protogrid
Sign inAdd to your agent

Search / io.github.jordanburke/joplin-mcp-server

joplin-mcp-server

L0· runs locally

Search, read, create, edit and sync Joplin notes and notebooks via a headless Joplin sidecar.

v2.3.3 · active · repository · descriptor JSON · versions

Runs on your machine: something must execute the package.Only local packages are published (npm, PyPI, OCI, …). The registry never executes them, so tools are unknown until you run it.
Quality–not scored
Trust87of 100
Packages1
Tools seen0

Connect

8 clients · secrets stay placeholders
{
  "mcpServers": {
    "joplin-mcp-server": {
      "command": "npx",
      "args": [
        "-y",
        "[email protected]"
      ],
      "env": {
        "JOPLIN_TOKEN": "${JOPLIN_TOKEN}",
        "JOPLIN_SYNC_PASSWORD": "${JOPLIN_SYNC_PASSWORD}"
      }
    }
  }
}
claude mcp add joplin-mcp-server -e "JOPLIN_TOKEN=${JOPLIN_TOKEN}" -e "JOPLIN_SYNC_PASSWORD=${JOPLIN_SYNC_PASSWORD}" -- npx -y [email protected]
[mcp_servers.joplin-mcp-server]
command = "npx"
args = ["-y", "[email protected]"]
env = { "JOPLIN_TOKEN" = "${JOPLIN_TOKEN}", "JOPLIN_SYNC_PASSWORD" = "${JOPLIN_SYNC_PASSWORD}" }

{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "joplin-mcp-server": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "[email protected]"
      ],
      "enabled": true,
      "environment": {
        "JOPLIN_TOKEN": "{env:JOPLIN_TOKEN}",
        "JOPLIN_SYNC_PASSWORD": "{env:JOPLIN_SYNC_PASSWORD}"
      }
    }
  }
}
{
  "mcpServers": {
    "joplin-mcp-server": {
      "command": "npx",
      "args": [
        "-y",
        "[email protected]"
      ],
      "env": {
        "JOPLIN_TOKEN": "${JOPLIN_TOKEN}",
        "JOPLIN_SYNC_PASSWORD": "${JOPLIN_SYNC_PASSWORD}"
      }
    }
  },
  "deeplink": "cursor://anysphere.cursor-deeplink/mcp/install?name=joplin-mcp-server&config=eyJjb21tYW5kIjoibnB4IiwiYXJncyI6WyIteSIsImpvcGxpbi1tY3Atc2VydmVyQDIuMy4zIl0sImVudiI6eyJKT1BMSU5fVE9LRU4iOiIke0pPUExJTl9UT0tFTn0iLCJKT1BMSU5fU1lOQ19QQVNTV09SRCI6IiR7Sk9QTElOX1NZTkNfUEFTU1dPUkR9In19"
}
{
  "servers": {
    "joplin-mcp-server": {
      "type": "stdio",
      "command": "npx",
      "args": [
        "-y",
        "[email protected]"
      ],
      "env": {
        "JOPLIN_TOKEN": "${JOPLIN_TOKEN}",
        "JOPLIN_SYNC_PASSWORD": "${JOPLIN_SYNC_PASSWORD}"
      }
    }
  }
}
{
  "mcpServers": {
    "joplin-mcp-server": {
      "command": "npx",
      "args": [
        "-y",
        "[email protected]"
      ],
      "env": {
        "JOPLIN_TOKEN": "${JOPLIN_TOKEN}",
        "JOPLIN_SYNC_PASSWORD": "${JOPLIN_SYNC_PASSWORD}"
      }
    }
  }
}
extensions:
  "joplin-mcp-server":
    enabled: true
    name: "joplin-mcp-server"
    type: stdio
    cmd: "npx"
    args:
      - "-y"
      - "[email protected]"
    envs:
      "JOPLIN_TOKEN": "${JOPLIN_TOKEN}"
      "JOPLIN_SYNC_PASSWORD": "${JOPLIN_SYNC_PASSWORD}"
    timeout: 300

Placeholders to fill from your own secret store: ${JOPLIN_TOKEN}, ${JOPLIN_SYNC_PASSWORD}. The registry never accepts secret values.

This is a local package: the command runs on your machine.

Quality – / 100not scored

Not scored: fewer than three checks apply, usually because no remote answered a credential-free probe or the server is a local package.

protocoln/a · weight 25
  • n/a
    protocol.modern, protocol.stateless, protocol.transport, protocol.list_ttlno remote answered a protocol handshake (not probed yet, unreachable, or local-only)
authorizationn/a · weight 15
  • n/a
    auth.prm, auth.as_metadata, auth.cimdno remote uses OAuth
  • n/a
    auth.secret_in_urlno templated URL
tool hygienen/a · weight 30
  • n/a
    tools.descriptions, tools.description_length, tools.schemas, tools.annotations, tools.directory_hints, tools.token_cost, tools.api_dumptool list unknown (behind auth, not probed, or empty)
stabilityn/a · weight 15
  • n/a
    stability.changes, stability.rug_pulltool list unknown
dependencies33 · weight 15
  • fail
    deps.known_vulns36 advisories to act on (malicious, or rated high or critical with a fix available): GHSA-7q85-xj36-vmfc in [email protected] (indirect, fixed in 0.6.1), GHSA-8238-w5pm-2374 in [email protected] (indirect, fixed in 0.6.1), GHSA-j5f4-cc29-5x44 in [email protected] (indirect, fixed in 0.6.1), ...; 40 more of lower severity or without a fix
  • fail
    deps.mcp_sdk_version@modelcontextprotocol/client 2.1.0 has 1 known advisory (GHSA-6qxp-vccf-f47h); update @modelcontextprotocol/client to 2.2.0 or later
  • pass
    deps.resolvable[email protected] resolved: 883 packages

Tool list unknown · checked 2026-10-20 18:38 UTC

Tool changes

No tool definition changes recorded. A server's first observation is its baseline; later probes record what changes.

Checks run on what our credential-free, read-only probes observe; tools are never called and no code audit is performed. How it is computed.

Trust 87 / 100

provenance80
livenessn/a
freshness85
hygiene100

+repository +namespace-matches-repo ~liveness-unmeasured ~updated-51d-ago

Derived from observable signals (official registry feed and our own credential-free probes); no code audit performed. How it is computed.

Dependencies

[email protected] npm882 dependencies, resolved · MCP SDK @modelcontextprotocol/sdk 1.30.1 · advisories checked 2026-10-19

advisoryseveritypackagefixed in
GHSA-fjxv-7rqg-78g4form-data uses unsafe random function in form-data for choosing boundarycritical[email protected]indirectfixed in 2.5.4
GHSA-23hp-3jrh-7fpwnode-tar: Decompression/parse DoS via unlimited inputcritical[email protected]indirectfixed in 7.5.19
GHSA-23hp-3jrh-7fpwnode-tar: Decompression/parse DoS via unlimited inputcritical[email protected]indirectfixed in 7.5.19
GHSA-6qxp-vccf-f47hMCP TypeScript SDK: OAuth client could send credentials to an authorization server chosen by the MCP serverhigh@modelcontextprotocol/[email protected]MCP SDK, indirectfixed in 2.2.0
GHSA-6qxp-vccf-f47hMCP TypeScript SDK: OAuth client could send credentials to an authorization server chosen by the MCP serverhigh@modelcontextprotocol/[email protected]MCP SDK, directfixed in 1.31.0
GHSA-7q85-xj36-vmfcadm-zip: Uncontrolled memory allocation via the declared uncompressed size (DoS)high[email protected]indirectfixed in 0.6.1
GHSA-8238-w5pm-2374adm-zip: Unhandled error event in async DEFLATE decompression crashes Node.js process (DoS)high[email protected]indirectfixed in 0.6.1
GHSA-j5f4-cc29-5x44adm-zip extraction preserves SUID/SGID bits from untrusted ZIPs -> local privilege escalationhigh[email protected]indirectfixed in 0.6.1
GHSA-rcw4-f5rp-g42vadm-zip: Decompression-bomb protection (fix for CVE-2026-39244) can be bypassed by declaring uncompressed size as 0high[email protected]indirectfixed in 0.6.1
GHSA-xcpc-8h2w-3j85adm-zip: Crafted ZIP file triggers 4GB memory allocationhigh[email protected]indirectfixed in 0.6.0

68 more advisories in the dependencies endpoint.

Dependency graphs from deps.dev; advisories from OSV.dev, including the GitHub Advisory Database and the PyPI Advisory Database; all CC BY 4.0. The graph is what a clean install of this version resolves today; nothing was installed or run. How it is checked.

Endpoints

packageregistryversionruntimesecrets
joplin-mcp-servernpm2.3.3–JOPLIN_TOKEN, JOPLIN_SYNC_PASSWORD

Tools (0)

No tools observed. Local packages are never executed by the registry.

Schemas: list_tools.

Similar MCP servers

  • Joplin MCP ServerL0
    io.github.alondmnt/joplin-mcp

    FastMCP server exposing Joplin notes, notebooks, tags, and imports.

  • Listen NotesR0
    io.github.pipeworx-io/listen-notes

    Listen Notes MCP.

  • simplenote-mcpL0
    io.github.Automattic/simplenote-mcp

    MCP server for reading Simplenote notes across macOS, Linux, and Windows

  • sonicaura-mcpR0quality 79
    io.github.warmcoding/sonicaura-mcp

    Remote MCP server for audio stem separation, denoise, and reverb.

  • mcp-gee-sweetL0
    io.github.khuisman/mcp-gee-sweet

    MCP server for Google Workspace — Sheets, Drive, Docs (HTML or Markdown), Calendar, and Gmail.

  • mcp-notes-serverL0
    io.github.bradraylucas-eng/mcp-notes-server

    Tiny local MCP notes server in Python: create, list, and search notes stored in a local JSON file.

More from io.github.jordanburke

  • dokploy-mcp-serverL0
    io.github.jordanburke/dokploy-mcp-server

    Dokploy MCP server: manage apps, Docker Compose, databases, domains, backups, and servers.

  • oura-ring-mcp-serverL0
    io.github.jordanburke/oura-ring-mcp-server

    Oura Ring MCP server for the Oura API v2: sleep, readiness, activity, heart rate, and more.

  • reddit-mcp-serverL0
    io.github.jordanburke/reddit-mcp-server

    Reddit MCP server with full read/write - posts, comments, search, and content creation.

  • ssh-client-mcp-serverL0
    io.github.jordanburke/ssh-client-mcp-server

    MCP server for executing shell commands on remote hosts via SSH.

Official server.json
{
  "name": "io.github.jordanburke/joplin-mcp-server",
  "$schema": "https://static.modelcontextprotocol.io/schemas/2025-12-11/server.schema.json",
  "version": "2.3.3",
  "packages": [
    {
      "version": "2.3.3",
      "transport": {
        "type": "stdio"
      },
      "identifier": "joplin-mcp-server",
      "registryType": "npm",
      "environmentVariables": [
        {
          "name": "JOPLIN_TOKEN",
          "format": "string",
          "isSecret": true,
          "description": "Joplin API token, for external mode only (see JOPLIN_HOST). Sidecar mode manages its own token and ignores this."
        },
        {
          "name": "JOPLIN_HOST",
          "format": "string",
          "description": "Connect to an existing Joplin instance at this host instead of running a sidecar"
        },
        {
          "name": "JOPLIN_PORT",
          "format": "string",
          "description": "Port of the existing Joplin instance (default: 41184)"
        },
        {
          "name": "JOPLIN_PROFILE",
          "format": "string",
          "description": "Joplin data directory for sidecar mode (default: ~/.config/joplin-mcp)"
        },
        {
          "name": "JOPLIN_CLI",
          "format": "string",
          "description": "Path to the joplin CLI binary, overriding auto-detection"
        },
        {
          "name": "JOPLIN_SYNC_TARGET",
          "format": "string",
          "description": "Sync target: none, filesystem, webdav, nextcloud, joplin-cloud, joplin-server, s3, dropbox, onedrive (default: none)"
        },
        {
          "name": "JOPLIN_SYNC_PATH",
          "format": "string",
          "description": "Sync target URL or path; the bucket name for the s3 target"
        },
        {
          "name": "JOPLIN_SYNC_USERNAME",
          "format": "string",
          "description": "Sync username or email; the access key for the s3 target"
        },
        {
          "name": "JOPLIN_SYNC_PASSWORD",
          "format": "string",
          "isSecret": true,
          "description": "Sync password; the secret key for the s3 target"
        },
        {
          "name": "JOPLIN_SYNC_REGION",
          "format": "string",
          "description": "S3 region (default: us-east-1)"
        },
        {
          "name": "JOPLIN_SYNC_ENDPOINT",
          "format": "string",
          "description": "S3 endpoint URL for non-AWS providers such as Backblaze B2, MinIO, R2 or Wasabi (default: https://s3.amazonaws.com/)"
        },
        {
          "name": "JOPLIN_SYNC_FORCE_PATH_STYLE",
          "format": "string",
          "description": "Use path-style S3 URLs, which self-hosted providers such as MinIO usually require: true or false (default: false)"
        },
        {
          "name": "LOG_LEVEL",
          "format": "string",
          "description": "Log verbosity: debug, info, warn or error (default: info)"
        }
      ]
    }
  ],
  "repository": {
    "url": "https://github.com/jordanburke/joplin-mcp-server",
    "source": "github"
  },
  "description": "Search, read, create, edit and sync Joplin notes and notebooks via a headless Joplin sidecar."
}