Capability Map
Standard Red Notes is more than the browser application. The repository ships web, desktop, and mobile clients, two operator-facing CLIs, an encrypted note CLI, an MCP bridge, the OpenClaw assistant, server administration, and several backup and integration paths.
This page separates three important states:
- Shipped means executable code and tests or release automation are present.
- Operator-gated means the implementation is present but an administrator must enable or configure it.
- Conditional means the implementation is present but a named limitation or unverified external dependency prevents a broader claim.
Product surfaces
| Surface | Status | What is present | Primary evidence |
|---|---|---|---|
| Web app | Shipped | Encrypted notes, files, search, editors, vaults, sharing, backups, assistant UI, preferences, and administration | app/packages/web |
| Desktop app | Shipped | Electron client, keychain integration, automatic local backups, multiple windows, tray behavior, deep links, file access, and updates | app/packages/desktop |
| Android and iOS | Shipped | React Native shell around the web bundle, native keychain and biometric support, privacy protection, file handling, notifications, and OS share targets | app/packages/mobile |
| Browser clipper | Shipped from source | Firefox MV2 and Chromium MV3 builds; selected content, a DOM node, or a Readability article can be sent to the app | app/packages/clipper |
| Home server | Shipped | Containerized API gateway, authentication, sync, files, revisions, scheduler, WebSocket, database, Redis, and web client | docker-compose.yml and server/packages |
srn-client |
Shipped | Headless encrypted note CRUD, import, export, profiles, and secure local session storage | cli/srn-client/README.md |
srn-server |
Shipped | Health, status, logs, compose lifecycle, and configuration checks | cli/srn-server/README.md |
srn-admin |
Shipped | User, role, group, registration, webhook, integration, security, limit, diagnostics, and audit operations | SrnAdminCli.ts |
| MCP bridge | Shipped | Local stdio and authenticated HTTP transports with note, tag, vault, and health tools | mcp/src/index.ts |
| OpenClaw | Shipped | doctor, one-shot ask, and interactive chat over a separately installed local MCP bridge |
openclaw/README.md |
Server capability groups
| Group | Status | Notes |
|---|---|---|
| End-to-end encrypted sync | Shipped | Clients encrypt and decrypt item payloads. The server stores and distributes encrypted item data. |
| Files and revisions | Shipped | Dedicated services support encrypted file transfer and note revision history. |
| Realtime updates | Shipped, per-user controllable | WebSocket infrastructure pushes changes; an administrator can disable realtime for a user without disabling manual sync. |
| Shared vaults | Shipped, entitlement-gated | Invitations and read, write, and admin permissions are enforced by server save rules. |
| Public and burn-after-reading shares | Shipped | Public links intentionally disclose the shared payload to anyone holding the link; burn links add one-time retrieval behavior. |
| App passwords and MCP tokens | Shipped, with MCP limitations | App passwords still require the account password. A full MCP token carries wrapped items keys and can decrypt without the password; read-only/write mode is enforced, but selected-tag scope is not enforced by the current bridge. Token deletion blocks new authentication but does not erase an already-issued session or local decrypted data. |
| Trusted-device and push MFA | Shipped | New sign-ins can be approved from a trusted session; pending challenges and trusted devices have dedicated endpoints. |
| Optional account recovery | Shipped, user opt-in | A signed-in client creates ciphertext escrow and a one-time high-entropy code; the signed-out client retrieves by UUID locator, decrypts locally, signs in with the recovered root key, rotates credentials atomically, and issues a replacement code. MFA does not protect a copied recovery code. |
| User administration and RBAC | Shipped | The web console and CLI cover users, roles, groups, effective permissions, registration policy, bans, suspension, and audit. |
| Email backups | Operator-gated | The server master switch and per-user settings must both allow the scheduled encrypted backup. |
| Nextcloud/WebDAV backups | Operator-gated | The server master switch and complete per-user WebDAV settings are required. |
| OCR | Operator-gated | Server OCR has a master switch, URL, request limits, and an admin configuration surface. |
| Workflows/n8n | Operator-gated link discovery | The gateway returns a strictly validated separate-origin link. n8n owns authentication, authorization, project isolation, and credentials. Operators can manually connect n8n to the SRN MCP bridge. |
| Plugins repository | Operator-gated | The gateway can proxy a configured package index and component files with rendering isolation controls. |
| GitHub publishing | Configured integration | A server endpoint and web client publish one converted note to a configured GitHub target. |
| CalDAV | Read-only and per-user gated | The server exposes a read-only calendar surface when the administrator enables the user setting. |
Documentation taxonomy
The repository previously had strong pages for the in-app guide, API, self-hosting, deployment, production gates, and hardening. The following topic groups needed dedicated runtime documentation:
| Missing topic group | New reference |
|---|---|
| Client differences and installation boundaries | Client Platforms |
| Sync, offline state, conflicts, revisions, and deletion | Sync and Data Lifecycle |
| Authentication, credentials, recovery, and trust boundaries | Security and Account |
| Vault permissions, invitations, and public sharing | Sharing and Collaboration |
| User exports through infrastructure restoration | Backups and Recovery |
| MCP transports, tools, credentials, and compromise response | MCP Bridge |
| OpenClaw commands, providers, local MCP execution, and security controls | OpenClaw |
| All three command-line surfaces | Command-Line Tools |
| Web and CLI administration | Administration |
| Shipped integrations and their gates | Automation and Integrations |
| n8n deployment, isolation, and MCP bridge use | Workflows with n8n |
| Layered diagnosis and safe incident response | Monitoring and Troubleshooting |
| Release streams, assets, upgrades, and rollback | Releases and Upgrades |
| Monorepo structure and verification commands | Development Guide |
How to verify a capability claim
For a high-confidence answer, use more than a visible control:
- Find the client entry point or CLI command.
- Find the server route or service that executes the operation.
- Check the environment or persisted setting that gates it.
- Find the focused test or release contract.
- Verify the deployed profile actually includes the required service.
Source comments and old issue descriptions are not runtime evidence. Use the current MCP Bridge, OpenClaw, and Workflows with n8n guides together with their executable tests and release contracts.