Giving AI agents your clipboard, without your secrets

Ask a coding agent to remember the staging URL and it will, until the session ends. Ask it tomorrow and it has never heard of it. Meanwhile the URL is sitting in your clipboard history, next to the error you pasted into the chat an hour ago and the snippet you keep retyping.

Since 0.5.0, Clypy's desktop app speaks MCP, the protocol AI agents use to call tools. Claude Code, Codex, Cursor and others can search your clipboard history, open a clip, and save what you ask them to remember. This post is about how we built it, and about the part that took longest to get right: what an agent must never see.

Why the app serves it

We could have shipped MCP as a separate helper program. We did not, for two reasons.

The first is that your clipboard history is an encrypted library, with a search index and a sync engine around it. A helper would have to open that library on its own, and every clip it saved would have to reach the index and the sync queue exactly the way the app's own clips do. The second is a Mac detail: a helper bundled inside the app is signed with the app's entitlements, which need the app's provisioning profile, and macOS kills it at launch.

So the app does it. When you connect an agent, Clypy writes one entry into that agent's settings: run Clypy's own executable with mcp and the agent's name. That process never opens your library. It passes each message to the running app over a connection that only exists on your computer, and reads the address and a token from a file in your home folder for every message, so nothing secret is written into the agent's config. If the app is not running, the relay starts it, but only if MCP was switched on when the app last ran.

What an agent can do

Thirteen tools, grouped by what they change:

• Read: search_clips, get_recent_clips, get_clips_by_time, get_clips_by_category, list_collections, and get_clip_content for the full text of one clip.
• Add: create_clip, create_collection and add_clip_to_collection.
• Change or remove: update_clip, remove_clip_from_collection, and delete_clip, which moves the clip to Trash on every device.
• Capture: set_capture_paused.

search_clips finds clips the way Clypy's own search does: by the words in them and, when you have turned it on, by meaning. Each tool also tells the agent whether it only reads or can destroy something, using MCP's own hints. Agents that ask before acting go by those hints. Codex in its auto mode, for example, runs searches and saves without asking and stops to ask before a delete.

Three switches

Everything lives in Settings, MCP, and it starts off.

• Let AI agents use Clypy is the master switch. Until you turn it on, every request gets a refusal that says where to turn it on.
• Save and change clips lets agents save, edit, file and delete. Turn it off and those tools disappear from the agent's list rather than failing when called.
• Read full text lets agents open a whole clip and search past its preview. Turn it off and they see titles and the first 140 characters, and search only matches words in those.

The last two are on once MCP is on. If you want an agent that can look but not touch, turn off Save and change clips.

What an agent never sees

A clipboard history holds passwords, tokens and one-time codes, whatever care you take. So the rule for agents is not redaction. It is absence. A clip an agent may not see is left out of every result as if it did not exist:

• clips Clypy marked sensitive, which it also conceals in its own window
• password clips
• ephemeral clips, and clips past their expiry
• anything in Trash

The check runs against the stored clip on every read and again before every change, so an agent that learned an id earlier cannot use it once the clip has been concealed. Filing a clip in a collection does not change the answer. Copies from a known password manager are never in the library to begin with, because Clypy does not save them.

It works in the other direction too. If an agent saves something with the sensitive flag, Clypy conceals it before it is first written, and from then on no agent can read it, find it, edit it or delete it. An agent can put a secret away for you. It cannot take it back out.

The honest part

Two things we want you to know before you connect anything.

"This device only" does not mean hidden from agents. You can mark a clip, or a whole collection, to stay on the computer that copied it. That keeps it out of sync. It does not keep it from an agent running on that same computer: agents see local-only clips like any other. If a clip should never reach an agent, mark it sensitive.

What an agent reads goes wherever the agent goes. Clypy runs on your machine and hands clips to an agent on your machine. Most agents then send what they read to their model provider as part of the conversation. That is how they work, and it is outside anything Clypy can control. If that matters for your work, turn off Read full text so agents see only titles and previews, or leave MCP off.

Memory that follows you

The thing people use most is not search. It is telling an agent to remember something. The Clypy Memory skill teaches an agent the habit: search before saving, update a clip instead of saving a near-duplicate, never save credentials, and keep what it remembers in a collection named after itself, such as Claude Memory or Codex Memory. Each clip an agent saves records the agent's name as its source, so you can always see who saved what. Install the skill with:

npx skills add https://updates.clypy.app/skills/clypy-memory-skill.zip

The skill is only instructions; the MCP connection is what provides the tools. And because those memories are ordinary clips, they show up in Clypy's own search, and with Clypy Pro they sync, encrypted, to your other computers. An agent on your laptop can recall what an agent on your desktop saved last week.

Setting it up

Open Settings, MCP, turn on Let AI agents use Clypy, and connect your agent from the list. Clypy connects Claude Code, the Claude desktop app, Codex, Cursor, Gemini CLI, Windsurf, VS Code and Kimi Code in one click. For anything else that speaks MCP, copy the setup prompt or set it up by hand. Our MCP setup docs have the details.

MCP is part of Clypy Pro, on Mac, Windows and Linux. If your license lapses, you can still remove Clypy from your agents' settings with one click.