claude-desktop-extension-bear-notes

The server is explicitly designed for local-only operations, with no external network connections for data transfer, significantly reducing data leakage risks. It interacts with the Bear Notes local SQLite database for read operations and uses Bear's X-callback-URL API for write operations, both of which are local inter-application communication mechanisms. SQL queries use parameterized statements to prevent SQL injection, and user inputs for X-callback-URL are properly URL-encoded to mitigate command injection. No 'eval' or intentional obfuscation is present. The use of `--experimental-sqlite` directly from Node.js avoids third-party binaries, addressing a specific supply chain risk. While no system is entirely foolproof, the architecture and implementation demonstrate a strong focus on security and privacy.