
Security News
Axios Maintainer Confirms Social Engineering Attack Behind npm Compromise
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.
remnote-bridge
Advanced tools
Bridge toolkit that exposes your RemNote knowledge base to AI agents. Single package — CLI, MCP Server, and Plugin all in one.
npm install -g remnote-bridge
One step to connect, then let AI guide you through the rest.
npx skills add baobao700508/unofficial-remnote-bridge-cli -s remnote-bridge
Add the following to your AI client's MCP settings:
{
"mcpServers": {
"remnote-bridge": {
"command": "remnote-bridge",
"args": ["mcp"]
}
}
}
Tip: Install both for best results. MCP documentation is kept concise (loaded all at once), while Skill documentation is detailed (loaded on demand). Together they complement each other. That said, either one works independently — you don't need both.
Once connected, the AI will guide you through connecting to RemNote, loading the plugin, and everything else.
Recommended for daily use — you control when to load and unload the plugin.
# 1. Start the daemon (launches WS server + plugin server)
remnote-bridge connect
# 2. Load the plugin in RemNote
# Open RemNote → Plugins → Develop Your Plugin
# Enter: http://localhost:8080
# 3. Check system status
remnote-bridge health
# 4. Explore your knowledge base
remnote-bridge read-globe # Global document overview
remnote-bridge read-context # Current page context in RemNote
remnote-bridge search "machine learning" # Full-text search
remnote-bridge read-tree <remId> # Expand a subtree
remnote-bridge read-rem <remId> # Read Rem properties
# 5. Edit content
remnote-bridge edit-rem <remId> --changes '{"text":["new text"]}'
remnote-bridge edit-tree <remId> --old-str ' old line <!--id-->' --new-str ' new line\n old line <!--id-->'
# 6. Stop the daemon
remnote-bridge disconnect
Zero human intervention after initial setup — use only for fully automated workflows.
# 1. One-time: login to RemNote in Chrome (saves credentials)
remnote-bridge setup
# 2. Auto-connect with headless Chrome (no browser window needed)
remnote-bridge connect --headless
# 3. Verify all layers are ready
remnote-bridge health
# 4. Use any command — done!
remnote-bridge search "machine learning"
| Command | Description |
|---|---|
setup | Launch Chrome for RemNote login, save credentials for headless mode |
connect | Start the daemon (--headless for auto Chrome, default requires manual plugin load) |
health | Check daemon/Plugin/SDK status (--diagnose for screenshots, --reload to restart Chrome) |
disconnect | Stop the daemon and release resources |
clean | Remove all residual files (.pid / .log / .json / skill dirs) |
| Command | Description | Caches |
|---|---|---|
read-globe | Global document-level overview | No |
read-context | Current page/focus context view | No |
read-tree <remId> | Subtree as Markdown outline | Yes |
read-rem <remId> | Single Rem's full JSON properties | Yes |
read-rem-in-tree <remId> | Subtree outline + all Rem objects in one call | Yes |
search <query> | Full-text search | No |
| Command | Description | Prerequisite |
|---|---|---|
edit-rem <remId> | Directly modify Rem fields (text, backText, type, etc.) | read-rem first |
edit-tree <remId> | Edit tree structure via str_replace | read-tree first |
| Command | Description |
|---|---|
mcp | Start the MCP Server (stdio transport) |
install skill | Install AI agent skill (via Vercel Skills) |
addon list|install|uninstall | Manage addon projects (e.g. remnote-rag) |
Use remnote-bridge mcp as an MCP server for AI clients:
{
"mcpServers": {
"remnote-bridge": {
"command": "remnote-bridge",
"args": ["mcp"]
}
}
}
The MCP server exposes all CLI commands as tools. Documentation is inlined into tool descriptions and server instructions (no separate resources).
The Skill provides detailed instructions (SKILL.md + 11 command docs) that teach AI agents how to use remnote-bridge — including command selection, workflows, safety rules, and flashcard operations.
Powered by the Vercel Skills ecosystem. Supports 40+ AI coding tools including Claude Code, Cursor, Windsurf, GitHub Copilot, Cline, and more.
# Direct — interactive agent selection
npx skills add baobao700508/unofficial-remnote-bridge-cli -s remnote-bridge
# Or through the built-in wrapper (same interactive experience)
remnote-bridge install skill
The interactive installer will detect your installed AI tools and let you choose which ones to install the skill for.
If npx is not available, or you prefer manual installation:
remnote-bridge install skill --copy
This copies the skill files directly to ~/.claude/skills/remnote-bridge/.
<agent-skills-dir>/remnote-bridge/
├── SKILL.md # Core skill — command decisions, workflows, safety rules
└── instructions/ # Detailed per-command documentation
├── overall.md # Global overview
├── connect.md # connect command
├── read-tree.md # read-tree command
├── edit-tree.md # edit-tree command
└── ... # 8 more command docs
All commands support --json for programmatic usage. In JSON mode, both input and output are JSON:
# Input: all parameters packed in a JSON string
remnote-bridge --json read-rem '{"remId":"abc123","fields":["text","type"]}'
# Output: single-line JSON
# {"ok":true,"command":"read-rem","timestamp":"...","data":{...}}
Run multiple daemon instances in parallel (e.g. different knowledge bases):
# Named instances
remnote-bridge --instance work connect
remnote-bridge --instance personal connect
# Headless shorthand
remnote-bridge --headless connect # equivalent to --instance headless
# Commands auto-route to the right instance
remnote-bridge --instance work search "project notes"
Instances are managed via a global registry at ~/.remnote-bridge/. Each instance gets its own port allocation, PID file, and log file.
AI Agent (Claude Code / MCP Client)
↕ CLI commands (stateless short processes)
remnote-bridge CLI
↕ WebSocket IPC
Daemon (long-lived process: WS server + handlers + cache)
↕ WebSocket
remnote-plugin (runs inside RemNote browser or headless Chrome)
↕
RemNote SDK → Knowledge Base
Optional config file: .remnote-bridge.json in project root.
{
"wsPort": 3002,
"devServerPort": 8080,
"configPort": 3003,
"daemonTimeoutMinutes": 30,
"defaults": {
"maxNodes": 200,
"maxSiblings": 20,
"readTreeDepth": 3
}
}
All values have sensible defaults — the config file is not required.
This project was inspired by and learned from:
Addon projects extend remnote-bridge with additional capabilities:
| Addon | Description |
|---|---|
| remnote-rag | Semantic search via ChromaDB + DashScope embeddings |
| remnote-chat | Chat interface for RemNote knowledge base |
# List available addons
remnote-bridge addon list
# Install an addon
remnote-bridge addon install remnote-rag
# Uninstall (--purge to remove data)
remnote-bridge addon uninstall remnote-rag --purge
edit_rem concurrency detection now classifies field differences into three tiers: semantic fields (text/type/tags etc.) → hard reject; parent → pass with ⚠️ parent has changed warning; metadata (position/timestamps etc.) → pass with ℹ️ Metadata fields changed warning. This eliminates false positives after edit_tree move/reorder operationsedit-tree now accepts 2.~9. prefixes for ordered lists, auto-normalizes to isListItem=true, and returns templateWarnings to remind agents to use 1. (Lazy Numbering). 10. and above are not matched (kept as plain text)edit-tree command now correctly includes templateWarnings in JSON output (was silently dropped).sort() from ID arrays in RemObject serialization that caused spurious concurrency conflicts in edit-remread-rem omits default-value fields by default, reducing token usage; use --full for complete output--changes flag)--instance <name> flag, global registry at ~/.remnote-bridge/, parallel daemonsaddon list|install|uninstall commands for managing extension projects (remnote-rag, remnote-chat)children moved from default to full mode (read-rem --full)setup + connect --headless + health --diagnose/--reload for zero-intervention workflowsedit-treeclean command for removing residual filesread-context prompt enhancementsnpx skills add ...)connect user guidance improvementsfiles whitelist)remnote-bridge packageconnect, disconnect, health, read-rem, edit-rem, read-tree, edit-tree, read-globe, read-context, searchMIT
FAQs
RemNote 自动化桥接工具集:CLI + MCP Server + Plugin
We found that remnote-bridge demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.

Security News
The Axios compromise shows how time-dependent dependency resolution makes exposure harder to detect and contain.