inode

inode is a CLI tool for storing notes, secrets, API keys, commands, and decisions — retrieved via vector similarity search and LLM inference instead of grep, folders, or memory. It runs entirely on your machine; the default backends are local (Ollama for both LLM and embeddings, SQLite for storage).

$ inode add "staging DB creds: vault write database/rotate-root/staging"
  category=runbooks  tags=[vault, postgres, staging]  sensitive=true
  saved  id=a1b2c3d4
$ inode get "how do I rotate staging db creds"
Run vault write database/rotate-root/staging, then restart the api.

── Sources (1 note(s)) ──
  #a1b2c3d4  Rotate staging DB creds  [runbooks] [vault, postgres, staging]  [sensitive]

Features

• Natural-language retrieval — ask in plain English, get the right note back
• Auto-classification — the LLM picks the category and tags from a curated set
• Sensitive-value protection — secrets are AES-256-GCM encrypted at rest, masked by default
• Local-first by default — Ollama for LLM and embeddings, SQLite for storage; no API keys, no account, no internet required
• Cross-platform — single Go binary on macOS, Linux, and Windows
• Optional cloud backends — Claude API + Voyage AI for higher-quality answers if you want them

Install

Build from source (recommended while we iterate)

go install github.com/BiSemaphore/inode@latest

Needs Go 1.26 or newer and, for the default SQLite backend, CGO with a C compiler. Versions before v0.5.0 were published as github.com/shahid-io/inode.

Releases

GitHub Releases has a pre-built linux/amd64 archive for each version. On macOS, Windows and other architectures, use go install above; more release targets are tracked in #33.

Quick Start (zero-cost path)

# 1. Install Ollama and pull the local models (one-time, free)
brew install ollama
ollama pull llama3.2
ollama pull nomic-embed-text

# 2. Save something
inode add "My GitHub PAT is ghp_xxxxxxxxxx"

# 3. Find it later
inode get "github personal access token"

That's it. No API keys, no account, no telemetry. Everything stays on your laptop.

Optional: cloud backends

If you want Claude-quality answers and Voyage-quality embeddings:

inode config set llm.backend claude-api
inode config set llm.api_key sk-ant-xxxx
inode config set embedding.backend voyage
inode config set embedding.api_key pa-xxxx

Or OpenAI for the LLM (llm.base_url also points it at Azure OpenAI or any compatible gateway):

inode config set llm.backend openai
inode config set llm.api_key sk-xxxx
inode config set llm.model gpt-4o-mini   # optional, this is the default

These are completely optional. The Ollama path is fully featured.

Optional: Postgres + pgvector backend

By default inode uses SQLite + sqlite-vec — single file, zero infrastructure.

If you're on Windows (where the sqlite-vec CGO build chain is painful) or you'd rather run on a real database, you can switch to Postgres + pgvector. The Postgres driver is pure Go, so go install works without any C toolchain.

# 1. Start a pgvector-enabled Postgres (compose file in repo root)
docker compose up -d

# 2. Point inode at it
inode config set db.backend postgres
inode config set db.dsn "postgres://postgres:password@localhost:5432/postgres?sslmode=disable"

inode will CREATE EXTENSION vector and create the notes table on first run. SQLite remains the default — Postgres is opt-in.

Optional: MCP server (Claude Code / Cursor)

inode mcp runs as a Model Context Protocol server over stdio so an MCP-aware AI client can read your knowledge base.

Exposes three read-only tools to the calling agent:

• search_notes — vector search; returns the most relevant notes
• list_notes — paginated listing; metadata only
• get_note — fetch a single note by ID prefix

Sensitive notes are excluded from search results and masked in get_note responses by default. To let the agent see them:

inode config set mcp.reveal_sensitive true

Wire it into your MCP client config (Claude Code example):

{
  "mcpServers": {
    "inode": { "command": "inode", "args": ["mcp"] }
  }
}

Writing notes from an agent isn't exposed yet — read-only is the safer first step.

Commands

# Add notes
inode add "note content"
inode add "secret" --sensitive
inode add "docker system prune -a" --category commands --tags docker,cleanup
inode add                          # opens $EDITOR

# Retrieve (aliases: ask, find, search)
inode get "query"
inode get "query" --reveal         # unmask sensitive values

# List
inode list
inode list --category credentials
inode list --tag github

# Manage
inode note get <id>
inode note delete <id>

# Config
inode config set llm.backend claude-api
inode config set llm.model claude-sonnet-4-6
inode config show

Categories

inode classifies every note into one of nine strict categories:

credentials · commands · snippets · decisions · runbooks · learnings · references · contacts · notes

If the LLM proposes something else, the classifier falls back to notes. You can override with --category and the classifier won't second-guess you.

Documentation

• docs/spec.md: what inode does, for whom, and what it does not do
• docs/architecture.md: how it is built, file by file

Roadmap

The original phase numbering had Cloud at Phase 2 and Local LLM at Phase 3. In practice, Local LLM shipped first because it's also the architectural posture — local-first is the design, not a feature behind a future-Phase fence.

Contributing

Contributions are welcome. Please read CONTRIBUTING.md before opening a pull request.

Security

inode handles secrets and sensitive data. If you discover a vulnerability, please follow responsible disclosure — see SECURITY.md.

License

MIT © 2026 Shahid Raza