		@@ -5,3 +5,3 @@ {
		"display_name": "BrainLLM",
		"version": "10.5.2",
		"version": "11.0.0",
		"description": "Turns TriliumNext Notes into a persistent, graph-structured second brain for Claude and other LLM clients.",
		@@ -8,0 +8,0 @@ "long_description": "BrainLLM is an MCP server that organises memory into five purpose-built areas (Master, LLM, Memory, Knowledge, Insights). The model supplies content while the server owns placement, format, lifecycle, dates and backups. Includes a full raw ETAPI surface for advanced use. Requires a running TriliumNext instance and the Bun runtime.",

+1

-1

package.json

		{
		"name": "brainllm",
		"version": "10.5.2",
		"version": "11.0.0",
		"mcpName": "io.github.miisodev/brainllm",
		@@ -5,0 +5,0 @@ "description": "MCP server that turns TriliumNext Notes into a persistent, graph-structured second brain for Claude and other LLM clients.",

+10

-6

README.md

		@@ -13,3 +13,3 @@ <div align="center">

		[![Version](https://img.shields.io/badge/version-10.5.2-f59e0b?style=flat-square)](https://github.com/miisodev/BrainLLM/releases)
		[![Version](https://img.shields.io/badge/version-11.0.0-f59e0b?style=flat-square)](https://github.com/miisodev/BrainLLM/releases)
		[![CI](https://img.shields.io/github/actions/workflow/status/miisodev/BrainLLM/ci.yml?branch=main&style=flat-square&label=CI&color=f59e0b)](https://github.com/miisodev/BrainLLM/actions/workflows/ci.yml)
		@@ -228,3 +228,3 @@ [![License: MIT](https://img.shields.io/badge/license-MIT-a1a1aa?style=flat-square)](./LICENSE)

		The HTTP connector serves a streamable-HTTP MCP endpoint at `/mcp` (one session per `mcp-session-id`, DELETE terminates, CORS-enabled with `mcp-session-id` exposed for browser clients) plus `GET /health`. The server itself speaks plain HTTP — TLS is expected to terminate in front of it (Railway's edge does this automatically for you; on a bare VPS or your own Docker host, put it behind a reverse proxy such as Caddy, nginx, or a Cloudflare Tunnel). Set `MCP_AUTH_TOKEN` on any deployment reachable outside a trusted network — CORS defaults to `*`, so without a token any client that can reach the endpoint can call your Trilium brain. Idle sessions are evicted after 1 hour; request bodies are capped at 50 MB.
		The HTTP connector serves a streamable-HTTP MCP endpoint at `/mcp` (one session per `mcp-session-id`, DELETE terminates, CORS-enabled with `mcp-session-id` exposed for browser clients), a legacy SSE endpoint at `/sse` (with `POST /messages`) for clients that predate streamable HTTP — older Cursor builds, Continue, and Python-SDK clients — and `GET /health`. The server root serves a plain page naming the endpoints, so a human or probing client landing on the origin sees what lives there. The server itself speaks plain HTTP — TLS is expected to terminate in front of it (Railway's edge does this automatically for you; on a bare VPS or your own Docker host, put it behind a reverse proxy such as Caddy, nginx, or a Cloudflare Tunnel). Set `MCP_AUTH_TOKEN` on any deployment reachable outside a trusted network — CORS defaults to `*`, so without a token any client that can reach the endpoint can call your Trilium brain. Idle sessions are evicted after 1 hour; request bodies are capped at 50 MB. Both transports sit behind the same authentication gate.

		@@ -243,6 +243,9 @@ ### Docker / Railway

		### Connecting claude.ai (OAuth)
		### Connecting remote clients (OAuth)

		Claude Code and `mcp-remote` send `MCP_AUTH_TOKEN` as a header and need nothing further. The hosted Claude surfaces — claude.ai, Claude mobile, Cowork — cannot. Their custom-connector UI offers OAuth or nothing; there is no field for a bearer token. So BrainLLM ships its own OAuth 2.1 authorization server, using [Client ID Metadata Documents](https://modelcontextprotocol.io/specification/2026-07-28/basic/authorization) — the registration-free mechanism MCP's `2026-07-28` revision adopted in place of Dynamic Client Registration.
		Claude Code and `mcp-remote` send `MCP_AUTH_TOKEN` as a header and need nothing further. The hosted Claude surfaces — claude.ai, Claude mobile, Cowork — cannot. Their custom-connector UI offers OAuth or nothing; there is no field for a bearer token. So BrainLLM ships its own OAuth 2.1 authorization server. It serves both registration mechanisms, so every OAuth-capable client works:

		- Client ID Metadata Documents (CIMD) — the registration-free mechanism MCP's `2026-07-28` revision adopted; this is what Claude selects.
		- Dynamic Client Registration (RFC 7591) — for clients that never grew CIMD support. opencode (MCP TS SDK ≤1.29) is the forcing case: without a `registration_endpoint` it refuses to authenticate at all.

		Set one variable to turn it on:
		@@ -263,5 +266,6 @@
		\| `/.well-known/oauth-protected-resource` (+ `/mcp` variant) \| RFC 9728 — names the authorization server \|
		\| `/.well-known/oauth-authorization-server` \| RFC 8414 — advertises CIMD support and PKCE S256 \|
		\| `/authorize` \| Validates the client's metadata document, shows the consent screen \|
		\| `/.well-known/oauth-authorization-server` (+ `/mcp` variant) \| RFC 8414 — advertises CIMD support, DCR, and PKCE S256 \|
		\| `/authorize` \| Validates the client (CIMD document or registered id), shows the consent screen \|
		\| `/token` \| PKCE-verified code exchange, with rotating refresh tokens \|
		\| `/register` \| RFC 7591 dynamic client registration — how opencode and other DCR-only clients connect \|

		@@ -268,0 +272,0 @@ Both credentials work simultaneously — a static token from Claude Code and an OAuth token from claude.ai, against the same brain. Access tokens are signed JWTs bound to your server's resource URI, so a token minted for a different MCP server is rejected; the signing secret and refresh tokens persist beside `brainllm.json`, which on a container deploy means putting `BRAINLLM_CONFIG` on a volume — otherwise every redeploy invalidates every token.

+2

-2

server.json

		@@ -5,3 +5,3 @@ {
		"description": "Persistent graph-structured memory for LLMs in TriliumNext Notes — readable and editable by humans.",
		"version": "10.5.2",
		"version": "11.0.0",
		"websiteUrl": "https://github.com/miisodev/BrainLLM#readme",
		@@ -16,3 +16,3 @@ "repository": {
		"identifier": "brainllm",
		"version": "10.5.2",
		"version": "11.0.0",
		"transport": {
		@@ -19,0 +19,0 @@ "type": "stdio"

dist/index.js

Sorry, the diff of this file is too big to display

skills/brainllm/SKILL.md

Sorry, the diff of this file is too big to display

		@@ -13,3 +13,3 @@ <div align="center">

		[![Version](https://img.shields.io/badge/version-10.5.2-f59e0b?style=flat-square)](https://github.com/miisodev/BrainLLM/releases)
		[![Version](https://img.shields.io/badge/version-11.0.0-f59e0b?style=flat-square)](https://github.com/miisodev/BrainLLM/releases)
		[![CI](https://img.shields.io/github/actions/workflow/status/miisodev/BrainLLM/ci.yml?branch=main&style=flat-square&label=CI&color=f59e0b)](https://github.com/miisodev/BrainLLM/actions/workflows/ci.yml)
		@@ -228,3 +228,3 @@ [![License: MIT](https://img.shields.io/badge/license-MIT-a1a1aa?style=flat-square)](./LICENSE)

		The HTTP connector serves a streamable-HTTP MCP endpoint at `/mcp` (one session per `mcp-session-id`, DELETE terminates, CORS-enabled with `mcp-session-id` exposed for browser clients) plus `GET /health`. The server itself speaks plain HTTP — TLS is expected to terminate in front of it (Railway's edge does this automatically for you; on a bare VPS or your own Docker host, put it behind a reverse proxy such as Caddy, nginx, or a Cloudflare Tunnel). Set `MCP_AUTH_TOKEN` on any deployment reachable outside a trusted network — CORS defaults to `*`, so without a token any client that can reach the endpoint can call your Trilium brain. Idle sessions are evicted after 1 hour; request bodies are capped at 50 MB.
		The HTTP connector serves a streamable-HTTP MCP endpoint at `/mcp` (one session per `mcp-session-id`, DELETE terminates, CORS-enabled with `mcp-session-id` exposed for browser clients), a legacy SSE endpoint at `/sse` (with `POST /messages`) for clients that predate streamable HTTP — older Cursor builds, Continue, and Python-SDK clients — and `GET /health`. The server root serves a plain page naming the endpoints, so a human or probing client landing on the origin sees what lives there. The server itself speaks plain HTTP — TLS is expected to terminate in front of it (Railway's edge does this automatically for you; on a bare VPS or your own Docker host, put it behind a reverse proxy such as Caddy, nginx, or a Cloudflare Tunnel). Set `MCP_AUTH_TOKEN` on any deployment reachable outside a trusted network — CORS defaults to `*`, so without a token any client that can reach the endpoint can call your Trilium brain. Idle sessions are evicted after 1 hour; request bodies are capped at 50 MB. Both transports sit behind the same authentication gate.

		@@ -243,6 +243,9 @@ ### Docker / Railway

		### Connecting claude.ai (OAuth)
		### Connecting remote clients (OAuth)

		Claude Code and `mcp-remote` send `MCP_AUTH_TOKEN` as a header and need nothing further. The hosted Claude surfaces — claude.ai, Claude mobile, Cowork — cannot. Their custom-connector UI offers OAuth or nothing; there is no field for a bearer token. So BrainLLM ships its own OAuth 2.1 authorization server, using [Client ID Metadata Documents](https://modelcontextprotocol.io/specification/2026-07-28/basic/authorization) — the registration-free mechanism MCP's `2026-07-28` revision adopted in place of Dynamic Client Registration.
		Claude Code and `mcp-remote` send `MCP_AUTH_TOKEN` as a header and need nothing further. The hosted Claude surfaces — claude.ai, Claude mobile, Cowork — cannot. Their custom-connector UI offers OAuth or nothing; there is no field for a bearer token. So BrainLLM ships its own OAuth 2.1 authorization server. It serves both registration mechanisms, so every OAuth-capable client works:

		- Client ID Metadata Documents (CIMD) — the registration-free mechanism MCP's `2026-07-28` revision adopted; this is what Claude selects.
		- Dynamic Client Registration (RFC 7591) — for clients that never grew CIMD support. opencode (MCP TS SDK ≤1.29) is the forcing case: without a `registration_endpoint` it refuses to authenticate at all.

		Set one variable to turn it on:
		@@ -263,5 +266,6 @@
		\| `/.well-known/oauth-protected-resource` (+ `/mcp` variant) \| RFC 9728 — names the authorization server \|
		\| `/.well-known/oauth-authorization-server` \| RFC 8414 — advertises CIMD support and PKCE S256 \|
		\| `/authorize` \| Validates the client's metadata document, shows the consent screen \|
		\| `/.well-known/oauth-authorization-server` (+ `/mcp` variant) \| RFC 8414 — advertises CIMD support, DCR, and PKCE S256 \|
		\| `/authorize` \| Validates the client (CIMD document or registered id), shows the consent screen \|
		\| `/token` \| PKCE-verified code exchange, with rotating refresh tokens \|
		\| `/register` \| RFC 7591 dynamic client registration — how opencode and other DCR-only clients connect \|

		@@ -268,0 +272,0 @@ Both credentials work simultaneously — a static token from Claude Code and an OAuth token from claude.ai, against the same brain. Access tokens are signed JWTs bound to your server's resource URI, so a token minted for a different MCP server is rejected; the signing secret and refresh tokens persist beside `brainllm.json`, which on a container deploy means putting `BRAINLLM_CONFIG` on a volume — otherwise every redeploy invalidates every token.

brainllm - npm Package Compare versions

Improved metrics