One command, user scope, and every project on the machine can reach the brain. The token is the bearer MCP_TOKEN; it never appears in a URL.
claude mcp add --transport http cortex \ https://<host>/api/mcp \ --header "Authorization: Bearer <MCP_TOKEN>"
claude.ai custom connectors cannot send headers, so they use the secret-URL alias instead: /api/s/<secret>/mcp. Add it once as a custom connector on the web, and it syncs to the iOS app and desktop on its own. The secret lives only in that URL and in the server's environment.
brain_ask reads the whole live corpus and cites the file it answered from. A deterministic verifier — no model, no network — then checks the quote against that file at that commit, and the stamp says exactly what that proves. A passage the brain has retracted (marked SUPERSEDED, CORRECTION, DEPRECATED, (was: "…") or Do not answer) comes back stamped SUPERSEDED rather than VERIFIED — verbatim is exactly what a stale answer looks like in a memory that keeps its corrections on the page.
This site’s split is a privacy boundary, not a design one. The overview, this guide, the tools reference and the demo map are public and carry nothing real — the demo map is the true renderer over synthetic placeholders. The live map and the console quote the actual brain, so they live behind the connector secret and answer an empty 404 to anyone else.