WEEKKEEP

WEEKKEEP / FOR AGENTS

Your memories.
Your permissions.

Let an assistant help you reflect, keep a moment, or revisit what matters. You choose the connection, the permissions, and when access ends.

Manage connectionsRead the agent skill

Connect through MCP with your Weekkeep login, or use a scoped token for the REST API and private RSS.

01 / GET CONNECTED

A little help.
On your terms.

Connect with MCP

In a compatible assistant, add https://weekkeep.com/mcp as a remote HTTP MCP server and choose OAuth. Sign in with your Weekkeep passkey, review the requested read and write permissions, then confirm. No API key is needed.

Try “Find memories from last week and help me reflect.” Read access returns selected memories, saved place names, Compass and weekly reflections. Write access can create and edit these items, but cannot delete memories or manage your account. Revoke access under Settings → Connected apps.

Download the Weekkeep plugin bundle for hosts that support local plugin installation. Host support and installation steps vary.

Or use the REST skill and private feeds

  1. Choose a trusted tool.

    Use an agent that supports Agent Skills, HTTPS requests and secure credential storage. Save the Weekkeep skill as weekkeep/SKILL.md in the skill directory supported by your tool. Exact installation steps depend on the host.

  2. Create a connection.

    Sign in to Weekkeep, then open Settings → Agents & private feeds. Name the tool, choose its permissions and expiry, and confirm with your passkey. Your recovery kit must already be backed up.

  3. Store the token securely.

    The token appears once. Put it in the tool’s secret store. Never paste it into a prompt, a public document, a URL or source control. Never give an agent your passkey or recovery words.

  4. Start with a small request.

    Try “Help me reflect on last week’s memories.” For writing, review the proposed entry before asking the agent to save it. Revoke the connection in Settings whenever you are done.

02 / PERMISSIONS

Only the access
you choose.

PermissionWhat the tool can doWhat it cannot do
journal:readRead your complete cloud journal, including profile, memories, saved locations, Compass and reflections.Change the journal or manage your account.
journal:writeCreate, edit or delete memories and update supported journal fields.Read the journal unless read permission is also granted; change passkeys, create tokens or delete the account.
feed:readRead the latest 50 memories as private RSS.Read the complete journal or change entries.

The table describes REST tokens. MCP provides selected journal content without profile details or precise coordinates, and offers no deletion tool. OAuth connections last up to 90 days. Permissions apply to the whole issuing account, not a selected date or entry. Use a separate token for each tool. Connections expire after 7, 30 or 90 days; at most ten can be active.

03 / API & RSS

Clear contracts.
Private by default.

API guideAuthentication, event fields, conflicts and examples.OpenAPI 3.1Machine-readable routes and request contracts.llms.txtPublic discovery for agents. No journal content.Journal schemaThe shared data contract for validated journals.

Read, then write with a current revision.

GET /api/agent/journal returns the journal and its revision and sync epoch. POST /api/agent/events applies one validated event. Send the current revision and epoch; a stale value or paused sync returns 409. Re-read and review conflicts instead of blindly retrying. A write response contains a receipt, not the journal.

A feed that stays private.

GET /api/agent/feed.rss requires feed:read. Use an Authorization Bearer header, or HTTP Basic with username weekkeep and the full token as password. Choose a reader that supports authenticated feeds. Tokens in query strings are not accepted; there is no public subscription link.

Agent requests are limited to 60 per minute per token, with additional abuse limits. Expired or revoked credentials return 401; insufficient permissions return 403. Use a descriptive User-Agent such as WeekkeepAgent/1.0; the edge may block generic automated clients.

04 / PRIVACY & CONTROL

Know what
you are sharing.

A token is a bearer credential: anyone holding it can use its permissions until it expires or is revoked. Weekkeep checks the account, permission, expiry and recovery version on every request. Changing an account ID does not grant access to another journal.

Tokens are stored as hashes on the server. Private API responses are marked no-store and noindex. The public docs contain examples and contracts only. Rotating the recovery kit invalidates existing tokens; deleting the account removes them. Signing out of a browser does not revoke independent agent connections.

The tool you authorize receives the content it reads and may retain copies under its own policies. Revocation stops future access; it cannot erase downloaded copies. Paused sync means agents see the last cloud version, not newer local writing; agent writes are blocked until sync resumes.

The skill instructs agents to treat journal content as untrusted data, never as instructions to reveal secrets or send information elsewhere. Such instructions supplement server authorization; they cannot guarantee the behavior of an external agent.