The full upstream README, mirrored here for reference. Install config, tool schemas, adoption signals, and an original overview live on the Heuresis listing page.
A Model Context Protocol (MCP) server that exposes a Heuresis workspace to any MCP-capable client (Claude Desktop, Claude Code, Cursor, Windsurf, custom agents). The server logs into the user's Heuresis account, talks to the same Supabase project the webapp talks to, and respects the same RLS. Webapp and MCP are two front-ends to one cloud workspace.
Current version: 1.0.0-rc.13.
Package name vs. command name. The npm package is
@heuresis/mcp; the command it installs isheuresis-mcp. A barenpx -y @heuresis/mcp(no subcommand) starts the MCP server fine, butnpx @heuresis/mcp logincan fail withheuresis-mcp: not foundbecause npx derives the command name from the scope-stripped package name (mcp), which doesn't match. To run a subcommand reliably on every npm/OS, name the binary explicitly with-p:
The CLI prints a device code and a one-click URL of the form
https://heuresis.app/device?code=XXXX-XXXX. Open it in your browser,
sign in if you aren't already, and confirm the device. The CLI polls
in the background and writes credentials to
~/.heuresis/credentials.json (chmod 600 on POSIX) the moment you
confirm. Subsequent runs of the MCP are silent.
The login flow rides three Supabase Edge Functions:
mcp-device-init, mcp-device-grant, and mcp-device-poll.
To unlink a machine: npx -y -p @heuresis/mcp heuresis-mcp logout, or open
Settings ▸ Connected devices in the webapp to revoke remotely.
npx -y -p @heuresis/mcp heuresis-mcp whoami confirms which account a machine
is currently linked to.
Claude Desktop. Edit
~/Library/Application Support/Claude/claude_desktop_config.json on
macOS, or %APPDATA%/Claude/claude_desktop_config.json on Windows:
Claude Code / Cursor / Windsurf. Drop a .mcp.json in the
workspace root:
Restart the client. The Heuresis tools appear in the tool menu.
Device pairing writes a refresh token to disk. That works great on a personal machine, but it does not survive disposable/ephemeral environments (CI runners, cloud agent containers, "Claude Code on the web"): the filesystem is wiped between runs, and a Supabase refresh token is single-use under rotation — so a token baked into config dies after the first session.
For those environments, skip pairing and let the server sign in fresh on every boot from your account email + password (a password is not consumed on use, so it works forever with no re-pairing). Set three env vars:
When HEURESIS_EMAIL + HEURESIS_PASSWORD are present they take precedence
over any credentials.json, and the MCP server authenticates per boot — no
device link required. Requirements:
HEURESIS_PASSWORD as a secret. Prefer a dedicated account if your
environment can only expose env vars that are visible to its users.When the MCP boots in cloud mode it subscribes to the workspace over
Supabase Realtime and notifies the client whenever a nodes, edges,
projects, or ideas row changes. Edits made in the webapp show up
in the agent's view without a manual refresh, and writes from one
MCP-connected client reach any other connected client the same way.
Pass --no-realtime to disable the subscription (useful if the
chatter is noisy or the client logs every notification). The
preference is saved to ~/.heuresis/config.json so the flag only
needs to be passed once.
34 tools total: 31 data tools against the cloud workspace, plus 3 operator tools that drive the same ideation operators the webapp uses.
Reads (10). get_workspace_summary, list_projects,
get_project_graph, list_concepts, list_edges, get_subtree,
get_concept, search_concepts, find_concepts,
list_recent_decisions. Most agent sessions start with
get_workspace_summary or list_projects.
Writes (21). Concepts: add_concept, update_concept,
bulk_add_concepts, set_parent, validate_concept, set_standing,
archive_concept, unarchive_concept, star_concept,
remove_concept. Edges: link_concepts, add_kref. Ideas:
create_idea, rename_idea, recolor_idea, set_idea_members,
add_to_idea, delete_idea. Projects: create_project,
update_project, delete_project. Every write stamps a row in
public.provenance with origin='mcp' so the webapp's session log
shows which surface made the change.
Operator runs (3). run_operator (generate candidates with
Branch / Matrix / ASIT / TRIZ / Combine / Free / Contradiction),
run_operator_and_commit (same, plus commit the result in one
round-trip), and expand_concept (recursive Branch, capped at depth ×
breadth ≤ 60).
Tool input shapes mirror their counterparts in the webapp's
src/agent/tools.ts, so an agent that uses both surfaces sees a
uniform contract.
Wave-shipping: find_in_files (in-browser embedding search) is in the
webapp but not yet on the MCP.
The original read-only snapshot reader still works as a fallback while
users migrate to cloud auth. With no ~/.heuresis/credentials.json
and the HEURESIS_SNAPSHOT env var set, the server reads a JSON
export from disk and exposes the original read-only tool set
(get_workspace_summary, list_projects, search_concepts,
get_concept, get_subtree, get_project_graph,
list_recent_decisions).
This path is deprecated and will be removed in a later release. It is here so existing setups keep working through the migration to cloud auth.
AGPL-3.0-or-later.