Provides a pre-execution gate for AI agents to review Git changes, scan for secrets, and enforce human-approved path boundaries.
Also known as manumarri-sudo/quill, quillx
- Stars
- 0
- Tools
- —
- Downloads, 30 days
- 71
- Latest version
- 0.2.0a5
- Last commit
- Nov 10, 2026
- License
- MIT
What is Notari MCP?
Notari provides a pre-execution gate for AI agents to review Git changes, scan for secrets, and enforce human-approved path boundaries.
Summary generated from the project's README
About Notari MCP server
Quill provides a pre-execution security layer for AI agents by reviewing Git changes before they are finalized. It functions as a gatekeeper that scans for 26 different vendor-format secret patterns and identifies workflow edits that require human inspection. Developers can use this tool to ensure that automated changes do not introduce credentials or modify sensitive files without oversight.
The system operates through a command line interface and can be integrated into GitHub Actions or used as local hooks for tools like Claude Code and Cursor. Users manage permissions through signed boundaries, where commands like notari begin and notari guard allow humans to define and sign specific paths an agent is allowed to touch. The tool produces a Change Passport containing signed JSON and Markdown evidence to maintain a verifiable audit trail of all modifications.
What you can do with it
- 1Scan for leaked credentialsAn AI agent can run a scan to check if any committed changes contain sensitive vendor-format secrets.
- 2Enforce path boundariesA developer can restrict an AI agent to only modifying specific files approved for a particular task.
- 3Audit agent tool requestsYou can use local hooks to inspect and record decisions made when an agent requests to use a tool.
- 4Verify change evidenceA reviewer can use the verification command to ensure the evidence provided for a pull request is authentic.
Written from the project's README. Every use case is checked against a quote from it.
How to install Notari MCP
Formats verified 10 Nov 2026Add to CursorAdd to GooseInstall Notari MCP in Claude Code
$ claude mcp add quill -- uvx quillxInstall Notari MCP in Cursor
~/.cursor/mcp.json
{
"mcpServers": {
"quill": {
"command": "uvx",
"args": [
"quillx"
]
}
}
}Install Notari MCP in VS Code
.vscode/mcp.json
{
"servers": {
"quill": {
"type": "stdio",
"command": "uvx",
"args": [
"quillx"
]
}
}
}Install Notari MCP in VS Code CLI
$ code --add-mcp '{"name":"quill","type":"stdio","command":"uvx","args":["quillx"]}'Install Notari MCP in Claude Desktop
claude_desktop_config.json
{
"mcpServers": {
"quill": {
"command": "uvx",
"args": [
"quillx"
]
}
}
}Install Notari MCP in Codex
$ codex mcp add quill -- uvx quillxInstall Notari MCP in Codex config.toml
~/.codex/config.toml
[mcp_servers.quill] command = "uvx" args = ["quillx"]
Install Notari MCP in Gemini CLI
$ gemini mcp add -s user quill uvx -- quillxInstall Notari MCP in Gemini settings.json
~/.gemini/settings.json
{
"mcpServers": {
"quill": {
"command": "uvx",
"args": [
"quillx"
]
}
}
}Automated checks
Ran Nov 14, 2026Full report →Passed our automated checks. That is not a security audit: read the code and give the server the narrowest access it needs. How checks work
- Source repository linked and reachablemanumarri-sudo/quill is public and reachablegithub.com/manumarri-sudo/quill ↗Pass
- Package names this repository as its sourcequillx names manumarri-sudo/quill as sourcepypi.org/project/quillx/ ↗Pass
- Build provenance (Sigstore attestation)No build attestation published for this releaseNot checked
- Open source license (OSI)MITspdx.org/licenses/MIT.html ↗Pass
- Commit or release in the last yearLast commit or release 2026-11-10github.com/manumarri-sudo/quill ↗Pass
- OpenSSF ScorecardNot checked
- Package name not close to a popular packageNo popular package one edit away from quillxPass
- No critical advisory in the package or its dependencies41 resolved dependencies checked; no critical advisoryosv.dev ↗Pass
- No hidden instructions to the model0 tool descriptions and the README read; no override phrases, credential paths or hidden charactersPass
- Destructive tools are labelledNot checked
- Remote endpoint answers the MCP handshakeNot checked
README
View on GitHubNotari
Notari is an open-source alpha for reviewing committed Git changes. Its scan flags workflow edits, checks for 26 vendor-format secret patterns, and calls out files that deserve a closer look. An optional signed boundary checks which paths a human approved for a task.
Try the scan
Install uv on macOS
or Linux. Run this from a Git branch with a committed change and substitute the
branch it targets if that branch is named something other than main.
uvx notari scan --base main --no-passport
| Result | What it means | Exit |
|---|---|---|
| PASS | The scan found no matching checks to flag. | 0 |
| NEEDS_REVIEW | A change needs inspection, such as a lockfile, test, or low-confidence credential pattern. | 0 |
| BLOCK | The scan found a blocking change or could not complete its coverage. | 1 |
| Error | The command could not produce a verdict. | 2 |
The scan compares commits. Commit the changes you want included. Omit
--no-passport to save the unsigned JSON and Markdown evidence in .notari/.
Run notari explain to see the findings and suggested fixes.
Add it to GitHub
Copy the scan workflow into
.github/workflows/notari-scan.yml on your default branch. It fetches the
candidate commit for inspection and posts notari/scan to the PR head.
Follow the GitHub setup in the quickstart
to verify the status and set it as required. Repositories with GitHub Actions
event restrictions may need a workflow-specific policy.
Signed change control
Run notari init to generate keys, sign an initial perimeter, and write a
workflow. Use notari guard to set the standing boundaries, notari begin
to sign a task and its allowed paths, and notari verify --strict with the
trusted approver key to check a change. A configured gate signing key signs the
resulting Change Passport. A reviewer can use notari verify-passport with
the trusted gate public key and the expected PR head to verify that evidence.
The signed quickstart walks through this setup.
Local hooks and audit
The optional Claude Code and Cursor hooks inspect supported tool requests
before execution. They can ask for approval or block a request and record the
decision. Use notari doctor to check your setup, notari audit show to inspect
recorded decisions, and notari audit verify to check the local audit chain.
The CLI sends no telemetry by default.
The security model describes the rule coverage, key placement and local-hook limits. A scan PASS describes the checks applied to the Git change. Human review remains necessary for the behavior of the code. Keep private keys separate from an agent's working environment.
Releases and security
The package is available on PyPI through Trusted Publishing. GitHub builds publish provenance attestations. The security policy explains how to report a vulnerability privately, and the changelog records fixes and limitations.
See contributing for development and testing for verification. The code is available under the MIT license.
Notari MCP questions
How do I add Notari MCP to Claude Code?
Run claude mcp add quill -- uvx quillx in your terminal. Add --scope user to make it available in every project.
How do I add Notari MCP to Cursor?
Open ~/.cursor/mcp.json and add the server under mcpServers, using the Cursor config shown in the install section above.
What does the scan do?
The scan flags workflow edits, checks for 26 different vendor-format secret patterns, and identifies files that require closer inspection.
How can I inspect recorded decisions made by AI hooks?
You can use the command 'notari audit show' to inspect recorded decisions.
What are the possible scan results?
Results include PASS (no matching checks), NEEDS_REVIEW (requires inspection), BLOCK (blocking change found), or Error (command failed).