DEV Community: Miles Ford

I killed my in-app AI chat, made the agent a first-class user, and made every move it makes auditable

Miles Ford — Mon, 07 Sep 2026 06:32:56 +0000

Disclosure: I build Sensefold. It captures what you run into during the day (articles, X and Reddit threads, YouTube videos with transcripts, PDFs, screenshots, images, and ChatGPT, Claude, Gemini, and Grok conversations) and makes them available to you and whatever AI you use. This post covers why I deleted my own chat feature and what building the replacement forced me to get right.

I had a chat box. I removed it.

The first version of the product had the standard feature every "AI knowledge" app has: a chat box over your saved items. Ask a question, get an answer citing the sources it used. It worked. People used it briefly, then went back to ChatGPT or Claude and pasted things in by hand.

The pattern was obvious once I looked: nobody wanted another chat. People already had one, sometimes three, complete with memory, history, and established habits. What they wanted was for that chat to know what they had read, watched, saved, and said last week.

So I deleted the chat and replaced it with a remote MCP server. Paste one URL into Claude, ChatGPT, Claude Code, Codex, or Cursor, sign in, and the agent you already use can search and read your library, and write back to it if permitted. The product stopped being a place you go and became something your agents carry with them.

That shift changes who the user is. In the chat-box version, the human was the only actor, and the AI was just a feature. In the MCP version, the agent is an actor in its own right, running in its own session and operating on your data while you are not looking. That raised the question that shaped everything that followed: when the agent did something at 2 a.m., how do I know, and how do I undo it?

The answer I landed on has two parts:

The agent is a first-class user. It gets its own identity, its own permissions, and its own row in the audit log. It is never "the human, but through an API key".
Everything it does is auditable and reversible. If a human cannot see it and undo it, the agent is not allowed to do it.

Here is what that meant in practice.

1. Identity: one connection, one principal

The lazy way to let an agent into a product is to hand it the user's API key. That works, but it breaks two things at once: you cannot revoke one agent without revoking all of them, and your logs cannot distinguish an agent's writes from a human's.

So every agent connection is its own principal. For clients that can open a browser (Claude, ChatGPT, Claude Code, Codex, Cursor), that means OAuth 2.1 with PKCE and dynamic client registration. The user pastes one URL:

https://api.sensefold.app/mcp

The client discovers the authorization server, registers itself, and opens a browser. The user approves access and picks a permission tier on the consent screen. Each approval becomes its own connection row in user settings. Reconnecting the same client revokes the previous row rather than stacking a duplicate. Revoked rows stay visible as history and grant nothing.

Headless and CI clients that cannot open a browser get an Agent key instead: created with a specific tier, shown once, and independently revocable and rotatable. Same principle, different transport.

The point is not the OAuth spec. The point is that "which agent did this" is a question the database can answer.

2. Permissions: shape the tool list, then check anyway

MCP has a useful property here: the server decides which tools a client can even see. I use that as the first layer of least privilege across three tiers:

Tier	Tools the client sees	What it adds
`read_only`	6	search, list, read one item, check quota (plus `search`/`fetch` aliases for ChatGPT)
`edit`	10	save a link, save a note, update a note's text, replace tags
`full`	11	move an item to the recycle bin

A read-only connection cannot call update_note because the tool is omitted from tools/list. But filtering the list is only the visible half. The server still validates every call against the connection's tier, because a client can send any method name it likes. If it tries an unpermitted method, it gets a tier-denied error rather than a silent no-op.

Two details turned out to matter more than the tiers:

Read tools carry readOnlyHint. Claude Code and similar clients use MCP tool annotations to decide when to prompt the user. Marking search and read tools as read-only means the agent can look things up without a confirmation dialog every time, saving the human's attention for writes.
Recommend the lowest tier by default. The setup guide the agent reads says: start with read_only unless the user explicitly needs writes. Most sessions never need more.

3. Audit: who, what, diff, undo

This is the part people skip, but it is what makes the first half honest.

Every write an agent makes creates a revision. Each item in the library has a History drawer that lists every change, who made it (the human, or which named agent connection), and a field-level diff. There is a Revert button. Account-wide, the same feed powers an Activity page, so "what did my agents do this week" is answered on one screen instead of with a database query.

Deletes are soft. The delete_item tool moves an item to the recycle bin where a human can restore it, and no tool deletes permanently. An agent that goes wrong can make a mess, but it cannot make an irreversible one.

One rule came out of this that I would apply to any agent-writable system: no write path without a human-visible undo. If you cannot show the diff and offer Revert, do not ship the tool yet.

4. The boring part that keeps the audit log truthful

An audit log is only useful if it reflects what actually happened, and two ordinary failure modes corrupt it: retries and races.

Retries. Agents retry. Networks flake, clients time out, or the model decides to "try again". If save_note and save_link are not idempotent, one intended note becomes three, and the log dutifully records three writes. The protocol contract fixes this: the client generates a UUID before the first attempt and reuses it on every retry. Submitting the same UUID with different content is rejected as an idempotency mismatch rather than silently accepted.

Races. Two agents, or an agent and a human, editing the same note concurrently. update_note, update_tags, and delete_item all require an expectedVersion taken from a fresh read. If the item moved on, the call fails with VERSION_CONFLICT, and the agent's instructions say: re-read, retry once, then stop. Nobody silently overwrites anybody, and the revision history stays linear enough to remain human-readable.

Neither pattern is novel. Both make the difference between "there is an audit log" and "the audit log is true".

5. Don't touch what the human wrote

Sensefold enriches captures automatically: a saved article gets a summary and tags, a YouTube video gets its transcript and a chapter guide, and an image or PDF gets OCR. Notes the user wrote directly are indexed, but never rewritten by that pipeline. I extended the same rule to agents in the runtime instructions the server sends them: never rewrite a user's note unless explicitly asked. That part is guidance the agent reads, not a server-side check; the server-side guarantee is the revision history and Revert underneath it. An agent with edit access can change a note, and the user can revert it, but the default posture is that the human's words are ground truth and the agent builds around them.

This sounds like a product opinion, and it is, but it is also a safety property: the thing most likely to be wrong in your library is what an AI wrote, and the thing you most need to trust is what you wrote yourself.

What I'd tell anyone building an MCP server that writes

Give each agent connection its own identity. Never share the user's credential.
Put the permission choice on the consent screen, and default to read-only.
Shape tools/list by permission, then enforce on every call anyway.
Version every write. Show who made the change, show the diff, and offer undo. Soft-delete only.
Make saves idempotent and updates version-checked, or your audit log will lie.
State the rules clearly in tool descriptions and server instructions. Agents read them; that is the cheapest guardrail you have.

None of this required anything exotic. It required deciding that the agent is a user, and that users get accountability, not just access.

The scope of what flows through this keeps growing. Today it is web pages, social threads, YouTube videos with transcripts, PDFs, images, your own notes, and your AI conversations; TikTok and Douyin capture are on the roadmap, not shipped. Every new source is one more thing an agent can act on without you watching, which is why the identity and audit half had to come first.

If you want to try the real thing, setup for Claude, ChatGPT, Claude Code, Codex, and Cursor is on sensefold.app/for-agents, the tool schemas and error codes are in the MCP tools reference, and the permission and undo model is written up in agent permissions. I'd genuinely like to hear how other developers handle agent writes, especially anyone who found a case where soft-delete and revert weren't enough.

I tested 9 read-it-later apps in 2026 (after Pocket died)

Miles Ford — Sat, 04 Jul 2026 07:45:06 +0000

Disclosure up front: I build Sensefold, one of the apps below. I'll try to be more useful than a marketing page, including telling you when a competitor is the better choice.

September 2026 update. This post first went up in July under the product's old name, Lexi. Since then the product became Sensefold, the pricing changed, the Chrome extension and Mac app shipped, and the "ask questions across your library" feature I described was removed in favour of something I now think matters more: letting the AI you already use read the library over MCP. I've rewritten the Sensefold parts, re-checked every competitor's pricing on September 3, 2026, and added one column to the table that wasn't on my radar in July.

Why this list exists

Mozilla shut down Pocket on July 8, 2025, and the export-only window closed that November. Omnivore, the open-source darling, went down even earlier, after ElevenLabs hired the team and gave users two weeks to export. Two of the most-recommended apps in the category vanished within a year.

That reshuffled everything. Most "best read-it-later" articles you'll find still recommend dead software. So I spent time with every active option, as someone who both builds in this space and has a 2,000-item saved-links graveyard of my own.

The question I didn't ask in July

In July I judged these apps on capture, reading, and whether their built-in AI was any good. Two months later the question I actually care about is different: can the AI I already use, Claude, ChatGPT, Cursor, read what I saved?

Every app now has an "AI" bullet. Almost all of it lives inside the app: a summary button, a per-article chat, a Q&A box over your library. That's fine until you're in Claude Code trying to remember the argument from a thread you saved three weeks ago, and the only way to get it there is copy-paste. So the new column in the table is "your own AI can read it", meaning an MCP server or equivalent, not a chat box inside the product.

TL;DR

App	Best for	Price (checked Sep 2026)	Built-in AI	Your own AI can read it?
Readwise Reader	Power readers, heavy highlighters	$9.99/mo billed annually or $12.99 month-to-month, no free tier	Ghostreader, per document	Not verified; highlights export to Obsidian/Notion
Matter	Reading + listening on iPhone	free tier; Premium $8/mo or $60/yr	Co-Reader, per article	Not verified
Instapaper	Calm, minimal article reading	free tier; Premium $5.99/mo or $59.99/yr	Summaries (5/mo free), TTS	No
Raindrop.io	Visual bookmark organization	generous free; Pro ~$28/yr	AI tag suggestions; Stella chat (beta, Pro)	Yes, Raindrop has an MCP server with read and write tools
GoodLinks	Apple-only, one-time purchase	$9.99 once + optional yearly pass	Minimal (BYO API key)	No
Cubox	AI reading across platforms	Pro $29/yr; Pro+AI $49/yr	Summaries + AI assistant (Pro+AI)	Not verified
wallabag	Self-hosters, data ownership	self-host free; ~€11/yr hosted	None, by design	No MCP, but full export and a REST API
Omnivore	⚰️ self-host only now	free (AGPL) + your server	Orphaned	No
Sensefold (mine)	One library every AI you use can read and write	Starter $16/mo or $13.33/mo billed annually; 14-day trial, no free tier	Summaries, tags, OCR, transcripts on save	Yes: remote MCP server, OAuth, read/edit/full tiers

The quick takes

Readwise Reader is the best power tool in the category, full stop. If your workflow is read → highlight → export to Obsidian/Notion → spaced repetition, nothing else comes close. The trade-offs: no free tier (30-day trial, then $9.99/mo billed annually), and it can feel like operating heavy machinery when you just want to stash a link.

Matter has the most polished reading experience on iOS and genuinely great text-to-speech. Its Co-Reader answers questions about the article you're reading, per article only. No Android app.

Instapaper is the cockroach of this category, in the most complimentary sense: it has survived every platform shift since 2008 and keeps shipping. The free tier is real. Full-text search and PDFs are paywalled.

Raindrop.io is what most people actually need if "read it later" really means "stop losing links." Collections, tags, apps everywhere, Pro around $28/year. It also quietly did the thing I'm arguing for: Raindrop ships an MCP server, so Claude or Cursor can search your bookmarks. What it doesn't do is capture the content: it's the link and your tags, not the article text, the thread, or the transcript.

GoodLinks is the best value on Apple platforms: $9.99 once, no account, no subscription treadmill, articles saved offline to iCloud, deep Shortcuts support. Apple-only, articles-only, no AI unless you bring your own API key.

Cubox is genuinely good: cross-platform, auto-summaries, and an AI assistant over your saved library. The honest caveat: the AI sits in the $49/year Pro+AI tier, and it stays inside Cubox.

wallabag deserves more respect than it gets. MIT-licensed, self-hostable, survived a decade while VC-backed competitors died, hosted version about €11/year. Web articles only, no PDFs, no OCR, no AI, but nothing else in this list gives you the same data ownership. After watching Pocket and Omnivore die, that argument writes itself.

Omnivore is the cautionary tale. The code is still on GitHub and technically self-hostable, but development is maintenance-only, the mobile apps must be built from source, and the stack is heavy. I'd only recommend it to people who enjoy running infrastructure as a hobby.

Sensefold is mine, so calibrate accordingly. Here's what changed since July and why.

The July version had a chat box over your library, with answers citing the saved items. I removed it. Not because it didn't work, but because the people I talked to already had a chat they preferred, and it wasn't mine. What they wanted was for that chat to know what they'd saved.

So Sensefold is now a personal context: the articles, X and Reddit threads, YouTube pages with transcripts, PDFs, your own notes, and the ChatGPT/Claude/Gemini/Grok conversations you capture, all stored as Markdown, enriched with a summary, tags, and OCR on save, and exposed through a remote MCP server at https://api.sensefold.app/mcp. You paste that address into Claude, ChatGPT, Claude Code, Codex, or Cursor, sign in once in the browser, and pick a tier: read-only, edit, or full. With edit access an agent can also write a note back, and every agent write is versioned so you can revert it. The setup is documented at sensefold.app/for-agents.

The other thing I got wrong in July was the roadmap. The Chrome extension and the Mac app have both shipped since, and the extension is now the main way in: one click on a ChatGPT or Claude conversation saves it with each turn labelled by speaker, which turned out to be the capture I use most.

Pricing changed too, and not in the direction people like: there is no free tier any more. Saving is free, AI processing runs on monthly credits, and Starter is $16/month or $13.33/month billed annually after a 14-day trial. If you only want a reading queue, Instapaper or Raindrop will serve you better and cheaper. Sensefold makes sense when you're already paying for two or three AI tools and want them to share one memory that you own and can export as a Markdown ZIP.

What I learned building in this category

"AI inside the app" is the wrong place for it. Every app now has an AI button. The question worth asking is whether the AI you actually work in can reach your library. As of September 2026 only Raindrop and Sensefold answer yes with an MCP server; the rest keep the AI, and your data, inside their walls.
The hosted-vs-self-hosted trade is real and personal. Pocket users lost their archives. wallabag users didn't. But self-hosting has its own failure mode: the weekend your Postgres volume fills up. Pick which risk you'd rather own. Whatever you pick, make sure the thing exports as plain files.
Nobody needs 10 apps, match the tool to the job. Calm reading → Instapaper or Matter. Highlight-and-export workflows → Readwise Reader. Link organization → Raindrop. Data ownership → wallabag. One library your AIs can read and write → Sensefold.

I've written up the head-to-head trade-offs in more detail: Sensefold vs Pocket, vs Readwise Reader, and vs Raindrop, and the full nine-app comparison with methodology lives on the Sensefold blog.

If you've got a read-later graveyard story from the Pocket/Omnivore shutdowns, or a setup that actually works, I'd genuinely like to hear it in the comments. I read all of them.