Skip to content
verify mcp Beta VerifyMCP is currently in beta. If you notice any issues, get in touch and we’ll put it right.

Milanote by Cotlet

PYPI · MILANOTE-API-MCP · 3 COMPONENTS

Boards, notes and links in your Milanote workspace.

65 Trust /100

Last scanned (4 hours ago)

Scores higher than 63% of PyPI servers

Category Productivity and Notes

Trust breakdown (7 categories)

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →

Supply Chain Security50
  • Malware scan not yet available for this package.Unverified
  • No known CVEs affecting this package version or its production dependencies.Pass
  • Runs hatchling.build at install time, a recognised build step with no custom scripting around it. View diagnostics → Pass
  • 0 of 36 dependencies flagged as unhealthy. View diagnostics → Pass
Provenance & Transparency84
  • Source repository is publicly reachable at the declared URL. View diagnostics → Pass
  • Cryptographically verified build provenance (signed, bound to cotletdev/milanote-api-mcp-server). View diagnostics → Pass
  • License check failed: the license (PolyForm-Noncommercial-1.0.0) isn't a recognized OSI-approved license. See how to fix → Fail
  • Actively maintained (last published 0 days ago).Pass
  • Disclosure check failed: no security disclosure policy was found in the source repository. See how to fix → Fail
Schema Quality & AI Usability83
  • 100% of prompts and resources have a non-trivial description (not blank, and not just the item's name).Pass
  • AI-judged instruction clarity (excellent).Pass
  • Context-footprint check failed: tool/resource definitions use about 3952 tokens (~123/item across 32 items; 30 tools + 2 resources), over budget; trim descriptions and params. See how to fix → Fail
  • Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management0
  • Stability not yet verified: not enough scan history yet (needs a 30-day window).Unverified
Tool Coverage100
  • 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
  • 100% of tool parameters carry a description.Pass
Tool Safety100
  • No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
  • All 3 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation.Pass
  • An AI judge read all 32 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
  • Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass

Unverified: 1 category

A category scored 0 because we could not verify it: a data source with nothing on this package, evidence we could not reach, or a check we could not run. We only credit what we can confirm.

Changelog

Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.

  • 24 Oct 26 65

    First indexed and scored.

Diagnostics

Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.

Captured 24 Oct 2026 · Analysed pypi/milanote-api-mcp@1.0.3

Provenance Verified

A signed build attestation was found and verified, binding this exact artifact to the source repository it claims to come from.

Result Verified
Ecosystem pypi
Reason Verified
Discovered via Registry attestation endpoint
Source repo cotletdev/milanote-api-mcp-server
Certificate issuer https://token.actions.githubusercontent.com
Certificate SAN https://github.com/cotletdev/milanote-api-mcp-server/.github/workflows/publish.yml@refs/tags/v1.0.3
Rekor log index 3439417709
Predicate type PyPI publish attestation https://docs.pypi.org/attestations/publish/v1
Subject digest sha256:6d9034217093332ac99bb4de517dd9708e54e0c02e5659455b84c5fbdbcdcfe1

Background: How many MCP packages publish verified provenance →

Install scripts 1 script
Hook Tier Command
build_backend allowlisted hatchling.build

Background: Why install scripts are a supply-chain risk →

Dependencies 36 packages
Packages resolved 36
Tree resolution Complete

Background: SBOMs and build attestations, explained →

MCP tools · 30 exposed · ~3,838 tokens

The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →

Tool Tokens
add_column ~90

Empty column on a board, to group cards in a stack. Adds a titled column on top of the board's Unsorted panel and returns its column_id; move_card with to_column_id puts cards into it. Editors of the board see it, nobody is notified.

NameTypeReqDescription
board_idstringyesBoard ID from list_boards, or the board URL.
titlestringyesColumn title.

No output schema declared.

No examples provided.

add_comment ~168

Comment card on a board, or a reply in a comment thread, posted under your name. Without reply_to_id it adds a new comment card on top of the board's Unsorted panel; with it the comment joins that thread. Everyone who can open the board sees it under your name, and Milanote notifies people already in the thread. The text is plain: an @name stays text and tags nobody. Only you can edit or delete it afterwards, in Milanote.

NameTypeReqDescription
board_idstringyesBoard ID from list_boards, or the board URL.
reply_to_idstring–A comment thread ID or comment ID from get_board (include_comments) to reply in. Default: a new comment card.
textstringyesComment text, plain.

No output schema declared.

No examples provided.

add_label ~119

Put a label on a card, creating the label when the name is new. Matches the name against your labels (list_labels) without regard to case; created is true when it made a new one. The card keeps its other labels. Editors of the board see the label on the card.

NameTypeReqDescription
board_idstringyesBoard ID from list_boards, or the board URL.
card_idstringyesCard ID from get_board.
labelstringyesLabel name; a name you have not used yet creates the label.

No output schema declared.

No examples provided.

add_link ~152

Link card for a web address, with the page's title and preview, added to Unsorted. Adds one link card on top of the board's Unsorted panel. Milanote fetches the page itself and fills in the title, description and preview image, as when you paste a link; the answer returns what it found (title is null when the page gave none). On the free plan a link counts toward the 100 cards limit. Nobody is notified; move the card to the trash in Milanote to undo it.

NameTypeReqDescription
board_idstringyesBoard ID from list_boards, or the board URL.
urlstringyesWeb address to save, starting with http:// or https://.

No output schema declared.

No examples provided.

add_note ~128

Note card with plain text, added to a board's Unsorted panel. Adds one note card on top of the board's Unsorted panel and returns its card_id. The text is plain: line breaks become paragraphs, Markdown is not converted. On the free plan a note counts toward the 100 cards limit. Editors of the board see it, nobody is notified; move it to the trash in Milanote to undo it.

NameTypeReqDescription
board_idstringyesBoard ID from list_boards, or the board URL.
textstringyesNote text. Each line becomes a paragraph.

No output schema declared.

No examples provided.

add_todo_list ~169

To-do list card with tasks, each with an optional due date and time, added to Unsorted. Creates one to-do list on top of the board's Unsorted panel with all its tasks, unchecked, and returns each task_id. A due date without a time is due at 5 PM; Milanote reminds you at 9 AM the day it's due, by the channels in your notification settings. Times are in the Cloud Browser's time zone. Nobody else is notified; move the list to the trash in Milanote to undo it.

NameTypeReqDescription
board_idstringyesBoard ID from list_boards, or the board URL.
tasksarrayyes1 to 50 tasks, in order.
titlestring–List title. Default: no title.

No output schema declared.

No examples provided.

create_board ~130

New board on your Home or nested inside another board. Creates an empty board and returns its board_id for the tools that add cards. It appears in the Unsorted panel of the parent board (your Home by default), where you can drag it onto the canvas. It is private unless the parent board is shared, in which case the parent's editors can open it; nobody is notified. Move it to the trash in Milanote to undo it.

NameTypeReqDescription
parent_board_idstring–Board to nest it in (ID or board URL). Default: your Home.
titlestringyesBoard title.

No output schema declared.

No examples provided.

delete_comment ~87

Delete a comment you wrote, for everyone. Removes your own comment from its thread; the thread and other people's comments stay. There is no trash for comments, so it cannot be brought back.

NameTypeReqDescription
board_idstringyesBoard ID from list_boards, or the board URL.
comment_idstringyescomment_id from get_board (include_comments) or add_comment.

No output schema declared.

No examples provided.

duplicate_board ~173

Copy a board with everything on it, sub-boards included, as a template. Does what Duplicate in a board's menu does: Milanote copies every card, column, comment and sub-board into a new board and returns its board_id. The copy lands in the parent board's Unsorted panel, private to you unless that board is shared; the read-only link and editors are not copied. Every copied card counts toward the free plan's card limit (get_usage). card_count is what Milanote reports it copied.

NameTypeReqDescription
board_idstringyesBoard to copy: ID or board URL.
parent_board_idstring–Board to put the copy in (ID or board URL). Default: where the original is.
titlestring–Title of the copy. Default: the same title.

No output schema declared.

No examples provided.

edit_comment ~103

Replace the text of a comment you wrote. Overwrites your own comment with plain text, as Edit then Save does in the thread. Others' comments cannot be changed. People who already read it get no new notification.

NameTypeReqDescription
board_idstringyesBoard ID from list_boards, or the board URL.
comment_idstringyescomment_id from get_board (include_comments) or add_comment.
textstringyesNew comment text, plain.

No output schema declared.

No examples provided.

edit_note ~125

Replace the text of a note card. Overwrites the whole note with plain text: line breaks become paragraphs, and bold, links or lists the note had are lost. Only note cards; to-do lists change with set_task_done. Editors of the board see the change at once; Milanote's undo in the app does not reach it.

NameTypeReqDescription
board_idstringyesBoard ID from list_boards, or the board URL.
card_idstringyesNote ID from get_board.
textstringyesNew note text. Each line becomes a paragraph.

No output schema declared.

No examples provided.

export_board ~141

Export a board as Markdown, plain text, Word, PDF or PNG, as the Export menu does. Runs Milanote's own export of one board. markdown and plain_text return the text in content; word, pdf and png return only file_url. Text formats follow the board's reading order and leave out comments and sub-board contents; pdf and png are a picture of the canvas. Anyone with file_url can download the file, and Milanote deletes it after about a day.

NameTypeReqDescription
board_idstringyesBoard ID from list_boards, or the board URL.
formatstringyesmarkdown, plain_text, word, pdf or png.

No output schema declared.

No examples provided.

get_board ~211

Every card on a board: notes, links, images, files, to-do lists, columns and sub-boards. Returns one entry per card with its type, ID and content, so other tools can point at it. Order is the board's: the canvas top to bottom, then the Unsorted panel (section says which). Notes come back as plain text. To-do lists list each task with its done state and due date (due_time only when one was set). Cards inside a column carry column_id; color and labels (by name) appear when a card has them. Sub-boards appear as cards with their own board_id; call get_board again to open one. Drawings, lines and tables come back with their type and ID only. include_comments adds comment threads with author, text and time.

NameTypeReqDescription
board_idstringyesBoard ID from list_boards, or the board URL.
include_commentsboolean–Also return comment threads with their comments. Default: false.

No output schema declared.

No examples provided.

get_sharing ~117

Who can open a board: owner, editors and the read-only link with its settings. Lists the board's owner and the editors invited to it; status is invited for someone who has not made a Milanote account yet. Editors of a parent board can open it too and are not listed here. read_only_link is null until publish_board turns the link on; comments_on_link and downloads_on_link say what viewers of that link may do.

NameTypeReqDescription
board_idstringyesBoard ID from list_boards, or the board URL.

No output schema declared.

No examples provided.

get_usage ~99

How many cards your account uses against the free plan's limit, by card type. used is what Milanote counts toward the free plan's limit (100 cards, more with referral bonuses); once exceeded is true Milanote refuses new cards until you delete some or upgrade. On a paid plan unlimited is true and limit is null. by_type counts each kind of element you made, comments and lines included; Milanote decides which of them count toward used.

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

invite_editor ~134

Invite someone by email to edit a board and the boards inside it. Adds the address as an editor, as Share, Invite editors via email does, and Milanote emails them a link. status is invited when they have no Milanote account yet (a free one is enough to edit), active when they do. Milanote allows inviting only once your account's email is verified; the free plan limits how many boards you can share. Remove them in the Share dialog to undo it.

NameTypeReqDescription
board_idstringyesBoard ID from list_boards, or the board URL.
emailstringyesTheir email address.

No output schema declared.

No examples provided.

list_boards ~152

Boards inside one board, by default the boards on your Home, with title, ID and link. Lists the boards one level down: on your Home, or inside parent_board_id. Boards nest like folders, so pass a board's id as parent_board_id to walk down. Order is the board's own: the canvas top to bottom, then Unsorted. parent_board_id in the answer is the Home board's id when you left it out. Boards in the trash are left out.

NameTypeReqDescription
limitinteger–1 to 200. Default: 50.
parent_board_idstring–Only boards inside this board (ID or board URL). Default: the boards on your Home.

No output schema declared.

No examples provided.

list_labels ~59

The labels you can put on cards, with name and colour. Labels are yours, not a board's: the same label can sit on cards across all your boards. add_label puts one on a card by name and creates it when it is new.

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

list_recent_boards ~104

Boards you opened lately, newest first, wherever they sit in your board tree. The list behind Milanote's search box before you type: every board you viewed, shared ones too, with when you last opened it and how many times. Home and Quick notes appear like any other board. Boards you have not opened since they were made are missing; list_boards walks the tree instead.

NameTypeReqDescription
limitinteger–1 to 50. Default 20.

No output schema declared.

No examples provided.

list_trash ~93

Cards and boards you moved to the trash, with the board each one came from. Lists your own trash, newest first: one entry per trashed card or board with its ID, content and board_id of the board it was on. restore_card puts one back where it was. Milanote keeps trashed items until you empty the trash in the app; has_more is true when it holds more than one page.

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

move_card ~181

Move a card or a sub-board to another board, or into or out of a column. Moves it the way drag and drop does, keeping its ID, comments and content. With to_column_id it goes to the top of that column; without it, to the top of the target board's Unsorted panel. Moving a board moves everything inside it. Moving to a board shared with other people shows it to them.

NameTypeReqDescription
board_idstringyesBoard the card is on now: ID or board URL.
card_idstringyesCard ID from get_board; a sub-board's board_id works too.
to_board_idstring–Board to move it to. Default: the same board.
to_column_idstring–Column on the target board to put it in, at the top. Default: no column.

No output schema declared.

No examples provided.

publish_board ~148

Turn on a board's read-only link, which anyone can open without signing up. Does what Share, Enable read-only link does and returns the link. Anyone who has it sees the board and the boards inside it, without a Milanote account. A board keeps one link: publishing again, even after unpublish_board, brings back the same link with these settings. unpublish_board turns it off.

NameTypeReqDescription
allow_commentsboolean–Let viewers of the link comment, react and draw. Default false.
allow_downloadsboolean–Show download links on files to viewers. Default true.
board_idstringyesBoard ID from list_boards, or the board URL.

No output schema declared.

No examples provided.

remove_editor ~134

Take away someone's access to a board, or cancel an invite they have not accepted. Removes one editor, by user_id or email, as the Share dialog's Remove does. They lose the board and the boards inside it unless a parent board is shared with them too; Milanote does not tell them. The owner cannot be removed. invite_editor adds them back.

NameTypeReqDescription
board_idstringyesBoard ID from list_boards, or the board URL.
emailstring–Their email address, instead of user_id.
user_idstring–Their user_id from get_sharing or invite_editor.

No output schema declared.

No examples provided.

rename_board ~80

Change a board's title. Renames the board everywhere it shows: its card on the parent board, the breadcrumb and search. The board_id and the links to it stay the same. Your Home cannot be renamed.

NameTypeReqDescription
board_idstringyesBoard ID from list_boards, or the board URL.
titlestringyesNew title.

No output schema declared.

No examples provided.

restore_card ~104

Take a card or board out of the trash and put it back where it was. Puts it back on the board, and in the column, it was trashed from, at its old place; a restored board comes back with its contents. column_id is set when it went back into a column. Only items in your own trash, as list_trash shows them.

NameTypeReqDescription
card_idstringyesID of a trashed card or board from list_trash.

No output schema declared.

No examples provided.

search_boards ~137

Find boards and cards by text across your boards, like the Search icon in Milanote. Runs Milanote's own search over every board you can open. Each result is a board, with the cards on it that matched (matches) and the boards above it (path). A board whose title matched has no matches. Sorted by when you last viewed the board, or last modified. Returns Milanote's first page of boards; use get_board on a result to read all its cards.

NameTypeReqDescription
querystringyesText to look for.
sortstring–last_viewed or last_modified. Default: last_viewed.

No output schema declared.

No examples provided.

set_card_color ~129

Colour the bar on top of a note, to-do list, link, file or column, or clear it. Sets one of Milanote's eleven card colours, as the Color tool does; none removes it. Boards and images take no colour here. Editors of the board see the change at once.

NameTypeReqDescription
board_idstringyesBoard ID from list_boards, or the board URL.
card_idstringyesCard ID from get_board: a note, to-do list, link, file or column.
colorstringyesColour, or none to clear it.

No output schema declared.

No examples provided.

set_task_done ~150

Tick or untick one task in a to-do list. Finds the task by task_id or by its exact text and sets it done or not done, as clicking its checkbox does; the rest of the list stays as it was. Returns the whole list after the change. When two tasks share the text, pass the task_id instead.

NameTypeReqDescription
board_idstringyesBoard ID from list_boards, or the board URL.
card_idstringyesTo-do list ID from get_board.
doneboolean–true ticks it, false unticks it. Default true.
taskstringyesThe task's task_id from get_board, or its exact text.

No output schema declared.

No examples provided.

trash_cards ~124

Move cards or sub-boards to the trash, as the Delete key does. The cards leave the board for everyone who can see it, and a trashed sub-board takes its contents with it. Nothing is gone for good: list_trash shows them and restore_card puts one back where it was, until the trash is emptied in Milanote.

NameTypeReqDescription
board_idstringyesBoard ID from list_boards, or the board URL.
card_idsarrayyes1 to 50 card IDs from get_board; a sub-board's board_id works too.

No output schema declared.

No examples provided.

unpublish_board ~97

Turn off a board's read-only link; people who had it can no longer open the board. Does what switching off Share, Enable read-only link does. Editors keep their access. publish_board turns the same link back on, so anyone who kept it can open the board again. was_published is false when the board had no link.

NameTypeReqDescription
board_idstringyesBoard ID from list_boards, or the board URL.

No output schema declared.

No examples provided.

Install

How do I install the Milanote by Cotlet MCP server?

Milanote by Cotlet runs locally as a PyPI package, launched with uvx milanote-api-mcp. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.

pypi · milanote-api-mcp

# add to Claude Code
claude mcp add dev-cotlet-milanote -- uvx milanote-api-mcp
Common questions

What is the Milanote by Cotlet MCP server?

Milanote by Cotlet is an MCP server listed in the public MCP registry as dev.cotlet/milanote. Boards, notes and links in your Milanote workspace. This page covers its PyPI package (milanote-api-mcp).

Is the Milanote by Cotlet MCP server safe to use?

Milanote by Cotlet scores 65 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 24 October 2026. Its build provenance is signed and verified. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

What tools does the Milanote by Cotlet MCP server expose?

Milanote by Cotlet exposes 30 tools: add_column, add_comment, add_label, add_link, add_note, and 25 more. Their descriptions and schemas cost roughly 3,838 tokens of context every time the server is loaded.

Is the Milanote by Cotlet MCP server still maintained?

Milanote by Cotlet is still listed as active in the MCP registry. We last reached this channel on 24 October 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.

What licence is the Milanote by Cotlet MCP server under?

Milanote by Cotlet declares the PolyForm-Noncommercial-1.0.0 licence, which is not on the OSI-approved list. Read the terms before using it at work, and note this covers the source only, not the cost of any service it calls.