Who drives
You in the app, a local model, a cloud model through the tool bridge, or an external app over MCP.
For builders
The hard part isn't the model. It's the slice.
Anyone can call a frontier model. The hard, unglamorous part is deciding exactly what it gets to see — and proving, afterward, what it touched. Nolocron is the layer that turns your owned data into scoped slices and governs every operation over them, on your own machine. Here's how it works, and why the shape matters.
01
Why scoping has to happen before the model
To give a model scoped access to your data, something has to decide the slice. That something can't be the model you're scoping.
A model asked to "find what's relevant" has to read everything first — and scoping after full exposure isn't scoping at all. So the scoping has to happen before any frontier model is in the room, by something that can see your data without it being a surrender. Two things can: deterministic rules you set (per-source access and project scope rules), which need no model and run on any machine; and a model running locally on your own device, which can read broadly precisely because nothing leaves the machine. The already-scoped slice is the only thing a frontier model ever sees. That's what makes "use any model on your data, without surrendering it" structurally true instead of a slogan.
02
One governed path for every caller
You clicking, a local model, a cloud model, or your own desktop app — all of them pull the same levers, through the same gate.
Every caller invokes the same catalogue of actions, through the same policy checks, leaving the same durable receipt — one control plane that doesn't care who's driving it. Add a new way to drive Nolocron and it inherits the same scope enforcement, the same default-deny, the same audit trail — automatically.
The gate
One catalogue of actions, each with a schema, a policy and approval check, and a receipt on the way out.
What it drives
Your sources, collections, projects, the agent workspace, export — operating only on the scoped slice.
How the connection works
Your AI app
Claude, Cursor & friends
The chat app you already use, asking in plain language.
The governed gate
The MCP bridge
A small, controlled toolset — not a backdoor to everything.
- search & read
- list & scope projects
- your whole archive
Your vault
Local, on your disk
Your archive in open formats — it never leaves your machine.
03
Built, not promised
The controls aren't a roadmap promise. A scoped identity carries who's acting, their trust tier, and their scope — immutable, able to narrow but never widen mid-task. Every action through the catalogue writes a durable receipt. A default-deny policy gates each call, and responses to untrusted surfaces are shaped so a connector can't even probe for what it isn't allowed to see. What's still ahead is the visible surface — a single view of everything an AI saw and did, with one-click undo. The enforcement is built; giving it a face is on the roadmap.
04
Two kinds of boundary
Scope — what may be seen
A model only ever sees the slice you grant: a source or a bounded project. The boundary is enforced where the data is read, not promised in a settings page.
Workspace — where work may happen
When an assistant does real work, it happens in a governed, rewindable sandbox inside a project. Work is a derived projection that can never corrupt your canonical data, and your real file paths are never exposed.
05
Plug in the way you already build
Bring the brain; Nolocron keeps the boundary. Whoever runs the loop, the model only ever sees the slice you grant.
What an MCP client sees — a focused, scoped tool set, nothing more:
search — full-text + on-device semantic over a granted scope read_resource — fetch a block by nolocron:// URI list_projects — enumerate the projects you've exposed create_project — open a new scoped workspace set_scope — narrow what this session is allowed to see
06
Why the shape holds
Every piece here — local models, MCP, scoping, action catalogues — commoditizes on its own. What doesn't is the whole, assembled honestly: scoping done locally, one governed path, and a receipt for everything, working together — plus the corpus you accumulate and the custodial relationship around it. We don't pretend any single capability is a moat. The integration, and your trust, are the point.