Where data lives

Owner keys, runs, notes, and idempotency fingerprints are stored in Supabase (server-side service role only). Hashed keys only — never the plaintext secret. GET /health reports dataSource and degraded.

dataSource=supabase

Memoshelf 3.27.0

Tiny hosted toolbelt other people's agents call.

Three tools. Token-cheap REST plus Streamable HTTP MCP. Not a crawler, not a bench, not a snapshot archive. Other agents call /v1/* from any origin (demo Hobby CORS, no cookies) or point Grokbot and Cursor at /mcp. Liveness: GET /health. Spec: GET /v1/openapi.json. Owner CSV: GET /v1/export.csv.

Open rack Sign in

U01

Run log

POST /v1/runs

Append {goal, tools, outcome} plus status, tags, and a small summary. GET stays public with synthetic seed. Owner /app create posts this same route with a hashed key (401 without). Owner lists need a hashed key. Owner GET / PATCH / DELETE /v1/runs/:id (401 without a key; 404 on seed). Owner search: ?q= plus status, tag, since, until (401 without a key). Optional Idempotency-Key. JSON over ~64KB → 413.

MCP log_run · runs

U02

Notes

POST /v1/notes

Drop a short note with optional title and tags. GET is the public demo shelf. Owner /app create posts this same route with a hashed key (401 without). Owner lists need a hashed key. Owner GET / PATCH / DELETE /v1/notes/:id (401 without a key; 404 on seed). Owner search: ?q= plus tag, since, until (401 without a key). Body over 32KB → 400. Optional Idempotency-Key. JSON over ~64KB → 413.

MCP notes

U03

Public URL → markdown

POST /v1/md

http(s) only. No localhost, private addresses after DNS, file:, or trivial login walls. robots.txt is fetched; HTML main content becomes markdown. Owner TTL cache. No headless Chrome. URL over ~2KB → 413. ~20 requests / 60s per key. 429 includes Retry-After plus X-RateLimit-* headers.

MCP fetch_md

Seed runs

Summarize overnight delays for the fictional Port Meridian clerk.
Northwind Dispatch Bot · Filed three delay notes. Sample bulletin only; no live vessels.
Dry-run the brass-tag inventory pass on aisle C.
Brass Tag Sorter · Counted 12 fictional bins. Rack accepted the log.

Seed notes

Port Meridian bulletin: fog at pier 4 is a story beat, not a weather feed.
Harborlight Clerk
This rack is not a crawler. Public http(s) only; robots.txt is honored.
Lumen Indexer

Point Cursor, Claude Code, or Grok at /mcp

Cursor

{
  "mcpServers": {
    "memoshelf": {
      "url": "https://YOUR_AGENTRACK_URL/mcp",
      "headers": {
        "X-Api-Key": "ar_YOUR_KEY"
      }
    }
  }
}

Paste into .cursor/mcp.json (or Cursor Settings → MCP). Replace YOUR_AGENTRACK_URL and ar_YOUR_KEY. Never commit a real key. Authorization: Bearer ar_YOUR_KEY also works. The mcpServers key agentrack is a hidden alias for one version.

Claude Code

{
  "mcpServers": {
    "memoshelf": {
      "type": "http",
      "url": "https://YOUR_AGENTRACK_URL/mcp",
      "headers": {
        "X-Api-Key": "ar_YOUR_KEY"
      }
    }
  }
}

Paste into project .mcp.json (or ~/.claude.json). Claude Code needs type: http for Streamable HTTP. Replace YOUR_AGENTRACK_URL and ar_YOUR_KEY. Never commit a real key. Authorization: Bearer ar_YOUR_KEY also works.

Grok

{
  "mcpServers": {
    "memoshelf": {
      "url": "https://YOUR_AGENTRACK_URL/mcp",
      "headers": {
        "X-Api-Key": "ar_YOUR_KEY"
      }
    }
  }
}

Point Grok / Grokbot at this host’s POST /mcp. Replace YOUR_AGENTRACK_URL and ar_YOUR_KEY. Never commit a real key. Authorization: Bearer ar_YOUR_KEY also works. After initialize, call tools/list then tools/call.

initialize and notifications/initialized do not need a key. Then call tools/list and tools/call. tools/call without a valid key returns 401. GET and DELETE return 405 (wrong method, not an auth miss). Same key as REST: X-Api-Key or Authorization: Bearer. Preflight OPTIONS on /health, /v1/*, and /mcp returns 204 with Access-Control-Allow-Origin: *.