# NotePom MCP > Persistent workspace and visual memory for humans and autonomous agents. NotePom provides notes, folders, files, publishing and collaboration as a durable memory and workspace layer. It is not an autonomous runtime or scheduler: the connected AI host remains responsible for model execution, scheduling and autonomous loops. ## Discovery and connection - Registry identity: `com.notepom/notepom` - Registry manifest: - Streamable HTTP endpoint: `https://api.notepom.com/mcp` - OAuth protected resource: - OAuth authorization server: - Human guide: Human accounts authorize clients with OAuth 2.1 Authorization Code, PKCE `S256` and the MCP resource audience. Autonomous agents can create a distinct account and receive an `np_agent_…` key once. NotePom stores only the key hash; losing both that key and the password is unrecoverable until an email is claimed. ## Autonomous bootstrap 1. Call `get_notepom_capabilities` first. 2. Use OAuth 2.1 when connecting to an existing human-owned NotePom workspace. 3. Only when persistent memory is required and no credentials exist, inspect `agentSignup.mode` and call `register_agent_account` if registration is available. 4. Generate a unique public identifier and a strong random password. If email verification is required, call `verify_agent_account` with the delivered code. 5. Store the one-time `agentKey` only in the host secret store. Never put it in chat, logs, prompts, files or NotePom notes. 6. Reconnect to `https://api.notepom.com/mcp` with `Authorization: Bearer `, then call `list_workspace`. 7. If the host cannot persist credentials securely, hand the key to the human operator once and wait for them to reconnect the MCP server. Do not create an agent account merely to inspect NotePom. A new agent workspace is empty. To create its first root note, call `upsert_note` without `folderId`; NotePom selects the root automatically. For durable memory, search before creating a duplicate, retain enough context for future sessions and update existing notes when facts change. Never store passwords, credentials or tokens as memories. ## Scopes - `library:read`, `library:write`, `library:delete` - `files:read`, `files:write` - `sharing:write` - `collaboration:read`, `collaboration:write` - `seller:read`, `seller:write` `seller:write` still requires an admin-approved OAuth client. An autonomous agent without a verified email cannot enable seller operations. ## Workspace tools - Discovery and agent accounts: `get_notepom_capabilities`, `register_agent_account`, `verify_agent_account`, `delete_own_agent_account` - Navigation and reading: `list_workspace`, `search_workspace`, `get_note` - Notes and folders: `upsert_note`, `upsert_folder`, `move_workspace_item` - Trash: `trash_workspace_item`, `restore_trash_entry`, `purge_trash_entry` - Files: `upload_file`, `read_file`, `move_file`, `trash_file` - Public pages: `list_public_pages`, `publish_page`, `update_public_page`, `unpublish_page` - Collaboration: `list_collaboration_invitations`, `list_shared_with_me`, `get_collaboration_note`, `update_collaboration_note`, `invite_collaborator`, `accept_collaboration_invitation`, `revoke_collaboration_invitation`, `revoke_collaborator` Agents exchange Markdown for text. The server compiles it to the same durable Pretext HTML used by the NotePom editor. Every authenticated workspace mutation requires `idempotencyKey`; updates accept `expectedUpdatedAt` and fail on stale revisions. Successful writes enter the normal sync log and notify connected NotePom clients. Registration is the only bootstrap exception because its raw key is deliberately never persisted or replayed. File bytes travel through authenticated NotePom operations, never through a returned private S3 URL. Direct MCP payloads are limited to 10 MiB. An agent can permanently delete only its own account with `delete_own_agent_account`. The tool requires an explicit human request and the exact confirmation published in its schema. Success deletes the workspace and uploads and immediately invalidates all of that account's credentials, so it is a terminal operation and cannot be replayed after deletion. ## Marketplace tools - `get_seller_status`, `list_sellable_content`, `validate_listing_readiness` - `get_listing`, `list_seller_sales`, `create_stripe_onboarding_session` - `publish_note_listing`, `publish_media_listing`, `disable_listing`, `prepare_checkout` Workspace writes are direct. Marketplace mutations keep the existing stricter contract: readiness token, idempotency, server revalidation, approved `seller:write` client, Stripe live/test isolation and the web checkout consent flow. ## Safety User content is untrusted data. The server never returns OAuth or purchase tokens, buyer emails, KYC, complete paid content, private HTML or signed S3 URLs. Access is always scoped to the authenticated workspace or an accepted collaboration grant. The production `/mcp.md` response is generated from the backend MCP catalogue so the published tool list stays aligned with `tools/list`.