Module mcp 

sioul mcp: what Sioul keeps on this computer, served to AI agents over the Model Context Protocol (https://modelcontextprotocol.io, revision 2025-06-18), on standard input and output, as Claude Code and Claude Desktop start it (docs/mcp.md).

The pieces stay apart, so that each can be reused:

• transport: how messages travel. Standard input and output now, one JSON-RPC message per line; Streamable HTTP, for ChatGPT and remote clients, comes as another transport over the same server.
• protocol: JSON-RPC 2.0 and the parts of MCP Sioul answers: the handshake, ping, tools, resources.
• tools: the registry, as plain data (a name, a description, a JSON schema, a function), which another agent protocol can serve as it is.
• read and write: the tools themselves, on the core’s public functions, as the command line uses them; phone (the phone’s messages, calls) and records (papers, contracts, letters, time, invoices, reminders, the moment now) read the rest, read-only.
• spam: the spam filter’s tools (computers only), on sioul spam’s own reports; [mcp] spam = false keeps them from agents.
• access: consent per project: every project closed to agents until the person opens it, things in no project as [mcp] outside_projects says (sioul_core::consent); every tool keeps to it.
• mask: what is never handed to an agent as it is (docs/ai.md); the command line’s sioul spam lists masks the same way.
• log: what each agent asked, and what it was given.

Every tool works on this computer’s files only: nothing is sent, no password or key is read, nothing is deleted. The tools that write add a task, an event, a note, a draft, a tie or a spam label, or mark a task done; the next sync sends a task or an event to its server, as it does for what you change in the window. A draft waits in Sioul’s Drafts: only you send it. Two spam tools start a job apart that reads your mail servers (the training corpus, read-only) or trains; none moves mail.

Modules

access 🔒

Consent per project, as every tool keeps to it (docs/mcp.md, “Per-project access”; the rule itself is the core’s: sioul_core::consent).

log 🔒

What each agent asked, and what it was given (docs/ai.md, “A log”): one JSON line per call, one file per month, in the state folder ($XDG_STATE_HOME/sioul/mcp/2026-10.jsonl), readable by you alone. It stays on this computer. What was handed over is named by its addresses (mid:…, sioul:…) and its length, never by its words: no message’s text, no code, no secret is kept a second time, in a file that outlives the mail.

mask 🔒

What is never handed to an agent as it is (docs/ai.md, “Masking”): the one-time code, password or sign-in link a message carries, IBANs, payment card numbers and French social security numbers (NIR). Each number is checked by its own rule (ISO 13616’s mod 97, Luhn’s, the NIR’s key), so an order number or a phone number stays as written. The window shows them all.

phone 🔒

The tools that read what the person’s phone shares with their computers, read-only: the phone’s messages (phonemsgs: who wrote, in which app and conversation, when, and the words where the phone sent them) and the calls it screened (calls: who called, when, whether it rang or went to voicemail). Read from the logs the sharing carries to this computer; none when the parts “Messages from your phone” and “Calls” are off.

protocol 🔒

JSON-RPC 2.0 (https://www.jsonrpc.org/specification) and the parts of MCP 2025-06-18 Sioul answers: the handshake (“Lifecycle”), ping, tools, and a few resources made by the same tools. One message in, at most one out; the transport only carries them.

read 🔒

The tools that read: what came, mail, tasks, the agenda, contacts, budgets, notes, projects and links. Each reads the files as the command line does (main, tasks, dav), and Sioul’s own sentences come in the configuration’s language. The labels and hints meant for the agent alone (“From”, “not found”) are English, as the tools’ descriptions are.

records 🔒

The tools that read the person’s records, all read-only: papers, contracts and paper letters (what each is, what ends and when, the notice a contract needs, a letter’s sender, kind and date asked); time and invoices (time noted per project, what is billable and not billed yet, invoices issued and whether they are paid); reminders (dates asked, waits, payments, papers’ and contracts’ dates); and the moment now (what now is for, do-not-disturb, what reaches the person now), so that an agent respects their hours.

spam 🔒

The spam filter’s tools (docs/mcp.md, “The spam filter’s tools”), so that an agent can run it, watch it and judge it from outside, as sioul spam does (crate::spam::report, whose lines and data each answers with).

tools 🔒

The tools, as plain data: a name, a title, what it does (and, for those that write, what it changes), the JSON schema of its arguments, and the function that does it. MCP lists and calls them (protocol); another agent protocol, or another transport, can serve the same table.

transport 🔒

How MCP messages travel, apart from what they say (MCP 2025-06-18, “Transports”). The stdio transport is the one Claude Code and Claude Desktop use: the client starts sioul mcp and writes one JSON-RPC message per line on its standard input; each answer is one line on its standard output. Streamable HTTP (one POST per message, for ChatGPT and remote clients) will be another Transport over the same protocol::Server.

write 🔒

The tools that write, on this computer only: a task added or marked done, an event added, a note written, a draft saved, two things tied. Nothing is sent from here. A task or an event changed goes to its server with the next sync, as what you change in the window does; a draft waits in Drafts until you read and send it. Nothing is deleted or overwritten.

Functions

run 🔒

Serves MCP on standard input and output until the client closes them. Standard output carries the protocol alone: nothing else may print there.