← roadmap

interkasten

improve priority P2 effort M wave 2

What it does: A Claude Code plugin + Node/TypeScript MCP server (@modelcontextprotocol/sdk, Drizzle/SQLite) that is a bidirectional bridge between a projects folder and Notion. Confirmed in code: ~34 interkasten_* MCP tools registered eagerly at startup across daemon/tools/* (covering project CRUD/hierarchy, push+pull sync, database tracking, recursive page tracking, signals/scan, link, config, health). Real engineering depth: WAL crash-recovery protocol (pending->target_written->committed->delete), per-token circuit breaker, three-way merge via node-diff3 with configurable conflict strategy, SHA-256 content hashing, multi-workspace token resolution chain with a NotionClient pool, chokidar watcher + 60s NotionPoller, durable queue, HMAC-SHA256 webhook signature verification with timingSafeEqual, beads issue sync via execFileSync, 30-day soft-delete GC. Agent-native by design: the server contains NO LLM SDK (grep hits were ‘claude’ path strings, not API calls); classification and doc generation live in the onboard/doctor/webhook-setup skills, which delegate to interpath/interdoc/interwatch.

Rationale: This is a mature, well-tested integration plugin (261 tests, WAL, circuit breaker, three-way merge, webhook + poll + cloud-bridge trigger paths) that uniquely owns the Notion bridge in the ecosystem — it earns a keep on the sync core. The verdict is ‘improve’ rather than ‘keep’ because two concrete 2026-frontier gaps are real and additive (not a re-architecture): (1) eager registration of ~34 tool schemas at MCP startup is now the named anti-pattern per the MCP context-bloat backlash and RAG-MCP/Tool Search Tool findings; (2) Notion-pulled content is synced into local markdown that agents read, with no sanitization or provenance, which is the ‘untrusted external content’ leg of the lethal trifecta per the agent supply-chain security findings. The agent-native split (raw tools in server, intelligence in skills delegating to companions) is well-aligned with the ‘thin MCP + skills’ SOTA consensus and should be preserved.

SOTA gap: Primary: progressive tool disclosure. All ~34 tools load their schemas eagerly at server start; the 2026 consensus (Tool Search Tool / defer_loading ~85% token cut, RAG-MCP >50% prompt-token reduction with 3x selection accuracy, Code Mode) is that a plugin exposing this many tools should present a small static surface and lazy-load the rest. interkasten’s everyday workflow touches a handful of tools (sync, list_projects, gather_signals, conflicts), yet pays the full 34-schema context tax every session. Secondary: untrusted-content provenance — pulled Notion content has no injection/provenance handling (the lethal-trifecta framing); webhook transport is HMAC-verified but content is trusted blindly.

Redundancy: Low / clean. interkasten uniquely owns the projects<->Notion bridge — no other interverse plugin does Notion sync. The only overlap is doc generation, which the onboard skill correctly delegates outward (interpath for PRD/roadmap/vision, interdoc for AGENTS.md, interwatch for drift baselines) rather than reimplementing — that is good composition, not redundancy. The layout skill was already extracted to intertree (noted in CLAUDE.md), reducing scope correctly. Minor note: the standalone interkasten:doctor/onboard skills overlap conceptually with clavain:doctor and project-onboard, but interkasten’s variants are Notion-scoped and delegate, so this is acceptable.

Actions:

  • Adopt progressive tool disclosure: keep a small always-on core (health, sync, sync_status, list_projects, conflicts) and gate the long tail (track/untrack/refresh database+page, hierarchy/signals, config, add_database_property, link, triage) behind a deferred/lazy-loaded surface or a single discovery tool, mirroring the Tool Search Tool / RAG-MCP pattern to cut per-session schema tokens.
  • Add untrusted-content handling on the pull path: tag Notion-sourced markdown with provenance frontmatter (source=notion, page_id, pulled_at) and strip/neutralize embedded instruction-like content, so downstream agents treat synced Notion text as untrusted (lethal-trifecta defense).
  • Fix the stale, self-contradicting tool/test counts: README says ‘27 tools’, AGENTS.md says ‘21’, code has ~34 names; reconcile to the actual registered count in one place and update README/AGENTS/CLAUDE/agents/mcp-tools.md (server McpServer version string is also stale at 0.2.0 vs plugin 0.4.25).
  • Document and surface the async/webhook trigger path as a first-class capability (it already supports Cloudflare Tunnel / direct / cloud-bridge poll) to align with the ‘async event-driven agents are table stakes’ finding — e.g. let a Notion edit enqueue work, not just sync content.