rustpad-mcp

Real OT edits, not overwrites
append_to_document and replace_in_document retain everything they do not touch, and the Rustpad server transforms concurrent edits — a human typing in the same pad at the same moment loses nothing. The model shows up in the pad as a named collaborator.
Built for an unauthenticated world
Rustpad has no accounts, so every pad is untrusted by definition. All content that comes out of a pad — reads, metadata, even upstream error bodies — is explicitly marked as data, never instructions, before a model sees it.
Eight tools, or three
RUSTPAD_READ_ONLY=true registers the read tools and nothing else. RUSTPAD_ALLOW_TOOLS cuts finer — essential for a curated five, your own comma-separated list, or a whole family with list_* — and RUSTPAD_DENY_TOOLS subtracts. Whatever is filtered out does not exist on the protocol rather than failing when called, and a name that matches no tool stops the server at startup instead of quietly going missing.
A person is asked, not just told
Replacing a non-empty pad, or search-replacing in more than one place at once, raises a real dialog through MCP elicitation — one the model cannot answer on its behalf, and one that says how many places are about to change. Where the client cannot show a dialog it falls back to a single-use token bound to the pad and the exact edit, and says so rather than implying somebody approved. ELICITATION=false takes the fallback path deliberately; it never removes the guard.

rustpad-mcpCollaborative pads your AI can read and edit alongside you