{"id":51280176,"url":"https://github.com/supermarsx/standard-red-notes","last_synced_at":"2026-06-30T01:03:08.145Z","repository":{"id":366613187,"uuid":"1256082085","full_name":"supermarsx/standard-red-notes","owner":"supermarsx","description":"Enhanced end-to-end notes and files. Take your notes and give them superpowers.","archived":false,"fork":false,"pushed_at":"2026-06-22T15:11:35.000Z","size":38550,"stargazers_count":1,"open_issues_count":0,"forks_count":0,"subscribers_count":1,"default_branch":"main","last_synced_at":"2026-06-22T16:24:08.542Z","etag":null,"topics":["collaboration","encrypted","evernote","markdown","memo","note-taking","notecard","notes","notes-app","obsidian","open-source","own-your-data","privacy","secure","self-hosted","snippets","standard-notes","todolist"],"latest_commit_sha":null,"homepage":"","language":"TypeScript","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"agpl-3.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/supermarsx.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":".github/funding.yml","license":"LICENSE.md","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null},"funding":{"github":"supermarsx"}},"created_at":"2026-06-01T12:52:02.000Z","updated_at":"2026-06-22T15:14:04.000Z","dependencies_parsed_at":null,"dependency_job_id":null,"html_url":"https://github.com/supermarsx/standard-red-notes","commit_stats":null,"previous_names":["supermarsx/standard-red-notes"],"tags_count":1,"template":false,"template_full_name":null,"purl":"pkg:github/supermarsx/standard-red-notes","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/supermarsx%2Fstandard-red-notes","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/supermarsx%2Fstandard-red-notes/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/supermarsx%2Fstandard-red-notes/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/supermarsx%2Fstandard-red-notes/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/supermarsx","download_url":"https://codeload.github.com/supermarsx/standard-red-notes/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/supermarsx%2Fstandard-red-notes/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":34948227,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-05-26T15:22:16.424Z","status":"online","status_checked_at":"2026-06-29T02:00:05.398Z","response_time":58,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["collaboration","encrypted","evernote","markdown","memo","note-taking","notecard","notes","notes-app","obsidian","open-source","own-your-data","privacy","secure","self-hosted","snippets","standard-notes","todolist"],"created_at":"2026-06-30T01:03:06.923Z","updated_at":"2026-06-30T01:03:08.138Z","avatar_url":"https://github.com/supermarsx.png","language":"TypeScript","funding_links":["https://github.com/sponsors/supermarsx"],"categories":[],"sub_categories":[],"readme":"# Standard Red Notes\n\n[![GitHub stars](https://img.shields.io/github/stars/supermarsx/standard-red-notes?style=flat\u0026logo=github)](https://github.com/supermarsx/standard-red-notes/stargazers)\n[![GitHub forks](https://img.shields.io/github/forks/supermarsx/standard-red-notes?style=flat\u0026logo=github)](https://github.com/supermarsx/standard-red-notes/network/members)\n[![GitHub issues](https://img.shields.io/github/issues/supermarsx/standard-red-notes?style=flat\u0026logo=github)](https://github.com/supermarsx/standard-red-notes/issues)\n[![Last commit](https://img.shields.io/github/last-commit/supermarsx/standard-red-notes?style=flat\u0026logo=github)](https://github.com/supermarsx/standard-red-notes/commits)\n[![Top language](https://img.shields.io/github/languages/top/supermarsx/standard-red-notes?style=flat)](https://github.com/supermarsx/standard-red-notes)\n[![CI](https://img.shields.io/badge/CI-see%20Actions-lightgrey?style=flat\u0026logo=githubactions)](https://github.com/supermarsx/standard-red-notes/actions)\n[![License: AGPL-3.0](https://img.shields.io/badge/License-AGPL--3.0-blue.svg?style=flat)](LICENSE.md)\n\n\u003e A friendly, private, **end-to-end encrypted** notes app you run yourself — with\n\u003e every feature included, no paid tier, and nothing gatekept.\n\nStandard Red Notes is an open, AGPL-3.0 licensed, **self-hosted fork of\n[Standard Notes](https://standardnotes.com)**. It keeps the things that make\nStandard Notes great — strong end-to-end encryption, a clean cross-platform\nclient, and a sync server you can host yourself — and removes the part that\ngets in the way: the subscription. Where the upstream project puts a number of\nfeatures behind a paid plan, this fork ships **the full feature set on by\ndefault**. The server runs with `STANDARD_RED_FEATURES_MODE=included`, so\nfeature and subscription checks return full access without any subscription\nprovisioning. You host it, you own the data, and nothing is held back.\n\nThis is an independent project and is **not affiliated with, sponsored by, or\nendorsed by Standard Notes**. Upstream copyright and attribution are preserved.\n\n\u003e New here and want to *use* the app? Read the\n\u003e [onboarding guide](docs/onboarding.md) — accounts, editors, organizing notes,\n\u003e the AI assistant, and what stays private. Want to *run a server*? Jump to the\n\u003e [Docker quickstart](#docker-quickstart) or the full\n\u003e [self-hosting guide](docs/self-hosting.md).\n\n## Table of contents\n\n- [Why this fork](#why-this-fork)\n- [What's different / improved](#whats-different--improved)\n- [Feature comparison](#feature-comparison)\n- [Repository layout](#repository-layout)\n- [Docker quickstart](#docker-quickstart)\n- [Building from source](#building-from-source)\n- [Command-line tools](#command-line-tools)\n- [API](#api)\n- [License](#license)\n\n## Why this fork\n\nStandard Notes is genuinely great software — strong end-to-end encryption, a\nclean cross-platform client, and a self-hostable sync server. But upstream\ndevelopment has largely stalled, and a project this good shouldn't be allowed to\nquietly slide into abandonware. **This fork is, first and foremost, about\nmodernization: keeping great software alive, current, and moving forward instead\nof letting a vacuum form around it.** Concretely, that means an updated\ndependency stack and toolchain, refreshed builds and Docker/reverse-proxy setup,\nongoing bug fixes, and a steady stream of new capabilities — so you're running a\nliving, maintained codebase rather than a frozen snapshot of an app that\ndeserves to keep going.\n\nThe second thing it changes is the business model. Standard Notes gates some of\nthe nicer features behind a subscription; if you are happy to run your own\nserver, you do not need that gate. Standard Red Notes takes the AGPL-3.0 source\nand makes the self-hosted product the first-class target:\n\n- **No paid tier, nothing gatekept.** Every included feature is on for every\n  account on your instance. There is no \"upgrade to unlock\" and no subscription\n  to provision — full access is the baseline product mode, not a perk.\n- **Self-hosted first.** The defaults target your own server, not a hosted\n  service. One setup script generates a complete `.env` with secure secrets and\n  brings the Docker Compose stack up.\n- **You own your data.** Notes are end-to-end encrypted on your device before\n  they sync; the server only ever stores ciphertext it cannot read.\n- **Genuinely open.** AGPL-3.0 means you can inspect, modify, and run it\n  yourself — and anyone you offer it to over a network is entitled to the\n  source.\n\n## What's different / improved\n\nOn top of the upstream client and server, this fork adds and unlocks a broad set\nof features — and brings the whole project up to date: the **frontend and backend\ndependencies and toolchain have been modernized** (libraries updated, builds and\nDocker/reverse-proxy setup refreshed) so you're running a current, maintained stack\nrather than a frozen snapshot. The highlights below are all present in this repository:\n\n| Area | What you get |\n| --- | --- |\n| **All features included** | The server runs in `included` features mode, so no feature or note type is gated behind a subscription. |\n| **Modernized stack** | Frontend and backend **dependencies and build toolchain updated**, **reverse-proxy-friendly Docker** setup, a top-level `Makefile`, and documented [HTTP API](docs/API.md). |\n| **AI assistant** | An optional assistant (Preferences → Assistant) you point at any OpenAI-compatible endpoint — local (LM Studio, Ollama) or hosted. You pick the **context scope** (current note, whole notebook, a tag/folder/selection) so it only sees what you choose. AI features are **opt-in and off by default**. |\n| **Assistant actions** | **Suggest tags**, **auto-organize** notes, **conflict-merge** assistance, **AI auto-resolve conflicts**, note **narration / text-to-speech**, **speech-to-text / dictation**, **contextual AI search** (re-rank results), and a bounded **deep-research** mode over your own notes. |\n| **Many note types** | Plain text, **Super** rich blocks, **Canvas** (freeform drawing), **Bases**, **Calendar**, **Kanban**, **Timeline**, **Flashcards** (with study mode), a **Map** type (mind maps / family trees), and code **sandboxes** — a JS Sandbox (jsfiddle-style) and a Web App Sandbox (codepen-style live preview). |\n| **Super editor blocks** | Checklists, tables, code, **math**, **footnotes**, **web embeds**, **kanban**, **timeline**, **QR codes**, **TradingView** \u0026 **stock charts**, an in-browser **SQL** block, **gantt / timing / music-staff** charts, and a live **clock / world-clock** — from the `/` block picker. |\n| **Super editing power** | Collapsible / **foldable** sections, **multi-cursor** editing, a **customizable** Word-style toolbar with **contextual widget groups**, and **block zoom**. |\n| **Reminders \u0026 journaling** | Per-note **reminders** (one-off and **recurring**), browser **notifications**, optional server-sent **email reminders**, and a **diary mode** that prompts a daily entry. |\n| **Dashboards \u0026 views** | A **Dashboard** with account stats, **Achievements**, and aggregate views for **Reminders**, **Calendar**, **Todos**, and a Zotero-like **Research** library — plus a fully **customizable Home** page. |\n| **Sync \u0026 real-time** | **Websocket-first** delta sync (HTTP fallback), an optional **manual-sync** mode, live **co-editing + presence** in shared vaults, and a **Sync control** pane showing what's local-only. |\n| **Search** | Full-text search with a local **index** and **relevance ranking**, **advanced operators** (`tag:`, `type:`, `is:`, dates…), **find-in-PDF**, and optional **AI re-ranking** — all in your browser. |\n| **Files** | **Bulk file \u0026 folder uploads**, **large local-only files**, automatic **EXIF/metadata stripping** on image upload, in-app **audio playback**, and download-all-images-as-zip. |\n| **Account \u0026 security** | **Passkey** sign-in and **passkey app-lock**, **multiple workspaces per email** (server-configurable), **trusted devices**, **burn-note** one-view shares, **bannable users**, **app passwords / MCP tokens**, and scheduled **encrypted email backups**. |\n| **Import / export** | Import from **Evernote, Google Keep, OneNote, Zoho Notebook, CSV**; export to **`.ics`**, **Excel/Word** (spreadsheets), **print/PDF**, and encrypted backups. |\n| **Linking \u0026 navigation** | **Bidirectional links** and backlinks, the **constellation** graph, and an extended keyboard-driven **command palette**. |\n| **Collaboration** | Vaults, contacts, and invites, surfaced in a **Sharing** settings pane. |\n| **Privacy controls** | **Protected notes**, **selective sync**, **trusted devices**, and configurable **trash auto-cleanup**. |\n| **Appearance \u0026 personalization** | Auto **light/dark** theme, **custom themes with custom accent colors**, **font ligatures**, per-note colors, a per-note **hero cover image**, and a **profile picture**. |\n| **Localization** | An i18n framework with **16 locales**, switchable in settings. |\n| **Spellcheck** | Multi-language spellcheck configuration. |\n| **CLI tools** | `srn-client` (real end-to-end-encrypted note CRUD from the terminal) and `srn-server` (operator helpers: health, status, logs, config validation). |\n| **MCP bridge** | An MCP stdio bridge (`mcp/`) so MCP-capable clients can talk to your server. |\n| **Self-hosting** | One-command setup scripts (`scripts/setup.sh` / `scripts/setup.ps1`) and a documented, reverse-proxy-ready Docker Compose stack. |\n\n\u003e A note on accuracy: features like the AI assistant and narration decrypt notes\n\u003e locally but send the content you point them at to the AI provider you\n\u003e configure. See the [onboarding guide](docs/onboarding.md#security-what-leaves-your-device)\n\u003e for an honest breakdown of what crosses the end-to-end boundary.\n\n## Feature comparison\n\nHow the upstream hosted **Standard Notes** offering compares with **Standard Red\nNotes** (this fork). Standard Notes is excellent software with a sustainable\nbusiness; it offers a capable free tier and reserves a number of \"Productivity\"\nfeatures for its paid subscription. Standard Red Notes targets self-hosting\ninstead: every included feature is on for every account, with no paid tier — the\ntrade-off is that **you run and maintain the server yourself**. This table is\ncross-checked against the \"What's different / improved\" features this repository\nactually ships.\n\n| Capability | Standard Notes (free) | Standard Notes (paid / Productivity) | Standard Red Notes (this fork) |\n| --- | --- | --- | --- |\n| End-to-end encryption | Yes | Yes | Yes |\n| Unlimited notes, tags, nested folders | Yes | Yes | Yes |\n| Multi-device sync | Yes | Yes | Yes |\n| Plain text / basic editing | Yes | Yes | Yes |\n| Rich / Super block editor, Markdown, code, advanced note types | Limited | Subscription-gated | Included (Super blocks, Canvas, Bases, Calendar, Kanban, Timeline, code sandboxes) |\n| Themes / appearance | Default theme | Extra themes via subscription | Included (auto light/dark + extra themes) |\n| Encrypted file attachments / storage | Not on free tier | Subscription-gated (storage quota) | Included (limits are your server's storage) |\n| Note history / revisions | Short retention | Extended retention via subscription | Included (retention is your server's config) |\n| Two-factor authentication | Yes | Yes | Yes (TOTP, magic link, WebAuthn) |\n| Encrypted backups \u0026 email backups | Local export | Email/cloud backups via subscription | Included (export, and email/automatic where configured) |\n| Collaboration / shared vaults | No | Yes (on supported plans) | Included (vaults, contacts, invites, realtime relay) |\n| AI assistant / actions | Not offered | Not offered | Included (bring-your-own OpenAI-compatible endpoint or server proxy) |\n| Public share links, dead-man's switch, email reminders | No | No | Included (fork-specific) |\n| App passwords / scoped MCP tokens / MCP bridge | No | No | Included (fork-specific) |\n| Hosting | Managed by Standard Notes | Managed by Standard Notes | Self-hosted by you |\n| Cost | Free | Paid subscription | Free (you provide the server) |\n\n\u003e \"Subscription-gated\" reflects upstream's hosted product at a high level and may\n\u003e shift over time; check [standardnotes.com](https://standardnotes.com) for their\n\u003e current plans. The right-most column reflects what this repository ships today.\n\u003e Self-hosting means you are responsible for running, securing, and backing up\n\u003e the server.\n\n## Repository layout\n\nThis repository preserves the upstream package boundaries:\n\n- `app/` — web, desktop, mobile, and shared client packages.\n- `server/` — auth, sync, files, revisions, websockets, home server, and\n  supporting packages.\n- `mcp/` — Standard Red Notes MCP bridge bootstrap.\n- `cli/` — standalone command-line tools (`srn-client`, `srn-server`).\n- `scripts/` — self-hosting setup scripts.\n- `docs/` — onboarding, self-hosting, and project planning docs.\n\nThe app and server still use their upstream Yarn projects internally. The root\npackage is a coordinator for monorepo scripts and new packages while the larger\nworkspace migration is phased in.\n\n## Docker quickstart\n\nRun your own instance in three commands. **Prerequisite:** Docker with the\nCompose plugin, installed and running.\n\n```bash\ngit clone https://github.com/supermarsx/standard-red-notes.git\ncd standard-red-notes\n./scripts/setup.sh --up        # Windows (PowerShell): ./scripts/setup.ps1 -Up\n```\n\n`setup` generates a complete `.env` with secure secrets; `--up` then brings the\nstack up (web app, server, MySQL, Redis, LocalStack). When it finishes, open\n**\u003chttp://localhost:3001\u003e** and choose **Register** — every feature is included,\nnothing to purchase.\n\n\u003cdetails\u003e\n\u003csummary\u003eManual setup \u0026amp; everyday commands\u003c/summary\u003e\n\n```bash\n./scripts/setup.sh             # write .env only (add --yes to accept all defaults)\ndocker compose up -d           # start the stack\ndocker compose ps              # what's running\ndocker compose logs -f         # follow logs (append a service name to narrow)\ndocker compose down            # stop\ndocker compose pull \u0026\u0026 docker compose up -d    # update and restart\ndocker compose --profile mcp run --rm mcp      # optional MCP stdio bridge\n```\n\nOther endpoints: API gateway \u003chttp://localhost:3000\u003e, files\n\u003chttp://localhost:3125\u003e.\n\u003c/details\u003e\n\nFor production — every environment variable, **reverse proxy (nginx / Traefik)**,\ndata locations, upgrades, and backup/restore — see the\n**[self-hosting guide](docs/self-hosting.md)**.\n\n## Building from source\n\nRoot-level coordinator scripts:\n\n```powershell\nyarn install\nyarn build:mcp\nyarn start:mcp\nyarn deps:audit\n```\n\nThe full app and server builds still run through their existing project-level\nscripts:\n\n```powershell\nyarn --cwd app build:all\nyarn --cwd server build\n```\n\nYou can also drive the Docker stack via the coordinator scripts:\n\n```powershell\nyarn docker:config\nyarn docker:up\n```\n\n## Command-line tools\n\nTwo standalone CLI tools live in `cli/` (each is independent and does not touch\nthe app/server lockfiles):\n\n- **`srn-client`** — manage a Standard Red Notes account from the terminal with\n  **real, end-to-end-encrypted note CRUD**. It runs the actual protocol\n  (SRP sign-in, argon2 root-key derivation, items-key decryption) via an\n  embedded headless `@standardnotes/snjs` client, so changes sync back encrypted\n  exactly like the web/desktop app. See\n  [`cli/srn-client/README.md`](cli/srn-client/README.md).\n- **`srn-server`** — operator helpers for the Docker stack: health checks, stack\n  status, logs, config validation, and thin `docker compose` wrappers. Zero\n  runtime dependencies. See [`cli/srn-server/README.md`](cli/srn-server/README.md).\n\nA third tool, **`srn-admin`**, ships *inside* the server image (it drives the\nauth service's own database and use-cases, so it is not a downloadable binary) —\nsee [In-container admin](#in-container-admin-srn-admin) below.\n\n### Prebuilt binaries and releases\n\nEach CLI tool is released independently as native, single-file executables via\nGitHub Actions — **no manual tagging required**. Releases roll automatically:\n\n- **Triggers.** Pushing to `main` runs the per-tool workflow when that tool's\n  directory changes — [`srn-client.yml`](.github/workflows/srn-client.yml)\n  on `cli/srn-client/**`, [`srn-server.yml`](.github/workflows/srn-server.yml)\n  on `cli/srn-server/**`. Both can also be run on demand from the Actions tab\n  (`workflow_dispatch`).\n- **Pipeline.** Each workflow is gated: **check → build → package → release**\n  (a stage only runs if the previous one passed). Packaging cross-compiles with\n  [`@yao-pkg/pkg`](https://github.com/yao-pkg/pkg) on a single Linux runner.\n- **Versioning.** Rolling, per tool, `YY.N` resetting each year (e.g. the first\n  2025 client release is `25.1`, the next `25.2`, …). The server tool counts\n  independently. The workflow computes `N` at release time from existing\n  releases and creates a namespaced tag (`srn-client-v25.1`, `srn-server-v25.1`).\n- **Artifacts.** Every release attaches **6 executables** — Windows, macOS, and\n  Linux, each in `x64` and `arm64` (Windows ones end in `.exe`) — plus a\n  `SHA256SUMS.txt`. Download the one matching your platform, verify the checksum,\n  and run it directly. The two tools release as separate GitHub Releases.\n\n### Downloads\n\nGrab the prebuilt executable for your platform from the\n[**Releases**](https://github.com/supermarsx/standard-red-notes/releases) page.\nThe two tools publish independently, so pick the newest release tagged\n`srn-client-v*` (client) or `srn-server-v*` (server). Node is baked in — there's\nnothing to install; download, verify, make it executable, and run.\n\n**`srn-client`** — terminal note CRUD (end-to-end encrypted):\n\n| Platform | x64 | arm64 |\n| --- | --- | --- |\n| Windows | `srn-client-windows-x64.exe` | `srn-client-windows-arm64.exe` |\n| macOS | `srn-client-macos-x64` | `srn-client-macos-arm64` |\n| Linux | `srn-client-linux-x64` | `srn-client-linux-arm64` |\n\n**`srn-server`** — operator helpers for the Docker stack:\n\n| Platform | x64 | arm64 |\n| --- | --- | --- |\n| Windows | `srn-server-windows-x64.exe` | `srn-server-windows-arm64.exe` |\n| macOS | `srn-server-macos-x64` | `srn-server-macos-arm64` |\n| Linux | `srn-server-linux-x64` | `srn-server-linux-arm64` |\n\nDirect download follows the tagged-release URL pattern (replace the tag with the\ncurrent one from the Releases page, and the asset with your platform's row):\n\n```bash\n# Example: srn-client for Linux x64 from release srn-client-v25.1\nbase=https://github.com/supermarsx/standard-red-notes/releases/download/srn-client-v25.1\ncurl -LO \"$base/srn-client-linux-x64\"\ncurl -LO \"$base/SHA256SUMS.txt\"\nsha256sum -c SHA256SUMS.txt --ignore-missing   # verify integrity\nchmod +x srn-client-linux-x64                  # Linux/macOS only\n./srn-client-linux-x64 --help\n```\n\nOn Windows, download the matching `.exe` and run it from PowerShell or\ndouble-click; verify with `Get-FileHash srn-client-windows-x64.exe -Algorithm SHA256`\nagainst `SHA256SUMS.txt`. On macOS you may need to clear the quarantine flag with\n`xattr -d com.apple.quarantine ./srn-client-macos-arm64` before first run.\n\n### Desktop app\n\nThe desktop app (built with **electron-builder**) publishes as its own rolling\nrelease, tagged with a semver `vYY.M.\u003cbuild\u003e` (e.g. `v25.6.123`) — distinct from\nthe CLI tools' `srn-*-v*` tags. Grab the installer for your platform from the\n[Releases](https://github.com/supermarsx/standard-red-notes/releases) page:\n\n| Platform | Formats (x64 + arm64) |\n| --- | --- |\n| Windows | `.exe` NSIS installer |\n| macOS | `.dmg` and `.zip` (Intel + Apple Silicon) |\n| Linux | `.AppImage`, `.deb`, plus `.snap` (x64) |\n\nAuto-update is built in via **electron-updater** (it reads the GitHub release);\nit defaults to off and is opt-in under Preferences. The public builds are\n**unsigned**, so on first launch macOS may need right-click → Open and Windows\nSmartScreen may warn (More info → Run anyway).\n\n### In-container admin (`srn-admin`)\n\n`srn-admin` is baked into the **server** image and runs admin operations\n*directly against the auth database* — it reuses the auth service's own\nuse-cases and repositories (no HTTP, no admin session, no separate container).\nUse it to bootstrap the first admin, manage RBAC groups, reset 2FA, or fix a\nstorage quota. Run it inside the running stack:\n\n```sh\ndocker compose exec server srn-admin help\ndocker compose exec server srn-admin whois user@example.com   # uuid, email, roles\ndocker compose exec server srn-admin grant-admin user@example.com   # → INTERNAL_TEAM_USER\ndocker compose exec server srn-admin revoke-admin user@example.com\ndocker compose exec server srn-admin list-roles user@example.com    # direct + effective\ndocker compose exec server srn-admin reset-mfa user@example.com     # clear 2FA + recovery codes\ndocker compose exec server srn-admin fix-quota user@example.com     # recalculate storage usage\n```\n\nA `\u003cuser\u003e` may be an **email** or a **user uuid**. RBAC groups are managed via\nthe `group` subcommands:\n\n```sh\ndocker compose exec server srn-admin group list\ndocker compose exec server srn-admin group create \"Editors\" CORE_USER,INTERNAL_TEAM_USER\ndocker compose exec server srn-admin group set-roles \u003cgroupUuid\u003e CORE_USER\ndocker compose exec server srn-admin group members \u003cgroupUuid\u003e\ndocker compose exec server srn-admin group add-user \u003cgroupUuid\u003e user@example.com\ndocker compose exec server srn-admin group remove-user \u003cgroupUuid\u003e user@example.com\ndocker compose exec server srn-admin group delete \u003cgroupUuid\u003e\n```\n\nGranting `INTERNAL_TEAM_USER` is the same role the server reads from the\n`ADMIN_EMAILS` env var at boot — `srn-admin grant-admin` is the ad-hoc\nequivalent for an already-registered user.\n\n## API\n\nYour self-hosted server exposes the full Standard Notes HTTP API through the API\ngateway — sign-in (PKCE), sync (`POST /v1/items`), items/files, settings,\nsessions, two-factor, collaboration, plus this fork's additions (app passwords,\nMCP tokens, public share links, the AI assistant proxy, and more).\n\nSee **[docs/API.md](docs/API.md)** for the full reference: base URL and\nversioning, the authentication model (PKCE + bcrypt-derived server password,\n`Authorization: Bearer` access tokens, refresh), a curl walkthrough, and every\nendpoint grouped by area. Because notes are end-to-end encrypted, item payloads\nare ciphertext — the easiest faithful client is the bundled\n[`srn-client`](cli/srn-client/README.md), which runs the real protocol. The API\ndocs are also linked in-app under **Preferences → Documentation → Automation\n(MCP) → The HTTP API**.\n\n## License\n\nStandard Red Notes is licensed under the GNU Affero General Public License v3.0\n(AGPL-3.0). See the [LICENSE.md](LICENSE.md) file for the full text. Because the AGPL\ncovers network use, anyone you offer this software to over a network is entitled\nto its corresponding source.\n\nThis project is a self-hosted fork of [Standard Notes](https://standardnotes.com),\nwhich is also distributed under the AGPL-3.0. Upstream copyright and attribution\nnotices are preserved. Standard Red Notes is an independent project and is not\naffiliated with, sponsored by, or endorsed by Standard Notes.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fsupermarsx%2Fstandard-red-notes","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fsupermarsx%2Fstandard-red-notes","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fsupermarsx%2Fstandard-red-notes/lists"}