Add local MCP server for agent note access

[asymetryk]

Closes #11.

Summary

• add a local stdio MCP server backed by Kept's authenticated HTTP API
• expose seven focused tools for note search/read/create/update/archive/trash and label listing
• support session-token authentication or dedicated non-2FA username/password login with one safe 401 reauthentication
• include MCP safety annotations, bounded Zod inputs, secret-handling guidance, Docker packaging, and focused protocol/API tests

Motivation / Bug

Kept already has the application API needed by agent clients, but agents currently need bespoke HTTP integrations or unsafe direct SQLite access. This provides a small official adapter without adding a remote listener or another public port.

Permanent deletion, user administration, backup restoration, arbitrary action-plan execution, and direct database access are intentionally excluded.

Test Evidence

• npx --yes --package=node@24 node --test mcp/*.test.mjs — 11 passed
• npx --yes --package=node@24 node server/sync-smoke.test.js
• Node 24 Angular production build plus PurgeCSS
• real stdio client/server handshake through StdioClientTransport
• git diff --check
• added runtime dependencies are MIT licensed

npm audit --omit=dev still reports existing Kept application dependency advisories. Compatible MCP-tree Hono, body-parser, fast-uri, and ip-address versions were updated so this change does not leave the avoidable advisories initially surfaced in that new dependency path.

Risks / Rollback

• Kept's application API is not independently versioned; MCP route mappings are covered by focused contract tests and documented accordingly.
• Session tokens expire according to KEPT_SESSION_TTL_DAYS; 2FA users must provide an interactively obtained KEPT_TOKEN.
• Rollback is removal of mcp/, the two runtime dependencies/scripts, Docker copy line, and documentation links. The normal Kept server runtime and database schema are unchanged.

CLA

I have read CONTRIBUTING.md and agree that my contribution is submitted under the Kept Contributor License Agreement.

[asymetryk]

@codex review

[asymetryk]

@codex review

[asymetryk]

@codex review

[asymetryk]

Exact-head fallback at 0818ec7bcd40062c4db977db1415ef2bf9f3d42d: the Codex connector did not return a review after the initial request, one five-minute nudge, and a second five-minute window. I fetched origin/master (branch already current) and reran the full relevant gate: 11 MCP tests passed including stdio handshake, existing sync smoke passed, and the Node 24 production build plus PurgeCSS passed. Leaving the PR draft and unmerged for maintainer review.

[asymetryk]

The MCP adapter is now live-tested against a tailnet-only Kept instance using a real account session: tool discovery passed, and a temporary note was created, read, and moved to recoverable trash. The branch remains current with master and is ready for maintainer review.