What the assistant may do
and what it is never given
A connected assistant gets fourteen tools - no more. This page lists every one of them, which permission each needs, and the things that were deliberately left out.
Finding and reading notes
These need nothing beyond the master switch - no further permission, and they cannot change anything. If you use a passphrase they also need the vault unlocked, because the note list is your data too.
snoq_list_notes
Lists your notes with their names, categories, star state and dates. Note bodies are never included in a listing, and the listing itself needs the vault unlocked.
snoq_read_note
Reads one note. The assistant can ask for it as Markdown, as plain text, or in Snoq's own stored format - Markdown by default, so headings, lists and links survive the trip.
snoq_search_notes
Full-text search across every note, returning the matches with a snippet of context - the same search the Ctrl+K box runs.
snoq_tabs
Reports which notes you currently have open and which one is in front, so the assistant can talk about "this note" and mean the one you are looking at.
snoq_status
Whether Snoq is running, whether the vault is encrypted and currently unlocked, how many notes there are, and which permissions you have granted. The one tool that answers while locked - which is how an assistant knows to ask you to unlock.
Reads always reflect what is on screen. If you have unsaved changes in the editor, the assistant reads those - not the older copy on disk.
Changing notes
Every tool below is refused unless you have ticked Allow it to change my notes. That box is off in a fresh install, so a newly connected assistant is read-only until you decide otherwise.
snoq_create_note
Creates a note with a name and optionally a category, and can open it for you straight away.
snoq_append_note
Adds to the end of a note and leaves everything already there untouched. This is the safe one: formatting the assistant does not understand cannot be damaged by it.
snoq_write_note
Replaces a note's whole content. Because Snoq has no undo, the tool is described to the assistant as one to confirm with you first, and it reports how many characters it replaced.
snoq_insert_image
Puts a picture into a note from a file on your machine - a screenshot, a photo, a diagram. You give the assistant a path and Snoq reads the file itself, so the image never travels through your conversation with the AI provider. It is stored inside the encrypted note, so it goes wherever your vault and your backups go; that also makes it about a third bigger than the file on disk, which is why there is a 10 MB limit.
snoq_rename_note
Renames a note and can move it to a different category. Leaving the category out keeps the one it already had.
snoq_star_note
Stars or unstars a note.
snoq_delete_note
Asks you to delete a note. It opens the note, raises Snoq's usual "are you sure?" prompt and returns straight away - it cannot answer the prompt for you. Takes an id, never a name, so it cannot destroy the wrong note by matching the wrong title.
snoq_open_note
Brings a note up in Snoq, in the current tab or a new one, and brings the window to the front. Useful at the end of a task - "here is the note I just wrote".
snoq_export_pdf
Exports a note to a PDF, into a folder or under a filename you choose, with no save dialog in the way. It is the same export as the PDF button in Snoq's toolbar, so the result is identical - including any unsaved edits, because it prints what is on screen. Snoq comes to the front and switches to that note while it runs, and it will not replace an existing file unless it is told to. It needs the write permission even though it changes no note: it puts a file on your disk at a path the assistant chose, and a read-only setup did not agree to that.
Writes go through the app, not around it
A change from the assistant takes the same path as one you type. If the note is open, your unsaved edits are kept and the change is applied on top of them; every open tab showing that note is refreshed, so the text appears while you watch. Nothing is written straight into the database behind the editor's back, which is what would otherwise silently overwrite whatever you were in the middle of typing.
Locking and unlocking
snoq_lock
Locks the vault. This is the real thing - the decryption keys are cleared from memory, exactly as when you use the lock hotkey yourself. Afterwards nothing can read a note body, including the assistant that just locked it.
snoq_request_unlock
Brings Snoq to the front with the unlock prompt showing, and can wait a short while for you to type your passphrase. It has no way to supply one. This is the product path for a locked vault, and it works with every permission switched off.
There is one more tool, snoq_unlock, which takes a passphrase and opens the vault. It is off unless you tick Allow it to unlock my notes, and we recommend leaving it off. The risk is not really the tool - anyone who can already reach your machine's files does not need it - but that the passphrase has to pass through the assistant's conversation to arrive, which puts it in your chat history with your AI provider.
What is deliberately absent
A missing tool is a decision, not an oversight. These are the ones a reasonable person might expect and will not find.
Deleting a note without asking you
There is a tool, but it cannot finish the job: snoq_delete_note opens the note and raises Snoq's own confirmation, and you answer it. The assistant cannot answer for you, and it has to check the note list afterwards to find out what you chose.
Setting or changing your passphrase
Permanently absent. Encryption is set up by you, in Snoq, and nothing about that flow is reachable over the bridge.
Exporting or importing an archive
Backups involve a file path and an archive password. Both are things an assistant should not be choosing on your behalf, so the whole flow stays in the app.
Pulling an image in from a web address
snoq_insert_image takes a file on your machine, never a URL. An image loaded from the web stays a link, so the note would quietly call that server every time you opened it. Whether your notes reach out to the network is your decision, not one an assistant should make in passing.
Your settings
Theme, language, fonts, hotkeys, sort order, tray behaviour. None of it is exposed. The assistant works with your notes, not with your copy of Snoq.
Turning its own permissions on
The permission switches are not reachable through the bridge. An assistant cannot grant itself write access, or re-enable the feature after you switch it off.
How the permissions map onto the tools
Master switch off
Every tool is refused, including the read-only ones. The assistant is told the feature is switched off in Snoq's settings, so it can tell you that rather than reporting a mysterious failure.
Master switch on, nothing else
The five reading tools work, plus snoq_lock and snoq_request_unlock. Everything that changes a note is refused.
Vault locked
Everything about a note is refused - the content and the note list alike. snoq_status still answers, so the assistant can see that the vault is locked and ask you to unlock it, but it reports no note count until you do.
The switches are read fresh on every single request, so unticking one stops the next call - there is no cached permission, no session to expire, and no need to disconnect the assistant first.
Related
Connect Claude to your notes
What the MCP server is, and the one line that sets it up.
How Snoq encrypts your notes
AES-256, Argon2id, and what the passphrase actually protects.
Encrypted notes app for Windows
The encryption model in depth.
Frequently asked questions
Installation, encryption, backups and the rest.
Try it with your own notes
Free, offline, no account. Windows 10 and 11.
Download Snoq freeWindows 10 / 11 - ~166 MB - no admin required