Mcp Logseq — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited Mcp Logseq (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Python stdio MCP server for the Logseq local HTTP API.
In Logseq, enable the HTTP API from settings and copy the token. The server calls Logseq at http://127.0.0.1:12315/api by default.
python -m venv .venv
.venv/bin/pip install -e ".[dev]"From this project directory, install the package and add the stdio MCP server to Codex:
python -m venv .venv
.venv/bin/pip install -e .
codex mcp add logseq \
--env LOGSEQ_API_TOKEN=your-token \
--env LOGSEQ_API_URL=http://127.0.0.1:12315/api \
-- "$(pwd)/.venv/bin/mcp-logseq"On Windows PowerShell, use the virtualenv executable under .venv\Scripts:
py -3.11 -m venv .venv
.\.venv\Scripts\python.exe -m pip install -e .
codex mcp add logseq `
--env LOGSEQ_API_TOKEN=your-token `
--env LOGSEQ_API_URL=http://127.0.0.1:12315/api `
-- "$((Get-Location).Path)\.venv\Scripts\mcp-logseq.exe"Replace your-token with the token from Logseq. After adding it, restart Codex so the new MCP server is loaded.
If you prefer to edit the config manually, generate the JSON form from this checkout:
.venv/bin/mcp-logseq --print-configOn Windows:
.\.venv\Scripts\mcp-logseq.exe --print-configThe server is stdio-only for MCP clients. The LOGSEQ_API_URL value is the local Logseq HTTP API that this stdio server calls behind the scenes.
LOGSEQ_API_TOKEN in the codex mcp add command.LOGSEQ_API_TOKEN=your-token mcp-logseqOn Windows PowerShell:
$env:LOGSEQ_API_TOKEN = "your-token"
.\.venv\Scripts\mcp-logseq.exeThe server uses stdio transport by default. Do not run it behind an HTTP server for MCP clients that expect stdio.
Optional environment variables:
LOGSEQ_API_URL: full API URL, default http://127.0.0.1:12315/apiLOGSEQ_TIMEOUT: request timeout in seconds, default 15Run the full local test suite:
.venv/bin/python -m pytestOn Windows:
.\.venv\Scripts\python.exe -m pytestThe suite covers the Logseq HTTP client, environment loading, MCP config generation, stdio startup, and every exported server tool's Logseq API method/argument mapping.
Generate a ready-to-copy config from this checkout:
.venv/bin/mcp-logseq --print-configOn Windows:
.\.venv\Scripts\mcp-logseq.exe --print-configThen paste the JSON into your MCP client's config. A static example is also available in mcp.example.json.
{
"mcpServers": {
"logseq": {
"command": "/absolute/path/to/mcp-logseq/.venv/bin/mcp-logseq",
"args": [],
"env": {
"LOGSEQ_API_TOKEN": "your-token",
"LOGSEQ_API_URL": "http://127.0.0.1:12315/api"
}
}
}
}Windows manual config example:
{
"mcpServers": {
"logseq": {
"command": "C:\\Users\\you\\path\\to\\mcp-logseq\\.venv\\Scripts\\mcp-logseq.exe",
"args": [],
"env": {
"LOGSEQ_API_TOKEN": "your-token",
"LOGSEQ_API_URL": "http://127.0.0.1:12315/api"
}
}
}
}Generic:
logseq_call: call any Logseq API method by name.App and graph:
get_current_graphget_current_graph_configsget_current_graph_favoritesget_current_graph_recentget_current_graph_templatesget_user_configsget_app_infocheck_current_is_db_graphPages and blocks:
get_current_pageget_current_blockget_current_page_blocks_treeget_all_pagesget_pageget_page_blocks_treeget_page_linked_referencesget_page_propertiesget_pages_from_namespaceget_pages_tree_from_namespaceget_blockget_block_propertiesget_block_propertyget_previous_sibling_blockget_next_sibling_blocksearchQueries:
querydatascript_queryPage editing:
create_pagecreate_journal_pagerename_pagedelete_pageBlock editing:
append_block_in_pageprepend_block_in_pageinsert_blockinsert_batch_blockmove_blockupdate_blockremove_blocknew_block_uuidset_block_collapsedset_block_iconremove_block_iconProperties and tags:
get_all_tagsget_all_propertiesupsert_block_propertyremove_block_propertyupsert_propertyremove_propertycreate_tagget_tagget_tags_by_nameget_tag_objectsadd_block_tagremove_block_tagadd_tag_extendsremove_tag_extendsadd_tag_propertyremove_tag_propertyAssets and Git:
list_asset_filesmake_asset_urlopen_assetgit_execgit_load_ignore_filegit_save_ignore_fileTools that modify the graph are intentionally direct wrappers around Logseq's API. Use them with explicit page names, UUIDs, and content. Plugin callback/hook APIs are not exposed as first-class tools because a stdio MCP server cannot host interactive Logseq plugin callbacks; use logseq_call only for one-shot methods.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.