Encrypted notes your AI agent can read, and static.md can't

The notes you’d most like an agent to help with are often the ones you’d least like a server to read: a journal, health notes, client work, a plan you’re not ready to share. Until now, static.md made you choose. End-to-end encrypted notes were unreadable to static.md, and to every agent too.

Now an agent on your computer can read and write them, and static.md still only ever stores ciphertext. This post explains how that works, how to set it up, and what it doesn’t hide.

How encryption works on static.md

On Pro, you can turn on end-to-end encryption for a note. Your browser makes a key of 8 emoji, about 78 bits, and puts it in the link after the #. Browsers never send that part of a link to a server. Every change you type is encrypted in the browser with AES-256-GCM before it leaves, so static.md stores ciphertext it has no way to read. Anyone with the full link can open the note. Without the part after #key=, nobody can, static.md included.

Why the key never reaches static.md

An agent talks to static.md over MCP, and whatever it sends in a tool call reaches the server. So the key can’t travel through static.md’s MCP server at all. Instead, encryption happens in a small open-source program on your computer, the E2E bridge, which your agent talks to as a local MCP server.

A request goes through three steps:

1. Your agent asks the bridge for a note, and reads and writes its text like any other note. This happens on your computer.
2. The bridge holds the key. It decrypts what static.md sends and encrypts what your agent writes.
3. static.md stores and returns ciphertext. Its tools have no field for a key, and they refuse text that contains one, so a key can’t end up saved next to a note by accident.

An agent’s edit is encrypted as a small change, the same way your browser encrypts what you type. So it merges live with anyone who has the note open in the browser, and a note the agent creates opens on static.md with its link like any other.

Set it up

You need a Pro account and Node.js 20 or newer.

1. Create a personal access token with notes:read and notes:write on the agents page. It’s shown once: keep it like a password.

2. Add the bridge to your agent. In Claude Code:

   shell

   claude mcp add static-md-e2e -e STATIC_MD_TOKEN=smd_pat_… -- npx -y static-md-e2e
   

   In Claude Desktop, Cursor and most other apps, add it to the MCP config:

   json

   {
     "mcpServers": {
       "static-md-e2e": {
         "command": "npx",
         "args": ["-y", "static-md-e2e"],
         "env": { "STATIC_MD_TOKEN": "smd_pat_…" }
       }
     }
   }
   

3. Give it a key. You can paste a note’s full link into the chat. To keep the key out of the chat entirely, save it on your computer once, then refer to the note by its id:

   shell

   npx static-md-e2e key add
   

   It asks for the link, so the key doesn’t land in your shell history either. Saved keys stay in a file only your user can read.

Keep the regular static.md connection too: it handles notes that aren’t encrypted, whiteboards and sharing.

What to ask

The bridge gives your agent three tools, to read, create and update encrypted notes. Ask in plain words:

• “Read the encrypted note I just linked and list what’s still open.”
• “Put today’s session notes in a new encrypted note and give me the link.”
• “Add the decisions we made to the end of my encrypted project note.”

A new note comes back as its full link. Save it somewhere safe: static.md never has the key, so it can’t recover a lost one.

Which agents it works with

It works with agents that run on your computer and can start a local MCP server: Claude Code, Claude Desktop, Cursor, VS Code and Codex.

It doesn’t work with chat apps in the browser, such as claude.ai or ChatGPT, because there’s nowhere on your side to hold the key. They could be supported by sending the key to static.md and decrypting the note on the server, but then it wouldn’t be end-to-end encryption, so I didn’t build that.

What it doesn’t hide

Encryption covers a note’s text. Here’s what it doesn’t cover:

• Titles aren’t encrypted. static.md stores them in readable form, so keep anything private out of them.
• Your AI provider sees what your agent reads and writes, as with any note it works on. If you paste a link into the chat, it sees the key too. key add avoids that.
• static.md still sees metadata: a note’s owner, sharing settings, size, when it changed and which token wrote to it.
• Anyone with a public note’s link can download its ciphertext. They can’t read it without the key, but you can make the note open only to you (Pro) as well.
• It’s for notes only. Encrypted whiteboards stay out of agents’ reach for now.
• It’s a Pro feature. Agent access to encrypted notes, like encryption itself, is part of Pro.

Open source

The bridge is MIT-licensed on GitHub, with setup for every app and the exact encryption format. You can read every line that touches your key, or write your own client from the format.

Try it

Set it up from static.md/agents, or read how static.md decides what agents may do first.