bear-notes-mcp

The server employs a hybrid architecture for safety: direct read-only access to the Bear SQLite database for performance, and sync-safe write operations via Bear's x-callback-url API to prevent data corruption and ensure iCloud compatibility. SQL injection risks are mitigated through parameterized queries. The use of 'child_process.exec' is confined to controlled macOS inter-application communication (osascript and bear://x-callback-url/), not arbitrary user-controlled command execution. The main security consideration is the requirement for Claude Desktop to have 'Full Disk Access' permission on macOS, which is a significant privilege but necessary for this local integration.