Documentation · Claude and credentials
Wiring it in, and what leaves your Mac.
How a brain reaches Claude Code and Claude Desktop, where credentials are kept, and a plain account of what crosses the network and what never does.
Nothing is hosted and nothing is uploaded: a brain is a folder you own. The one exception is spelled out below, in the section on what indexing sends.
Connecting Claude
$ brain connect-claude ~/clients/acme # Claude Code
$ brain connect-claude ~/clients/acme --desktop # ...and Claude Desktop| Flag | Effect |
|---|---|
(none) | Connects Claude Code via CLAUDE.md and hooks. The low-risk default. |
--desktop | Also registers a graphify-mcp MCP server in claude_desktop_config.json, pointed at this project's graph.json. |
--trust-desktop | Appends the project to localAgentModeTrustedFolders. Additive — existing entries are never replaced. |
claude_desktop_config.json is backed up to .bak-<timestamp> before any edit. Restart Claude Desktop to pick up the change.
Credentials
Connector credentials live in the macOS Keychain — the same place Safari keeps your logins — and only there. Connectors read them at run time.
$ brain secret set graphify-acme-hubspot # prompts, hidden as you type
$ brain secret get graphify-acme-hubspot # debugging only; prints bare, for pipingA secret never reaches registry.yaml, a CLI argument, or shell history. Process arguments are readable by anything running as the same user for as long as the command runs, and they land in ps output and launchd logs — so the value is written to security's stdin instead of passed as an option.
What else is worth knowing before you review this
- Your data never leaves the machine. Sources are read locally or pulled from their own APIs, written into a folder you chose, and indexed there. There is no server and no account. The one exception is what you send when a model indexes your documents — the same trust boundary you already accepted by using Claude.
- Connector scripts are executed.
brain syncruns everyconnectors/<name>/sync.pyin the target project. A brain built from an untrusted project directory runs whatever those scripts contain. - Content pulled off the web is untrusted text, not instructions. The usual prompt-injection caution applies to anything a connector brings in. Record titles are escaped on the way into YAML and printed without markup interpretation.
- Removing a brain from the list deletes nothing.
brain forgetremoves the entry and touches nothing inside the folder. Deleting a client's knowledge base for real isrm, deliberately, by a human. - The source is the product. Every connector brainiphy generates is a readable Python file in your own project, which you can open, diff and change. Nothing is compiled and nothing is hidden. MIT licensed.
Security issues go to a private advisory, not a public issue.