add_attachment
ChatGPTAttach a file to a note. Give exactly one source: text or content_base64, each up to 2 MB. Larger files can be attached from disk only through a local Virlow MCP server. The file is encrypted on this side before upload, the same way the Virlow app does it. Requires the vault to be unlocked and the note to be in a folder exposed to AI.
add_memory
ChatGPTUse this when the user says 'remember', 'note that', 'from now on', or states a lasting preference or decision. Saves it to their Virlow memories (an opt-in they turned on); then confirm what was saved in one short line, for example "Saved to Virlow: prefers async standups". Do not store secrets, credentials, card or bank details, ID numbers, health information, one-off task details, or anything the user asked not to be remembered; text that looks like a credential, card, account or ID number is refused. The label is a short title; the text is the fact itself. Use namespace for project-specific facts (omit it for facts that apply everywhere). A near-identical memory is updated in place rather than duplicated. Memories are encrypted notes in the user's Memories folder that they can read, edit and delete in the Virlow app. Requires the vault to be unlocked. First use in this process downloads ~30MB of public embedding-model weights.
add_todo
ChatGPTAdd a task to the user's to-do list. list is one of their lists by name or id (leave it out for Tasks); an unknown name is an error, not a new list. due is a day (YYYY-MM-DD), my_day puts it in today's My Day, remind_at (ISO 8601, in the future) emails them, and Slack when connected. A repeat without a due day is due today. Task text and details are end-to-end encrypted; the server only sees whether a task is done and, for a reminder, when to send it. Requires the vault to be unlocked.
archive_note
ChatGPTArchive or unarchive a note by id. Requires the vault to be unlocked.
create_folder
ChatGPTCreate a new note folder, optionally nested under a parent folder. Requires the vault to be unlocked.
create_note
ChatGPTUse this when the user asks you to write something into Virlow as a new note. Creates a note with a title and content, optionally placed in a folder. Requires the vault to be unlocked. CONTENT FORMAT: content is HTML, not Markdown. Virlow renders it in a rich-text editor, so Markdown syntax is stored and displayed literally — "# Heading" appears as those characters, not as a heading. Use <h1>-<h4>, <p>, <strong>, <em>, <u>, <s>, <mark>, <ul>/<ol>/<li>, <blockquote>, <pre><code>, <a href>, <hr>, <img src>, and <table>/<tr>/<th>/<td>. Task lists are <ul data-type="taskList"> with <li data-checked="true|false">. Wrap every paragraph in <p>; a bare newline is not a paragraph break. STYLE: never use em-dashes (—). Use a comma, a colon, or two sentences.
create_todo_list
ChatGPTMake a new to-do list when the user asks for one, with an optional emoji and color (#rrggbb). Its name is end-to-end encrypted. Requires the vault to be unlocked.
define_property
ChatGPTDefine a new property on a folder, so every note in it can carry that field. Names must be unique within the folder. For a select or multiSelect, pass the option names in options; each gets an id, and set_properties then takes the option name, not the id. Requires the vault to be unlocked.
delete_attachment
ChatGPTMove an attachment to its note's Recently deleted. It can be restored for 30 days with restore_attachment, then it is deleted for good. Requires the vault to be unlocked and the note to be in a folder exposed to AI.
delete_memory
ChatGPTUse this when the user asks you to forget a saved memory or says it is wrong. Moves the memory with that id to the Trash: it stops being recalled immediately, and the user can restore it from the Virlow app. Requires the vault to be unlocked.
describe_entity
ChatGPTUse this when the user tells you what a saved name is, or after untyped_entities. Says what a name in the memories is: its kind, other names it goes by, and a short note ("Head of design at Acme"). The kind decides how the user sees it in Virlow (People, Places, Events...). Kinds: person; organization (companies, institutions); project; tool (software, services); place; event (meetings, trips, conferences, weddings); topic (subjects and interests); product (things and brands that are not software: a phone, a bike, a coffee brand); media (books, articles, papers, films, podcasts, contracts, decks); pet; group (informal groups: the family, a book club, a running crew); goal (goals and habits: run a marathon, learn Portuguese); other. Aliases fold other spellings into this entity without rewriting any memory (use merge_entities to rewrite them). A kind set here replaces any earlier one. To describe many names at once (after untyped_entities), pass them in more. Requires the vault to be unlocked.
get_backlinks
ChatGPTList the notes that link to a note. Built from encrypted per-note link records, so no note body is read. Requires the vault to be unlocked.
get_unlock_link
ChatGPTGet the link to the Virlow page where the USER unlocks their vault. Call this when a tool reports that the vault is locked, and share the link with the user. They open it in their own browser and enter their master password there. This tool cannot unlock anything itself and does not wait. Call the status tool afterward to confirm. Never ask the user for their master password or account credentials, and never relay a password through this tool or any other. It is entered only on that page and is never seen by any AI model.
link_memory
ChatGPTAdd entities and relations to an existing memory, for memories saved before they were linked. A relation that replaces an older fact ends that fact. Requires the vault to be unlocked.
list_attachments
ChatGPTList a note's attachments as JSON: id, filename, mime_type, size (bytes) and uploaded_at. Pass include_trashed to also list files in the note's Recently deleted, which carry deleted_at. Requires the vault to be unlocked and the note to be in a folder exposed to AI.
list_folder_view
ChatGPTRead a folder the way the app's table view shows it: one row per note, one column per property the folder defines, with each note's value already formatted. Use this instead of reading notes one by one when the question is about the shape of a folder, for example which items are in a given stage, who owns what, or what has no due date. Values come from the notes' structured fields, so no note body is read. Pass sortBy (a property id or name) to order the rows; notes with no value for it sort last. Requires the vault to be unlocked.
list_folders
ChatGPTList the note folders exposed to MCP. Folders the user has not switched on are not listed; the response says how many were withheld. Requires the vault to be unlocked.
list_memories
ChatGPTList cached memories, optionally filtered by namespace. Syncs with the server first so the list reflects the latest state across devices. Requires the vault to be unlocked.
list_notes
ChatGPTList notes with pagination, optionally filtered by folder or starred/archived state. Requires the vault to be unlocked.
list_properties
ChatGPTList a folder's property definitions: the typed fields every note in that folder can carry. Each line gives the property id, its name, its type, and for a select or multiSelect the option names a value may use. Requires the vault to be unlocked.
list_todo_lists
ChatGPTThe user's to-do lists with how many tasks are open in each: the smart lists (My Day, Important, Planned, Tasks) and the lists they made. Requires the vault to be unlocked.
list_todos
ChatGPTRead the user's to-do list. list is my_day, important, planned, tasks, or one of their own lists by name or id; leave it out for every open task. Each task comes with its id, list, due day, My Day, importance, steps, note, reminder and repeat. Task text and details are end-to-end encrypted; the server only sees whether a task is done and, for a reminder, when to send it. Requires the vault to be unlocked.
lock
ChatGPTImmediately lock the vault, discarding the in-memory decryption key and clearing all cached memories and notes. Use this when the user is done with a session or asks to lock explicitly. Safe to call even if already locked.
memory_context
ChatGPTUse this when a request depends on the user's own preferences, projects or history and there is no single topic to search for. Returns the most relevant saved facts: the entities this project talks about most and its most recent current facts, global memories included. Do not use for general knowledge. Requires the vault to be unlocked.
memory_health
ChatGPTHousekeeping for a tidy pass: memories not linked to any entity, names that look like one entity spelled two ways, facts that should hold one value but hold two, and names with no kind. Fix them with link_memory, merge_entities, update_memory, and untyped_entities with describe_entity. Requires the vault to be unlocked.
merge_entities
ChatGPTMake two names one entity, e.g. "Dana" into "Dana Whitfield": every memory naming the first is rewritten to name the second. Only merge names you are sure are the same. Requires the vault to be unlocked.
move_attachment
ChatGPTMove an attachment to another note. Both notes must be in folders exposed to AI, and the target must not be in the trash. Requires the vault to be unlocked.
move_note
ChatGPTMove a note into a different folder, or to no folder by passing folderId: null. Requires the vault to be unlocked.
read_attachment
ChatGPTRead an attachment. Text files (plain text, Markdown, CSV, JSON, XML, code) come back as text, cut at 200,000 characters. Other files up to 2 MB come back as base64 after a header line giving the filename, type and size; larger ones cannot be returned here. Files in Recently deleted can be read too. Requires the vault to be unlocked and the note to be in a folder exposed to AI.
read_dashboard
ChatGPTRead a workspace's dashboard: the blocks it shows, in order, with their settings. Use this before changing it, so a change replaces a known arrangement rather than guessing at one. Block kinds are counts, recent, starred, table, calendar, board, breakdown, upcoming, text and summary. Requires the vault to be unlocked.
read_note
ChatGPTRead the full title and content of a note by id. Requires the vault to be unlocked. Content comes back as the HTML the editor stores, so write it back in the same form. If the note carries structured attrs, a section after the content lists its properties, outgoing links, unlinked mentions, and aliases.
recall_entity
ChatGPTUse this when the user names a person, project, place or event and the answer depends on what they have saved about it. Returns what it is (kind, other names, a note), the facts about it, which are current and which have ended, and its relations to other entities. Do not use for public figures or general knowledge. Requires the vault to be unlocked.
rename_attachment
ChatGPTRename an attachment. Only the encrypted filename changes; the contents are untouched. Requires the vault to be unlocked and the note to be in a folder exposed to AI.
restore_attachment
ChatGPTBring an attachment back from its note's Recently deleted. Fails if the note is at its attachment size limit. Requires the vault to be unlocked and the note to be in a folder exposed to AI.
search_memory
ChatGPTUse this when a question or task depends on the user's own preferences, projects, people or past decisions on a specific topic. Searches their saved memories by meaning and returns the closest, best match first; use namespace to scope to a project. Do not use for general knowledge. Requires the vault to be unlocked.
search_notes
ChatGPTUse this when the user asks about something written in their Virlow notes. Full-text search over note titles and content, returning matching notes with a short snippet. Requires the vault to be unlocked.
set_dashboard
ChatGPTReplace a workspace's dashboard with the blocks given, in order. This is the whole arrangement, not a patch: blocks left out are removed. Run read_dashboard first and send it back with your change, or you will drop what the user had. The previous arrangement is kept so they can undo it. A summary block is the one whose text you write; every other kind is computed from the notes and takes only its settings. Kinds: counts, recent, starred, table, tasks, calendar, board, breakdown, upcoming, activity, stale, text, summary, pinned, quick. A table is a saved view: give it filters (all must match), a sort ({"by": <property id>|"title"|"@lastChanged"|"@created", "dir": "asc"|"desc"}) and a title, e.g. {"kind":"table","title":"Open proposals","filters":[{"propId":"<select id>","op":"is","value":"<option id>"}],"sort":{"by":"<date id>","dir":"asc"}}. tasks lists the unticked checklist items across the notes and takes the same filters. pinned is {"kind":"pinned","noteIds":[...]}: notes chosen by hand, in that order, for "keep these in front of me"; add "look":"notes" to draw them as sticky notes, and "colors":{"<note id>":"Amber"} to tint one (palette: Moss, Sage, Olive, Teal, Cobalt, Slate, Plum, Berry, Rose, Rust, Clay, Amber, Brass, Ash). quick is {"kind":"quick"}: a line to jot a new note and a New note button. Instead of blocks, preset ("project", "research" or "journal") applies a starting arrangement built from the workspace's own properties; read it back and adjust from there. Requires the vault to be unlocked.
set_properties
ChatGPTSet typed property values on a note. values is keyed by property name (or id) and takes plain values: a string, a number, true/false, a date like 2026-09-07, or an array for a multiSelect or relation. Use null to clear a property. For a select or multiSelect pass the option NAME, not its id; an unknown name is refused with the list of valid ones unless createOption is true, which adds it to the folder first. This changes only the note's properties, never its title or body. Run list_properties first to see what the folder defines. Requires the vault to be unlocked.
set_star
ChatGPTStar or unstar a note by id. Requires the vault to be unlocked.
status
ChatGPTReport whether the vault is currently locked or unlocked, and which account it's unlocked as. Call this after get_unlock_link to confirm the user finished unlocking, and before any memory/notes tool if you are unsure of the current lock state.
trash_note
ChatGPTMove a note to the trash by id. Requires the vault to be unlocked.
untyped_entities
ChatGPTNames in the memories that have no kind yet, most mentioned first, each with a few of the memories that name it and a suggested kind when the app can tell. Read them, decide what each is, then call describe_entity (with more for several at once). Skip a name you cannot place rather than guess; use kind "other" for one that is none of the kinds. Requires the vault to be unlocked.
update_memory
ChatGPTUse this when the user corrects a saved memory or says a saved fact has changed. Replaces the fields you give on the memory with that id; any field you omit is left alone, including metadata you do not name and the date the memory was first created. Tell the user in one short line what you changed. Requires the vault to be unlocked.
update_note
ChatGPTUse this when the user asks you to change an existing note. Updates the title and/or content of the note with that id. Only the provided fields are changed. Content replaces the note body entirely — read the note first if you mean to add to it. Requires the vault to be unlocked. CONTENT FORMAT: content is HTML, not Markdown. Virlow renders it in a rich-text editor, so Markdown syntax is stored and displayed literally — "# Heading" appears as those characters, not as a heading. Use <h1>-<h4>, <p>, <strong>, <em>, <u>, <s>, <mark>, <ul>/<ol>/<li>, <blockquote>, <pre><code>, <a href>, <hr>, <img src>, and <table>/<tr>/<th>/<td>. Task lists are <ul data-type="taskList"> with <li data-checked="true|false">. Wrap every paragraph in <p>; a bare newline is not a paragraph break. STYLE: never use em-dashes (—). Use a comma, a colon, or two sentences.
update_todo
ChatGPTChange a task by id (from list_todos): its text, done, due day, My Day, importance, note, list, repeat or reminder; add steps or tick steps off by id or exact text. done:true completes it, cancels its reminder and, when it repeats, adds the next one. null clears due, list (back to Tasks), repeat or remind_at. Task text and details are end-to-end encrypted; the server only sees whether a task is done and, for a reminder, when to send it. Requires the vault to be unlocked.
