may use, and everything else becomes invisible to it. Not merely unwritable: notes outside those folders don’t appear in its searches or listings at all.
• Per-operation switches — turn off anything you’d rather it never did. Deleting notes, say, or touching your calendar.

All three start off, so a connection you’ve already set up keeps working exactly as it did.

The safety of it

• It only listens to your own computer. Nothing on the internet can reach it — not with the address, not with the token.
• You can require a token, so other software on your machine can’t use it by accident. The token is kept in your operating system’s keychain, not in your vault.
• It’s off by default, and switching it off closes it immediately.
• Deleting goes to Pellet’s trash, not to nowhere — see the trash to put something back.
• Your file history still applies, so an agent overwriting a note leaves a version you can return to.

Desktop only

iOS doesn’t let an app listen for connections, so this exists on macOS, Windows and Linux only.