Every AI tool I pay for has some kind of memory now, and each one keeps it in its own locked diary. Claude has its memory. ChatGPT has its memory. They don’t share, and neither one keeps the other up to date. So the only thing connecting a decision I made with one assistant to the work I do with another is me, copying and pasting like an unpaid intern who never got the password to the shared drive.
Sherm’s Brain is my answer to that. At heart it’s a notes app: you capture text (typed, or through whatever dictation you already use), file it in a project, and find it again later. The difference is that it isn’t just my notebook. My AI tools plug into the same library, so something Claude writes down, ChatGPT can read. One brain, several mouths, and a fairly paranoid set of rules about who’s allowed to say what.
It’s at version 0.3.0. It’s a native Omarchy app written in C++ and Qt Quick, and it isn’t public yet. Here’s what’s going into it.
The plumbing that makes AIs share
The connective tissue is MCP, the Model Context Protocol. Anthropic introduced it in late 2024 as an open standard for hooking AI apps up to outside tools and data. An AI app that speaks MCP can be handed a set of tools (“search the notes,” “read this note,” “save this”) and call them during a conversation. Sherm’s Brain has an MCP adapter that exposes 13 of those tools. There’s also a plain JSON command line for scripts, and the regular desktop app for me, the human, who still likes clicking on things.
All of those talk to the same store. Not copies of it. Not a sync that goes weird when two machines disagree. One authoritative library.
The proof that this actually works was the most boring test possible. A note was saved through the connection Claude Desktop is set up to use, then read back through the one ChatGPT uses. That’s it. That’s the whole trick. Two rival companies’ plumbing passing notes through my server like kids in detention, and neither company had to agree to a damn thing.
A notebook that doesn’t let anyone rewrite history
If you let AIs write into your notes, you have to assume one of them will eventually do something stupid. Not malicious. Just confidently, cheerfully stupid. So the app never throws anything away.
The original capture stays exactly as written. Every edit becomes a new revision on top of it, and the whole history is kept. There’s an optional organizer that runs a capture through the official Codex CLI, using my existing ChatGPT sign-in (the app never reads or copies the login tokens), and suggests cleanups. Those suggestions get validated and saved as a new revision. The raw original is still sitting underneath, untouched, in case the organizer decides my grocery list is actually a manifesto.
Edits are also pinned to the version they were based on. If you open a note, someone else changes it, and then you try to save your older copy over the top, the app refuses. That goes for the AIs and it goes for me. I don’t get a special exemption for being the guy who owns the server, which, given my track record, is correct.
Close together doesn’t mean related
There are two main views. Library is the normal one: folders down the side with note counts, a list, a reader. Brain is the fun one, a map of notes built from real folder membership and real recorded relationships.
The design rule I’m proudest of is that layout is navigation, not evidence. Two notes sitting next to each other on the map means fuck all. It doesn’t mean they’re connected. Connections are their own records: they have a direction, they carry evidence for why they exist, and they remember which version of each note they were based on. If one of those notes changes later, the link gets flagged as stale, because the reason it existed might not be true anymore.
AIs can propose links. They can’t approve them. Approving a relationship takes a human credential, and the server flat-out rejects that permission on any AI’s credential. The robots can suggest that two ideas are connected. I decide whether they’re right. That isn’t up for negotiation.
Receipts, because I’ve been burned before
If you read I Promoted the One I Was Going to Cancel, you know I have a history with tools that report a job finished while the job is still running. So when an AI says “I saved that to your Brain,” I don’t take its word for it.
A panel called Agent Connections shows what actually happened: the searches, the reads, the confirmed saves and the failures, as observed by the system. Not what the model claimed. What it did. Those receipts don’t guarantee an AI will remember to file things every time (models are models, and they skip shit), but they make it obvious when one didn’t.
Then there’s the network, which lies in its own special way. Say an AI sends a save, the server writes it, and the reply gets lost on the way back. From the AI’s side, that looks like a failure. Retry it naively and you’ve got the same note twice. So every capture carries a stable retry key (the nerd term is an idempotency key), and the server recognizes a repeat and saves it only once. If a capture can’t get through at all, it gets queued and retried later with that same key.
And when the honest answer is “I don’t know if that worked,” the system says exactly that. Lost replies come back marked as unconfirmed, not as a success and not as a failure. I’ve written before about software that would rather make up a number than admit it doesn’t know something. This thing admits it.
Moving the brain off the laptop
Up through version 0.2.6, the whole library lived on my laptop. That’s fine until your AIs need it while the laptop is closed, or until you remember you’re the guy from Whoopsie who deleted his own website by reinstalling his OS.
So 0.3.0 moved the authoritative library onto my home server, reachable only over my private Tailscale network. Tailscale has two ways to share a service: Serve, which keeps it on your private network, and Funnel, which puts it on the public internet. This uses Serve, with no Funnel. The Brain is not on the internet. Full stop.
The cutover got handled like defusing a bomb. I confirmed I had no unsaved drafts, the old writers on the laptop were shut down, and the old library was kept privately for rollback instead of being “cleaned up” by a man who’s absolutely sure he doesn’t need it. Every record set was checked after the move: 102 notes, 113 revisions, 47 links and their histories, and the retry keys for all of them. Every count matched exactly.
Each client gets its own credential: one for me, plus separate ones for Codex, Claude, Grok and Gemini on the laptop. All five came back reporting the same server identity and read the migrated data through real MCP connections. The server stores only scrambled fingerprints (SHA-256 hashes) of those credentials, never the secrets themselves. It rereads the credential list on every single request, so revoking one takes effect immediately. That got tested live, too. There’s no unauthenticated health check, no open status page, nothing. Show up without a valid credential and you get told to piss off.
And backups. Obviously. A consistent snapshot went to the existing local Restic drive and to the encrypted offsite copy on Backblaze B2. Then, because I have learned exactly one lesson in my life and I learned it the hard way, both copies were restored into separate scratch directories, checked against their SHA-256 fingerprints and run through the app’s own integrity checks. They passed. An hourly snapshot job now feeds the backup schedule that already existed. A backup you’ve never restored is a rumor. This one’s been restored.
What hasn’t been tested yet: a full reboot of the server, and access from my actual phone. Those are on the list, and I’m not going to pretend otherwise.
The tests pass. That proves less than you’d think.
The laptop test suite runs 162 checks with zero failures. The server-side headless acceptance run on Fedora runs 94, also with zero failures, after fixing a couple of Fedora-specific annoyances involving where Python lives and how Qt 6.11 handles private file exports.
I wrote a whole post called Tested. Deployed. Wrong Anyway. about why a green test suite is not the same as working software, so here’s the honest version. Those checks prove the adapters connect, list their tools, search and read live notes, and correctly report who’s who. They do not prove the desktop AI apps will reliably use those tools in an ordinary conversation. That’s a separate acceptance step, and it’s recorded as one.
Case in point: when I checked from a Claude Code cloud session, it had no Brain tools at all. Of course it didn’t. That session ran in Anthropic’s cloud, not on my laptop, and it has no route to my private network. Same company, same model family, a completely different place where the code actually runs. Claude Desktop on the laptop got rechecked and was fine. The setup docs now spell out the difference, so future me doesn’t burn an evening angrily debugging the wrong goddamn Claude.
Grok Bot doesn’t get the keys to the house
The next connection is Grok Bot, which already runs seven of my inboxes and books my rides to work. It’s useful as hell. It’s also software running in someone else’s cloud, and I’m not handing it my whole network.
The easy way would be the official personal connector, which inherits my own access. Translation: whatever I can reach, the bot can reach. Fuck that. The plan instead is a restricted tagged enrollment. In Tailscale, a tagged device gets its own identity instead of borrowing a person’s, and access rules can be written for that tag specifically. The bot gets to reach the Brain and nothing else.
To get there, there’s now a portable remote adapter: a small bundle of Python using only the standard library, with no native binary and no local database. If it can’t reach the server, it fails. It doesn’t quietly start a second brain on the side. The bundle contains no personal data or keys, ships with checksums, and builds the same way every time, so the same source on the same Python version produces byte-for-byte identical output. It can also route through a local Tailscale proxy when the bot’s environment needs one. Even then, the certificate and hostname checks still run against the real server, and if the proxy fails, it does not fall back to a direct connection.
Status, precisely: 61 targeted checks pass against synthetic local fixtures, and a logged-out Tailscale preflight in Grok Bot’s environment came back clean. No bot has been enrolled. No credential has been issued. No real round trip from Grok Bot to the Brain has happened. The docs say “claim readiness only for the steps actually verified,” and I’m holding myself to that.
It also has to look good, because I’m me
None of the paranoia matters if I hate opening the thing. So it follows Omarchy’s active accent color and desktop language (English and Danish so far). It uses rounded corners inside the app even though my desktop windows are square, because I like rounded corners and it’s my goddamn app. It doesn’t touch the desktop’s own settings to pull that off.
Panels collapse so the map or the reader gets the room. Folders live in a sidebar with counts. Buttons got centered, forms got polished, and the “are you sure you want to quit?” dialogs keep your draft instead of eating it. There’s a Stream Deck button that toggles the app open and closed. The logo came out of a three-way bake-off between Claude, Grok and Gemini. Gemini’s design, called Focal Relief, won.
Still on the list
The next milestone is an Omarchy bar button and quick capture, so getting a thought into the Brain takes less effort than forgetting it. After that comes the big one: a phone app with recoverable meeting recording, transcripts and summaries, plus Google Calendar and Tasks alerts, Android sync and smarter search.
Until then, there’s one warning baked right into the app: you can save a task with a due time, and it gets explicitly labeled as not a scheduled notification. A saved task does not send a phone alert. The Brain will remember your dentist appointment perfectly and let you miss it anyway.
So every AI gets access to the same brain. None of them get to approve links, rewrite history, overwrite a newer edit or claim a save it can’t prove. Neither do I. I’m the guy from Whoopsie. I’d lock me out too.