MCP manual

The endpoint is https://jot.winnersight.ai/mcp/. Use browser OAuth or a scoped Jot key. Jot checks the connected account before every operation. The operation reference lists the available tasks.

Authentication

Jot publishes protected-resource metadata and OAuth authorization-server metadata. It supports authorization code with S256 PKCE, dynamic client registration, Client ID Metadata Documents for supported platforms, refresh tokens, and revocation.

The jot OAuth scope gives access to Jot's author operations. The offline_access scope lets the client refresh its token. A connected application can read and change notes, media, and site settings, and export the account.

A manual key can use narrower permissions. Create it in Profile.

Find an operation

1. Call list_operations.
2. Select an operation identifier.
3. Call get_operation with that identifier.
4. Examine the path parameters, request body, and responses.

The catalog contains author operations, including private-site reader access. It excludes API key creation and author invitations.

Publish a note

Use publish_note for a new managed note. Put the page title in title. Put only the body in markdown; do not repeat the title as a Markdown heading. Set collection and tags as separate inputs. Do not put the collection in slug.

Run an operation

Pass operation and arguments to run_operation. Arguments can contain path, query, and body.

Use upload_media when the MCP client supplies a file. Jot downloads the file from the client's temporary file URL and adds it to the media library. The file must be a supported image or PDF and must not exceed 10 MB.

For clients without MCP file inputs, run media.upload with file.filename, file.mime_type, and file.content_base64.

For a note restore, use the note ID and revision number from the revision list.

{"operation":"revisions.restore","arguments":{"path":{"note_id":"NOTE_UUID","number":2}}}

Confirm the intended note before you restore or delete it. Permanent deletion cannot be undone in Jot. Set arguments.confirm to true for permanent Trash or media deletion. Set it to true when you remove a private-site reader or custom domain.

For a WordPress import, pass source in arguments.query. Set dry_run to 1 to inspect entries before you import them. The tool returns the completed import results after Jot finishes the event stream.

Export

export.request returns the account ZIP URL. Download it with the same OAuth access token or Jot key in the X-API-Key header. The MCP response does not contain the ZIP bytes.

Errors

A 401 means the token or key is invalid, expired, or revoked. A 403 means a manual key lacks permission. A 404 means the record is unavailable to the account. Check the saved state before you repeat a change after a lost response.