No agent can edit a note's text, delete a capture for good, or empty the Trash.
What agents may do
A connected agent can always read your library, and three switches, off by default, decide what it may change.
- Where
- Settings → MCP → Access
- Default
- Read only
- On
- Mac
The switches
Reading is always allowed. An agent can read every capture, including note text, transcripts and captures in the Trash.
- Add. Create captures and comments. It also lets an agent edit or delete any comment, including yours, and removing a highlight's comment removes the highlight. A deleted comment can't be brought back.
- Organize. Change title, description, source, pin, tags, triage and Spaces.
- Move to Trash. Move a capture to the Trash, or restore one.
Change access
Open Settings → MCP.
Under Access, turn Add, Organize or Move to Trash on or off.
After changing access, set the agent up again. Click the info button on its row.
Click Update connection for Claude Desktop, Cursor or VS Code. For Claude Code, OpenAI Codex or Gemini CLI, click Copy setup command and run it again in Terminal.
For Claude Code, run claude mcp remove --scope user resurf first. Adding Resurf a second time fails.
The command line tool
The switches cover agents connected over MCP. The command line tool doesn't follow them: anything that can run it, including an agent with Terminal access, can add, organize and comment whatever the switches say.
Questions
I turned on Add but the agent still can't save.
Set the agent up again, as in Change access. An agent set up while every switch was off stays read-only until you do.
Can an agent delete something for good?
Not a capture. Move to Trash only moves captures to the Trash or restores them, and only you can empty it. With Add on, an agent can delete comments, and that is permanent.
What happens if an agent tries something that's switched off?
Resurf refuses it and tells the agent which permission is off.