nestornotes
Open-source command-line client for NestorNotes — your AI-powered knowledge base.
This CLI is a thin, auditable wrapper that talks to the hosted NestorNotes MCP server over the Model Context Protocol. Every line of code that runs on your machine is in this repository — read it before you install.
| Surface | Source | License |
|---|---|---|
| CLI client (this repo) | src/nestornotes/cli.py, npm/ |
MIT (open source) |
| MCP server (hosted) | Proprietary, runs at https://mcp.nestornotes.com/mcp |
Closed source |
The CLI is generated from the server's tool registry by fastmcp generate-cli — cli.py is regenerated each release and pushed here via PR. You can verify by reading the file directly: it's plain Python, no obfuscation.
Install
Via PyPI (recommended)
uv tool install nestornotes # or: pipx install nestornotes
nestornotes --help
Run ephemerally without installing: uvx nestornotes --help.
Upgrade: uv tool upgrade nestornotes (or pipx upgrade nestornotes).
Via npm
npm install -g nestornotes # requires `uv` on PATH (https://astral.sh/uv)
The npm package is a thin Node.js wrapper that proxies to the matching PyPI wheel via uvx — same Python code, different distribution channel.
Usage
nestornotes call-tool list_collections
nestornotes call-tool semantic_search --query "rust async"
nestornotes call-tool list_articles --collection-id <uuid> --limit 5
By default the CLI talks to https://mcp.nestornotes.com/mcp. Override per-environment:
NESTORNOTES_SERVER_URL=http://localhost:8000/mcp nestornotes call-tool list_collections
OAuth is handled automatically by FastMCP: the first tool call opens a browser for Supabase sign-in; the token is cached locally.
What this CLI does (and doesn't)
- Does: Parse your shell arguments → open an HTTPS connection to the configured MCP server → forward your call → print the JSON response.
- Does not: Execute any business logic locally. Cache anything but OAuth tokens. Send telemetry. Talk to anything other than the configured
NESTORNOTES_SERVER_URL.
You can verify all of the above by reading src/nestornotes/cli.py — it imports cyclopts (for argument parsing), fastmcp (for the MCP client), and rich (for output). That's it.
How updates happen
This repo is not hand-edited. When the NestorNotes server adds, changes, or removes a tool, an automated PR appears here with the regenerated cli.py. The PR contains exactly two artifact files (plus version bumps) — src/nestornotes/cli.py and src/nestornotes/SKILL.md — so you can diff each release against the previous one to see what changed.
Each release is tagged vX.Y.Z and triggers PyPI + npm publication via GitHub Actions (release.yml).
Verifying what you install
nestornotes --version
gh release view vX.Y.Z --repo nestornotes/nestornotes-cli
pip download --no-deps nestornotes==X.Y.Z
unzip -l nestornotes-X.Y.Z-py3-none-any.whl
The wheel contains exactly three files: __init__.py, cli.py, SKILL.md. Nothing more.
License
MIT. See LICENSE.
The CLI is open source. The MCP server it talks to is proprietary — but the interface (every tool name, parameter, and docstring) is fully documented here in cli.py.
Metadata
Release files for nestornotes 0.2.0
For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.
Source distribution (sdist)
| File | Size | Uploaded | Provenance | |
|---|---|---|---|---|
| nestornotes-0.2.0.tar.gz | 14.9 kB | With provenance | Details |
Built distribution (wheel)
| File | Interpreter | ABI | Platform | Reset |
|---|---|---|---|---|
| nestornotes-0.2.0-py3-none-any.whl | Python 3 | none | any | Details |
Total release size: 30.9 kB
Release files / nestornotes-0.2.0.tar.gz
| Download URL | nestornotes-0.2.0.tar.gz |
|---|---|
| Size | 14.9 kB |
| Tags | Source |
|
SHA-256 checksum How to use checksums |
919036b5689d46c1b27cfc4fd56f9a1d139a319c5a13554e6f4ebd86a7948d1b
|
|
BLAKE2b-256 checksum How to use checksums |
889e891def8a9345b13c00972f444a92913ff39f61b2cc740ba5a06232ebb9d0
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/6.1.0 CPython/3.13.12
|
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Jun 5, 2026.
Transparency logRelease files / nestornotes-0.2.0-py3-none-any.whl
| Download URL | nestornotes-0.2.0-py3-none-any.whl |
|---|---|
| Size | 16.0 kB |
| Tags | Python 3 |
|
SHA-256 checksum How to use checksums |
46ef43c586a14162a144c9d4830489a0e2f8a26328068f7c38bb27b7c382275b
|
|
BLAKE2b-256 checksum How to use checksums |
9f343fca41404ac0101d32694ce40ca2edcd2527f8468470f69d1b6eb83ba294
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/6.1.0 CPython/3.13.12
|
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Jun 5, 2026.
Transparency logSecurity for nestornotes 0.2.0
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
Full provenance
All 2 files in this release have been uploaded with provenance metadata.
Attestation for nestornotes-0.2.0.tar.gz
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Jun 5, 2026.
Transparency logA note on package security
PyPI is a repository for distributing packages, not a service for auditing them. While third-party security researchers and our staff do their best to detect and remove malicious packages, PyPI cannot guarantee the quality, security or suitability of any given package.
To learn more about protecting yourself from malicious actors, visit our package security documentation.