v3.0.1
Aki MCP Server now serves only the tools of apps you have installed (38 tools in all), makes your AI show a rule receipt before any tool that acts will run, keeps credentials out of tool results, and logs every call without the text you sent. From 2.2 it is a major release: update, restart, then reconnect AkiMCP in every client. From 3.0.0, update and restart: nothing to reconnect.
38
tools, only for installed apps
Tools of an app that is not installed are not served. Section 8 switches the rest
17
tools marked read-only
Out of 38. ChatGPT stops asking to confirm them, every tool that can write still asks
50
seconds at most per browser call
Even on a page that never answers. Out of time you get code timeout and a next step
4
web AIs connect with a passphrase
Claude, ChatGPT, Grok and now Notion. Gemini stays experimental
Already on 3.0.0? Update with the same command (How to upgrade) and restart AkiMCP: the fixes apply only after the restart. Nothing to reconnect, because the tool list your AI sees is the same as in 3.0.0. An AI that still holds an old rule receipt is asked once for a new one.
A background task started with task_start in a folder that does not exist, or with a program that is missing or not executable, made the whole AkiMCP process exit, and every connected client lost its tools until you restarted it. The call now fails with the reason, for example Failed to spawn background task process: ENOENT, and the server keeps running.
Launching Postman from the Postman tab of the panel with a Postman binary that was missing or not executable ended the Postman helper process, and a launch that failed used to wait out the full readiness timeout before it said so. It now fails at once with the reason, for example Failed to launch Postman: EACCES.
When devtools_eval ran out of time while still listing tabs or connecting, it said the script may have run, although nothing had. It now says the CDP endpoint did not answer and to check the app with aki__port_status. Once connected, a frozen tab still gets the earlier text, because there the script may have run.
The block after repeated wrong credentials and the limit on bulk /register calls both count attempts per caller. In 2.2.0 and 3.0.0 the caller was read from CF-Connecting-IP on every ingress, but only Cloudflare writes that header, so on Funnel a client could send its own value to dodge the block. Each ingress now reads only the header it writes itself: Cloudflare Tunnel CF-Connecting-IP, Tailscale Funnel the last X-Forwarded-For entry. Your own edge through PUBLIC_ORIGIN keeps both. This closes a way around the throttle on guessing; it was never a way in without the passphrase.
aki__akidevrule_context now tells an AI to work in the shared checkout in turns, committing only its own paths, and to create no worktree, build folder, clone or node_modules unless the work cannot be done without it. It asks the coordinator first, and whoever merges removes what was created in that same turn.
The lockfile now pulls patched versions of proxy-addr, the MCP SDK, ip-address and fast-uri, and npm audit reports no findings. AkiMCP runs on plain node:http and never calls the affected proxy-addr function, so this is hygiene, not a fix for a reachable hole. The npm package ships no lockfile, so the refreshed one matters to installs from source.
Panel section 8, “Tool providers”, lists each group of tools and switches it on or off. The AI’s tool list stays short.
Tools of an app that is not installed are not served: agy and kiro-cli on your PATH, the Postman app, a Chromium browser, AIObox. Nothing the AI cannot use sits in its tool list.
Section 8 shows each provider’s tools, whether its app is installed, and an on/off switch. Rule context, files, search and shell are always on. A switch is saved in setting.json and applies on the server at once.
Each hands a whole task to another paid agent, so they stay off until you switch them on in section 8. A setup that used them before this release needs that one click.
Detection runs once at start. Detect again picks up an app you installed or removed without a restart. A client sees the change on its next tool list, which usually means a new chat or reconnecting the connector.
When the AIObox app is installed, aki__aiobox (read) and aki__aiobox_write (act) let the AI read and act on its windows. Which actions exist comes from AIObox, so AIObox can add one without a new AkiMCP release. Without AIObox neither tool is served.
chrome_launch no longer copies your Chrome profile. It opens a profile clone shared with AIObox, or attaches when AIObox already runs that profile.
Clones live in ~/.aki/cdp/profiles/ and only AIObox creates them. Pass profile as Profile 14 or the clone id. A missing clone fails with no_profile, which names the shared clones there are and how to attach to a running Chrome instead. chrome_profiles lists the shared ids too.
Chrome’s own lock file decides. A running Chrome with a working debugging port is attached to (status: attached, owned: false) and your url opens as a new tab. A running Chrome with no working port is refused. A dead one gets its stale lock removed and a new Chrome starts. A lock from another computer fails closed and nothing is removed.
The refresh argument and akimcp’s own profile cloner are gone: it copied SQLite files while they were open and could rename a profile out from under a running Chrome. The old ~/.aki/mcpsv/chrome-clones/ folder is no longer read, delete it when you like.
Without pid, chrome_stop kills only a Chrome that chrome_launch started. An attached session is only forgotten. The active session’s port is probed before every use, and a dead one clears the session.
A missing or non-executable browser used to leave chrome_launch waiting 15 seconds, then report a port timeout. It now fails immediately with the binary’s path and the system error. On Windows, 64-bit Chrome and Edge are found too, per-user installs included.
devtools_targets, devtools_eval, devtools_screenshot, the tab open, close and activate requests, and postman_eval each end within 50 seconds, finding the target and connecting included. A client gives up after about a minute and gets nothing, yet a page that never answered used to hold a call for up to 10 minutes. Out of time you get code timeout and a next step: after an evaluate, check with a short read-only expression before running it again.
A gate before anything that acts, credentials kept out of the chat, and plain labels on what each tool does. The limits are listed at the end of the page.
Every tool that is not read-only takes receipt and refuses without the sha256:… receipt, the proof that the AI loaded your rules, that aki__akidevrule_context returns. An AI that skipped the rules, or lost them when its chat was compacted, can no longer write. A refusal such as RULE_RECEIPT_MISSING or RULE_RECEIPT_STALE says what to call next. A changed rule file makes the old receipt stale.
AkiMCP finds CLAUDE.md, CLAUDE.local.md, AGENTS.md and GEMINI.md from the path a call touches up to its root, as Claude Code, Codex and Gemini CLI do. A tool that acts, whose receipt does not cover them, does not run yet: it returns the rules (32 KiB cap) and a new receipt to call again with. A read tool always runs and adds one line naming the files. Calls made together into one project show its rules once.
Every tool now declares whether it only reads. 17 of the 38 are read-only by mechanism (18 while agy_run allows only plan), so ChatGPT stops asking to confirm them. Every tool that can write still asks. The marks are client UX and replace none of the allowlist, folders or fetch guard.
The file tools no longer read or write tokens.json, passphrase.txt, oauth-client.json, oauth-dcr-clients.json or cloudflared-cred.json. run_cmd and task_start refuse a command that names one, and search_content skips them. Every tool result also shows a token-shaped value from those files, the passphrase and the panel token as [redacted]. setting.json stays readable and writable by decision.
notify_user pasted its message into a command line, so a quote could run the rest: the text is now passed as data. chrome_launch read a url starting with a dash as a Chrome flag: it now refuses it. In a trusted script zone, node --eval=, node --require and python3 -c ran code the zone never held: the zone script must now be the interpreter’s first argument, so a call that needs a flag such as python3 -u needs an allowlist row.
local_fetch now blocks link-local and cloud-metadata addresses including their IPv6 forms (fe80::/10, the IPv4-mapped form, fd00:ec2::254), re-checks every redirect hop (5 at most) and reads at most 512 KB of a response. Other fd.. addresses stay reachable because a tailnet and a home LAN use them.
Panel section 9, “Call log”, sets what is recorded. No prompt, expression or argument text is ever written.
Each aki__ tool call appends one line to tool-calls.jsonl in the data folder: time, client and agent, tool, op, window, port, ok or an error code, duration and server version. Never the text, script or URL you passed.
Section 9 sets on or off, the level, the keep days and the size cap, and a save applies from the next call. basic, the default, keeps an error code and a tag such as click or fetch in place of a script. detail adds the full error text (200 characters) and a short hash of the eval expression. By default files older than 40 days are deleted and the current file rolls to a dated one at 16 MB.
It answers which AI drove which window when a message lands in the wrong chat. The names of a client’s request headers are recorded once, never their values.
npm run tool-calls turns the log into a report of how AIs drive AIObox: the success share, refusal codes, stale-schema errors and calls from an older server version. --days N limits it.
GET /api/access-token returns the shared access token on loopback, gated by the panel token, so a local app such as AIObox no longer has to read tokens.json. It adds no capability: whoever holds the panel token can already read the token on the panel page.
A chat keeps the tool list it loaded, so after an update it can send an argument the new tool no longer takes. The refusal (-32602) now names the argument the tool does not take. When every argument is valid it says the client’s tool list may be stale: reconnect AkiMCP or start a new chat.
Notion joins the web AIs, and a local MCP client can start AkiMCP with no tunnel at all.
Notion’s custom MCP server registers itself like Claude, ChatGPT and Grok: enter the URL, then the passphrase. It gets the shared access token and its own refresh token, so Roll token no longer breaks it. Do not paste the access token as a bearer, that copy stops working on every roll. Add the connection inside a Notion agent, then republish the agent.
A client can call POST /revoke to sign itself out. Only that client’s refresh ends and the shared access token stays. The scope a client asks for is carried to the token and never widened on refresh.
npx @akinet/akimcp --stdio serves the tools over stdin and stdout with no gateway, tunnel or token. It is the entry an MCP client spawns. A server.json record describes the package for the MCP Registry as io.github.lacvietanh/akimcp.
The panel and README now recommend a Cloudflare tunnel over Tailscale Funnel: a steadier connection, more bandwidth and a larger global network. Funnel stays what npm start sets up by itself, because it needs no domain.
A POST to /token, /revoke or /authorize whose connection dropped before the body arrived, a client_id such as constructor, or a /register body of null used to end the process and disconnect every client. Each now answers that request alone. OAuth bodies are capped at 64 KB.
Clients share one internal session with remapped request ids, but a cancel was forwarded with the client’s own id, which upstream was some other request. A cancel now ends only the caller’s own request, and ends its wait at once instead of after 10 minutes.
Upgrade notes
This is a major release. Update, restart, then reconnect AkiMCP in every client. Already on 3.0.0? Run the same update command and restart: 3.0.1 needs no reconnect.
# Global CLI
npm install -g @akinet/akimcp
akimcp
# From source
git pull && npm install && npm start
Tool list in your AI
BeforeNo read-only marks, no receipt argument
NowEvery tool is marked, acting tools take a receipt. Reconnect every client
Acting tools
BeforeRan without checking that the rules were loaded
NowRefused until aki__akidevrule_context gives a receipt
agy and Kiro CLI
BeforeServed
NowOff until you switch them on in section 8
Opening a Chrome profile
Beforechrome_launch cloned it, refresh copied it again
NowOpens a shared clone made by AIObox, or attaches. No refresh
Old clone folder
Before~/.aki/mcpsv/chrome-clones/
NowNo longer read. Delete it when you like
A page that never answers
BeforeCould hold a browser call for up to 10 minutes
NowEnds within 50 seconds with code timeout
Credential files
BeforeFile tools and cat could put a live token in the chat
NowClosed to tools that take a path. Results show [redacted]
A security feature you can trust tells you where it stops.
See the panel in the live preview, read the full security model, or go straight to the install page.