Connect your AI
Your AI can ask. You choose what it can read.
Selv opens a read-only connection on your Mac. Claude, Cursor, VS Code and other tools that support the Model Context Protocol can ask about the sources you authorise. Selv retrieves the answer locally and records the context it returns.
A connected tool receives the context you allow it to read. If it uses a cloud AI service, that provider may process the returned context under its own terms. The local access log records what was read; it does not control what the tool does next.
Add Selv to your client
One click configures the client. Selv itself is where you authorise it — the button never carries a token, because there is no token to carry until you say yes.
Before you click
Selv has to be installed, and the server runs on Node, so Node must be on your PATH. If your client reports the server failing to start, Selv's own Settings › AI Agents pane resolves the real path on your machine and is the authoritative fix.
No token is ever copied, pasted, or shown to you — and none of these links contains one.
Or configure it by hand
Any client that keeps a servers map takes this directly. Claude Desktop takes this form too.
{
"mcpServers": {
"selv": {
"type": "stdio",
"command": "node",
"args": [
"/Applications/Selv.app/Contents/Resources/mcp/index.cjs"
],
"env": {
"SELV_MCP_CLIENT_ID": "cursor",
"SELV_MCP_CLIENT": "Cursor"
}
}
}
}Claude Code
One line, if you use it.
claude mcp add selv --env SELV_MCP_CLIENT_ID=claude-code --env SELV_MCP_CLIENT='Claude Code' -- node /Applications/Selv.app/Contents/Resources/mcp/index.cjsWhat happens next
- 1.Your client adds Selv to its config and tries to start the server.
- 2.Open Selv → Settings → AI Agents. The client is listed as waiting.
- 3.Click Authorize. Selv writes a token file only that client can read.
What the door actually is
Verified against the shipping server rather than described from a design document.
Three tools, and no way to write
search, timeline and journal. Every one is annotated read-only, and the server exposes no write path at all — there is nothing an agent could change even if it tried.
Loopback only
The server talks to Selv over 127.0.0.1. There is no address to reach it from anywhere else, because there is no address.
One approval per grant, not per request
One Touch ID approves one client for about an hour. Calls inside that window ride the approval; a denial fails closed and holds a short cool-down, so a retrying agent cannot flood you with prompts.
A locked Mac is a closed door
Screen lock closes the door on a separate, universal layer. An agent asking during a lock gets a distinct answer from an agent asking while you are being prompted — so it can tell waiting from refused.
Revocation bites on the next call
Grants are checked per request against a file Selv owns. Withdraw one and the very next call is refused.
- search
- Hybrid semantic and keyword search across the corpus. Returns snippets with their source and timestamp.
- timeline
- A chronological view of captured activity around a given moment. Defaults to a 30-minute window, capped at 12 hours.
- journal
- Reads journal entries: one day, a date range, or a search within them.
What did agents read?
Every call an agent makes writes a line: which client, which tool, what it asked, how much came back, how long it took.
One row per call — the ledger is the product promise.
It is not a network monitor.
One honest limit, because you would find it anyway: the log is written by the Node server running under your client's own configuration. It is a record, not a wall. The wall is the grant — and the grant is enforced inside Selv.
One line about where this goes
Agents ask; you own the seat. Not a marketplace — a door, with a lock you control and a record you can read.