Authentication

The Evernote MCP server uses OAuth 2.0. You sign in to Evernote once, in your client, and approve access — there are no API keys or tokens to manage.

OAuth 2.0

When you add the server, your client starts an OAuth flow against accounts.evernote.com. You review and grant access on Evernote’s consent screen, and the client receives a token it sends with each request. The server validates that token before any tool runs.

No app registration

Clients that support OAuth Dynamic Client Registration connect with no manual setup — you don’t create an Evernote app or paste credentials. The server registers your client automatically as part of the flow.

When your client registers, it can use these redirect URIs:

• HTTP callbacks on a loopback host only — localhost, 127.0.0.1, or [::1] — such as http://127.0.0.1:8080/callback. Plain HTTP on any other host is rejected.
• HTTPS callbacks on any host, such as https://example.com/oauth/callback. You approve the client and its redirect target on Evernote’s consent screen.
• Custom app URI schemes for native apps, such as myapp://callback or com.example.app:/oauth. The javascript:, data:, and vbscript: schemes are rejected.

Dynamic Client Registration is the only way to register a client today. There is no option to register a client manually or to obtain a static client ID and secret, so your client or gateway must support Dynamic Client Registration (RFC 7591) to connect.

Permissions

Access is scoped to what your Evernote account already allows. The AI tool can only see and change what you can see and change.