Your notes, inside ChatGPT and Claude

Since September 30, coding agents like Codex, Claude Code and Kiro could read your Kada notes. They run a small command-line tool, kada, that you install with one line:

npx -y @kada-app/agent install

That covers people who live in a terminal. Most people don't. They talk to ChatGPT or Claude in a browser or on their iPhone, and those apps cannot run a command. They take one kind of plug-in: a remote server that speaks the Model Context Protocol and signs you in with OAuth.

So as of October 24, Kada has one. The address is:

https://mcp.kadanotes.com/mcp

In Claude, add it as a custom connector. In ChatGPT, add it as an app. Either one sends you to Kada to sign in, shows you what it wants to read, and waits for you to press Authorize. After that you can ask things like "what did I say about the launch on Tuesday?" and it looks it up.

#What an agent can do

The tools are the same as the kada command, one for one:

Tool	What it does
whoami	Which Kada account this is
list_recent_notes	Your newest notes, or the ones since a date
search_notes	Find notes by words in them
get_note	One note: title, summary, clean text
get_transcript	The full transcript, with timestamps if asked
rename_note	Give a note a better title

ChatGPT also wants two tools named search and fetch, so those exist too and point at the same code.

What is missing is on purpose. An agent cannot hear your audio. It cannot delete or move a note, make a recording, or send anything anywhere. The only write is rename, and it is off unless you tick it on the Authorize screen. Recording details, meaning where you were, how you were moving and any health readings, are also unticked by default.

#The Authorize screen

This is the one screen I spent the most time on, because it is where you decide. It shows the app's name and the host it is really coming from. It lists each permission in plain words, with the two riskier ones unticked. It says where your notes go once the agent has read them, and points to that provider's own policy on training. Nothing is granted until you press the button.

You can take it back later in Settings, under Agents & access, then Connected apps. Disconnect ends the agent's access right away.

#Tokens that only open one door

A connected agent gets two tokens. The access token lasts 30 minutes and works only on /mcp. The refresh token is swapped for a new one every time it is used. A used one that comes back within a minute, say a phone and a browser refreshing at once, just gets the same new token again. One that comes back later is treated as stolen: Kada ends the whole connection, the copy stops working, and the real agent has to sign in again.

The walls go both ways. A token made for ChatGPT or Claude never works on the rest of Kada's API. The tokens your kada command uses never work on /mcp. Kada keeps only SHA-256 hashes of all of them, not the tokens themselves.

#Two names for one server

The MCP server lives at mcp.kadanotes.com, but you sign in at app.kadanotes.com. They are the same server today. Two names fix two separate problems.

Sign-in stays on app. because that is where your Kada session cookie already lives. If the Authorize screen were on mcp., a person who is already signed in would be asked to sign in again.

The MCP address got its own name because it is baked into every token as the token's audience. Change that address later and every person would have to remove Kada from ChatGPT and Claude and add it again. With its own name from day one, /mcp can move to its own machine with a DNS change, and nobody has to reconnect.

#No open connections, yet

Each request to /mcp stands alone, and the server keeps no session between them. That is partly taste and partly the host: the edge in front of Kada closes any connection after about 60 seconds. So for now there is no "tell me when a new note arrives". The agent asks, and Kada answers.

#How it was built

The work split cleanly into three parts: the /mcp endpoint, the OAuth server, and the web screens. Three coding agents built them at the same time, each on its own branch. Each branch then got its own review from a second model, Codex, and the merged result got one more. It shipped with 124 end-to-end tests, and I checked both versions of the protocol with the MCP Inspector before turning it on.

The switch is a single setting on the server. Unset it and the routes are gone.

Alex