
Company News
Socket Joins New OpenJS Program to Fund Node.js Security Work
Socket is joining the OpenJS Security Stewardship Program to fund Node.js vulnerability research, maintainer remediation, and security releases.
@ownly-app/mcp
Advanced tools
Local-first MCP server for Ownly evidence and Planner schedules with opt-in, two-phase writes.
Ownly MCP is a local-first MCP server for Ownly ownership, recurring-cost, review, history, and Planner data. It reads the canonical Markdown directly and can perform explicitly enabled, two-phase writes with a safety backup.
--data-dir and OWNLY_DATA_DIR accept either:
Ownly/ data folder; orObjects/ directly.ownly-mcp --data-dir /path/to/vault
ownly-mcp --data-dir /path/to/custom-data-root
The server fails closed when the location is missing, unreadable, or invalid.
Read-only is the default:
npx -y @ownly-app/mcp --data-dir /path/to/vault
Enable persistent mutations explicitly:
npx -y @ownly-app/mcp --data-dir /path/to/vault --allow-write
or set OWNLY_MCP_ALLOW_WRITE=1.
Every mutation has two phases:
ownly_prepare_* tool and inspect its before / after preview.operation_id to ownly_commit_operation.Commit creates a full Ownly backup in the sibling Ownly Backups/ directory before changing data. It rejects stale previews if the target file changed and is idempotent when the same operation ID is retried.
Planner reads canonical Trip Places/, Trip Visits/, and Trip Legs/ facts and exposes the derived execution timeline through ownly_planner_get_trip. Walking, driving, and bicycling leg refresh / travel-time optimization use OpenRouteService from the local MCP process:
OPENROUTESERVICE_API_KEY=your-key npx -y @ownly-app/mcp --data-dir /path/to/vault --allow-write
The key is optional unless an OpenRouteService-backed Planner tool is called. It remains in the local MCP process environment and is never shipped to the static Web/PWA. Public-transit travel time remains an explicit user-verified fact.
Read tools:
ownly_summary, ownly_search, ownly_get_object, ownly_object_historyownly_recurring_costs, ownly_recurring_due, ownly_recurring_by_accountownly_review_needed, ownly_doctorownly_planner_summary, ownly_planner_get_trip, ownly_planner_budget_estimateownly_planner_get_calendar_icsWrite workflow tools:
ownly_prepare_create_object, ownly_prepare_update_objectownly_prepare_retire_object, ownly_prepare_cancel_recurring_costownly_prepare_add_object_log, ownly_prepare_create_reviewownly_prepare_create_snapshotownly_prepare_archive_object, ownly_prepare_restore_objectownly_planner_prepare_add_visit, ownly_planner_prepare_remove_visit, ownly_planner_prepare_reorder_dayownly_planner_prepare_set_stay_span, ownly_planner_prepare_drop_place, ownly_planner_prepare_restore_placeownly_planner_prepare_add_expense, ownly_planner_prepare_set_fx_ratesownly_planner_prepare_set_travel_leg, ownly_planner_prepare_refresh_day_travelownly_planner_prepare_optimize_day_travel_time, ownly_planner_prepare_apply_schedule_proposalownly_commit_operation, ownly_discard_operationThe Ownly source-of-truth stays in the user-controlled local folder. Only facts returned by a requested tool enter the connected MCP client context. Ownly MCP does not create a hosted mirror or send analytics, file paths, or background indexes to Ownly services.
npm ci
npm run test:mcp
npm run build --prefix packages/mcp
node packages/mcp/dist/index.js --help
(cd packages/mcp && npm pack --dry-run)
See ../../docs/MCP.md for setup, safety semantics, and examples.
FAQs
Local-first MCP server for Ownly evidence and Planner schedules with opt-in, two-phase writes.
The npm package @ownly-app/mcp receives a total of 36 weekly downloads. As such, @ownly-app/mcp popularity was classified as not popular.
We found that @ownly-app/mcp demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Company News
Socket is joining the OpenJS Security Stewardship Program to fund Node.js vulnerability research, maintainer remediation, and security releases.

Security News
Two compromised GitHub Actions were re-enabled with malicious tags intact, exposing thousands of downstream repositories to Mini Shai-Hulud.

Research
/Security News
A malicious Firefox extension fetches its payload after installation to evade detection, steal Google session cookies, and automate account takeover.