inode

README

inode is a command-line knowledge base for the things engineers keep losing: API keys, passwords, tokens, commands, runbooks. You save it in plain text and later ask for it in plain English. inode finds it by meaning (vector search) and answers only from what you stored. By default it runs on your machine with Ollama and SQLite: no API keys, no account.

$ inode add "staging DB creds: vault write database/rotate-root/staging"
  category=runbooks  tags=[vault, postgres, staging]  sensitive=true
  saved  id=a1b2c3d4
$ inode get "how do I rotate staging db creds"
Run vault write database/rotate-root/staging, then restart the api.

── Sources (1) ──
  #a1b2c3d4  Rotate staging DB creds  [runbooks] [vault, postgres, staging]  [sensitive]

---

What it does

• Ask in plain English. inode get turns your question into an embedding, finds the closest stored items, and has the LLM answer from them, listing them as sources. When nothing relevant is stored, it says so.
• Sorts what you store. Each item gets one of nine categories and a few tags from the LLM. --category and --tags override it.
• Keeps secrets out of sight. Items marked sensitive are encrypted with AES-256-GCM before they are written and stay masked in output until you confirm a reveal. A summary that repeats a secret-looking value from the item is replaced. Details in SECURITY.md.
• Runs offline by default. Ollama for the LLM and embeddings, SQLite (with sqlite-vec) for storage.
• Other backends when you want them. Claude or OpenAI for the LLM, Voyage for embeddings, Postgres with pgvector for storage.
• Works with coding agents. inode mcp is a read-only MCP server, so Claude Code or Cursor can search what you stored.

---

Install

go install github.com/BiSemaphore/inode@latest
inode version

You need Go 1.26 or newer and a C compiler: SQLite and sqlite-vec are compiled in through CGO, whichever storage backend you use.

Platform	How
macOS	go install; the compiler comes with Xcode Command Line Tools (xcode-select --install)
Linux	go install with gcc, or the linux/amd64 archive on Releases
Windows	go install from an MSYS2 MinGW-w64 shell with mingw-w64-x86_64-gcc and mingw-w64-x86_64-sqlite3; see CONTRIBUTING.md

CI builds and tests on all three. Release archives exist for linux/amd64 only for now; more targets are tracked in #33. Versions before v0.5.0 were published as github.com/shahid-io/inode.

---

Quick start

# 1. Install Ollama (https://ollama.com/download), start it, pull two models
ollama pull llama3.2           # answers, categories, summaries
ollama pull nomic-embed-text   # embeddings for search

# 2. Save something
inode add "docker system prune -af removes all unused images and containers"
inode add "stripe test key sk_test_xxxxxxxx" --sensitive

# 3. Find it later
inode get "how do I clean up docker"
inode list

The first command creates ~/.inode/notes.db and a master secret in your OS keychain (used to encrypt sensitive items). Nothing else to set up.

---

Other backends (optional)

Every setting can go in ~/.inode/config.toml with inode config set <key> <value>, or in an environment variable named INODE_ plus the key in capitals with . replaced by _ (INODE_LLM_API_KEY). inode config set --help lists every key and inode config show prints the values in use.

Claude for answers, Voyage for embeddings:

inode config set llm.backend claude-api
inode config set llm.api_key sk-ant-xxxx
inode config set embedding.backend voyage
inode config set embedding.api_key pa-xxxx

OpenAI for answers (llm.base_url also points it at Azure OpenAI or any compatible endpoint):

inode config set llm.backend openai
inode config set llm.api_key sk-xxxx

Each backend uses its own default model unless you set llm.model or embedding.model: llama3.2, claude-sonnet-5-5, gpt-4o-mini, nomic-embed-text, voyage-3. For any other embedding model, also set embedding.dimension.

Cloud backends receive the text of what you store, sensitive items included: on inode add to classify and embed them, and on inode get as the sources for the answer. See SECURITY.md.

Choose the embedding backend before adding anything: items embedded by one model cannot be searched with another. inode records the model in the database, and if the config later names a different one, add and get stop and say how to switch back; list, show and delete keep working. Re-embedding stored items with a new model is not built yet (#131).

Postgres with pgvector instead of SQLite:

docker compose up -d pgvector    # compose file in the repo root
inode config set db.backend postgres
inode config set db.dsn "postgres://postgres:password@localhost:5432/postgres?sslmode=disable"

inode creates the vector extension and its tables on first run. Schema upgrades run automatically on both backends; for SQLite, inode first writes a backup next to the database (notes.db.bak-v<n>-<time>).

---

Use it from Claude Code or Cursor (MCP)

inode mcp serves three read-only tools over stdio:

Tool	Returns
search_notes	the items closest to a query
list_notes	items by category or tag, metadata only
get_note	one item, by ID or unique ID prefix

Sensitive items are left out of search_notes and list_notes, and get_note masks their content. inode config set mcp.reveal_sensitive true lets the agent read them.

Claude Code:

claude mcp add inode -- inode mcp

Other clients (for Cursor, ~/.cursor/mcp.json):

{
  "mcpServers": {
    "inode": { "command": "inode", "args": ["mcp"] }
  }
}

Adding items from an agent is not exposed yet (#58).

---

Commands

# Add (with no argument, opens $EDITOR)
inode add "vault write database/rotate-root/staging"
inode add "a secret" --sensitive
inode add "brew upgrade" --no-sensitive
inode add "docker system prune -a" --category commands --tags docker,cleanup

# Ask (aliases: ask, find, search)
inode get "query"
inode get "query" --reveal              # unmask sensitive values, after a confirmation

# List
inode list                              # newest 20; --limit to change
inode list --category credentials
inode list --tag github
inode list --sensitive                  # only sensitive items, after a confirmation

# One item (its ID, or a unique prefix of the ID shown by inode list)
inode show <id>
inode delete <id>                       # at least 4 characters; asks first

# Settings
inode config set <key> <value>
inode config show

# Other
inode mcp                               # MCP server over stdio
inode version

Categories

credentials, commands, snippets, decisions, runbooks, learnings, references, contacts, notes.

If the LLM suggests anything else, the item goes to notes, the catch-all category. --category overrides the LLM.

---

Status and roadmap

inode is a single-user tool today, released as v0.5.x. The next phases add a self-hosted server so a team can share secrets with permissions, then what an organization needs (sign-in through its identity provider, admin roles, audit). Design questions are settled in spike issues before any of it is built.

• Milestones: what is planned for each release and phase
• CHANGELOG.md: what shipped in each version

---

Documentation

• docs/spec.md: what inode does, for whom, and what it does not do
• docs/architecture.md: how it is built, file by file, including every setting and its default
• CONTRIBUTING.md: setup, workflow, and what a pull request needs
• RELEASING.md: how a version is cut
• SECURITY.md: what is protected, known limitations, and how to report a vulnerability

---

License

MIT © 2026 Shahid Raza