MCP and Privacy: Why My MCP Knowledge Base Is Better Than ChatGPT For Personal Notes

Honestly, I used to be really paranoid about putting all my personal notes into ChatGPT.

Think about it — every idea, every half-baked project, every financial plan, every stupid mistake I made learning something new. All of that gets uploaded to OpenAI's servers, stored forever, maybe even used to train their models. It's not that I have anything illegal to hide — it's just that it's mine, you know?

I spent six years building this personal knowledge base called Papers. It's got over 2,800 notes I've collected throughout my career. Everything from design patterns I want to remember, to debugging tricks I learned the hard way, to ideas for side projects I might build someday.

When MCP (Model Context Protocol) came around, something clicked. I realized I could have AI use my knowledge without actually giving away all my knowledge. And honestly? It's worked way better than I expected.

So here's the thing — the privacy problem with AI note-taking

Most AI note-taking apps work like this:

1. You upload all your notes to their cloud
2. They process everything, embed everything, store everything
3. When you ask a question, they send the whole context to the AI
4. The answer comes back, but your data is already on their servers

Maybe you trust them. Maybe you don't. I didn't.

I tried everything. Local LLMs running on my machine — great for privacy, but my laptop isn't exactly a data center. Slow, gets hot, battery dies in an hour. Self-hosted vector databases — complicated to maintain, expensive to run 24/7, still requires sending the whole database somewhere if you want to use a good model like Claude or GPT-4.

What I wanted was simple:

• Keep all my notes on my own server
• Let AI use them when I ask questions
• Only send the specific fragments the AI needs right now
• Nothing stored permanently by third parties
• Easy to use with any MCP-compatible client

MCP gave me exactly that.

How MCP changes the privacy game

Let me show you the architecture I ended up with. It's actually ridiculously simple compared to what I was doing before.

Before MCP:

1. My knowledge base → build full embeddings for everything
2. Store embeddings in Pinecone/Weaviate/whatever
3. When query comes → embed query, find similar notes
4. Send entire similar notes to OpenAI/Anthropic
5. Get answer back

Problem: If you're using a third-party LLM, you still send all those notes to them. Maybe that's fine for some people, but not for me.

After MCP optimization:

1. My knowledge base → expose MCP endpoints tools/list and tools/call
2. AI client runs on my local machine (or anywhere really)
3. When I ask a question → the client calls my MCP server to search
4. My server returns just the matching fragments
5. Client sends only those fragments to the LLM with my question

The difference? My entire knowledge base never leaves my server. Only the tiny bits relevant to this specific question go to the LLM. That's it.

Here's what that looks like in code (Java Spring Boot, because that's what I know):

@RestController
@RequestMapping("/mcp")
public class McpPrivacyFirstController {

    private final KnowledgeSearchService searchService;

    public McpPrivacyFirstController(KnowledgeSearchService searchService) {
        this.searchService = searchService;
    }

    @PostMapping("/tools/call")
    public ResponseEntity<McpCallResponse> searchKnowledge(
            @RequestBody McpCallRequest request,
            @RequestHeader(value = "X-API-Key", required = false) String apiKey
    ) {
        // 1. Authenticate the client (only my clients can call this)
        if (!isValidApiKey(apiKey)) {
            return ResponseEntity.status(HttpStatus.UNAUTHORIZED)
                    .body(McpCallResponse.error("Invalid API key"));
        }

        // 2. Get the search query from the arguments
        String query = (String) request.getArguments().get("query");
        int maxResults = getOrDefault(request.getArguments().get("max_results"), 5);

        // 3. Search locally on *my server* - never leaves
        List<KnowledgeFragment> fragments = searchService.searchFragments(query, maxResults);

        // 4. Only return the matching fragments to the *client*
        // Client decides what to send to the LLM
        // My full knowledge base stays right here
        McpCallResponse response = McpCallResponse.success(fragments.stream()
                .map(fragment -> new McpContentItem()
                        .type("text")
                        .text(fragment.getContent()))
                .toList());

        return ResponseEntity.ok(response);
    }
}

That's basically it. The whole privacy-focused MCP server is under 150 lines of code. No fancy embeddings server required if you don't want it. I just use simple text search and it works surprisingly well because the AI does all the heavy lifting.

Wait, let me show you the tool definition too — because that's what the AI client uses to understand what your tool does:

@RestController
@RequestMapping("/mcp")
public class McpPrivacyFirstController {

    // ... constructor and search method ...

    @GetMapping("/tools/list")
    public ResponseEntity<List<McpToolDefinition>> listTools() {
        McpToolDefinition searchTool = McpToolDefinition.builder()
                .name("search_knowledge")
                .description("Search my personal knowledge base for relevant notes fragments. " +
                        "Use this when I ask about things I might have learned before.")
                .inputSchema(new JsonObject() {{
                    add("type", "object");
                    add("properties", new JsonObject() {{
                        add("query", new JsonObject() {{
                            add("type", "string");
                            add("description", "The search query to find relevant notes");
                        }});
                        add("max_results", new JsonObject() {{
                            add("type", "integer");
                            add("description", "Maximum number of results to return (default: 5)");
                            add("default", 5);
                        }});
                    }});
                    add("required", List.of("query"));
                }})
                .build();

        return ResponseEntity.ok(List.of(searchTool));
    }
}

See what I mean? It's all pretty straightforward. The AI client knows it can call search_knowledge to get relevant bits from my notes. My server never exposes everything — only what matches the current query.

The privacy difference in concrete terms

Let's say I have 2,800 notes (which I do). Average note is maybe 500 words. That's 1.4 million words total.

Before MCP when I wanted to ask a question:

• Sent to LLM: ~2,000-5,000 words (the top matching notes)
• But your entire database is already on someone else's server if you went with the cloud embedding approach

With my current MCP setup:

• Sent to LLM: ~2,000-5,000 words (the top matching fragments)
• Your entire database never leaves your server
• Only the fragments for this specific query ever go anywhere

Even if the LLM provider logs everything, they only get the fragments you actually asked about. They don't get the rest of your private business.

I learned this the hard way — I used to use a popular AI note-taking app, and one day I realized they'd changed their privacy policy to allow using user data for training. Bye bye.

What's actually stored where?

Let me be 100% clear about this:

What	Where it's stored	Who can access it
All my personal notes	My server only	Me only
Embeddings (if I use them)	My server only	Me only
Search index	My server only	Me only
Current query fragments	MCP client + LLM	The client and LLM provider see only these
Chat history	Depends on your client	If client is local, only you see it

That's the big win. If you trust your own server more than someone else's, this architecture is for you.

Pros and Cons — let's be honest about this

I wouldn't be doing my job if I didn't tell you the downsides. This isn't for everyone.

✅ What works really well

1. True privacy by design — Your data stays yours. If you don't want your personal thoughts training someone else's model, this is the way to go.

2. Incremental adoption — You don't have to migrate everything to a new service. Just wrap your existing notes with MCP endpoints. I migrated my 6-year-old project in an afternoon.

3. Works with any MCP client — Claude Desktop, Cursor, whatever comes next. As long as it speaks MCP, it works. No vendor lock-in.

4. Cheap as chips — My whole setup runs on Fly.io for about $3 a month. That's including the database, the MCP server, everything.

5. You already know how to maintain it — If you can run a basic web server, you can run this. No weird new infrastructure to learn.

❌ What doesn't work (yet)

1. MCP is still young — Not all AI clients support it yet. The ecosystem is growing fast, but it's not universal. If you need everything working perfectly today, you might be frustrated.

2. You have to maintain a server — It's not hard, but it's still something you have to maintain. If you don't want to deal with servers, this isn't for you.

3. No cross-device sync out of the box — Wait, actually that's easy — just sync your notes with Git. Which I was already doing. So maybe that's not really a con for me. But if you weren't already syncing, you need to set that up.

4. Search isn't "smart" out of the box — Simple text search works surprisingly well because the AI does the understanding. But if you have thousands of notes, you might still want embeddings. You can still do embeddings locally on your server though — that's what I do, and they never leave.

5. Offline use is tricky — You still need an internet connection to reach the LLM unless you're running everything locally. Which you can do, but that brings us back to the local LLM performance problem.

Who should actually do this?

After building this and using it daily for a few months, here's my honest take:

You should try this if:

• You have thousands of personal notes already
• You don't feel comfortable uploading everything to a third-party AI service
• You know how to run a basic web server
• You already use an MCP-compatible client like Claude Desktop or Cursor
• You just want AI to use your notes, not "own" your notes

You probably shouldn't bother if:

• You only have a few hundred notes
• You don't care about privacy that much (which is totally fine!)
• You don't want to maintain any infrastructure
• You need everything to "just work" out of the box with zero configuration

Honestly, even if you do it just to understand how MCP works, it's worth the afternoon of work. I learned more about MCP building this 150-line server than I did reading all the documentation.

Three unexpected benefits I didn't see coming

1. Faster iteration on my knowledge base — Because it's just my code on my server, I can tweak the search ranking whenever I want. No waiting for approvals or dealing with other people's APIs changing. If I want to weight newer notes higher, I just change a line of code and deploy. Done.

2. Better context for the AI — Because I'm only sending the relevant fragments, not the whole note, the context window isn't wasted. The AI gets exactly what it needs to answer the question. I actually get better answers now than when I was sending whole notes.

3. It changed how I write notes — I've started writing more concise, focused notes. Because I know the search returns fragments, I don't ramble as much. Not that rambling is bad — it's just interesting how the architecture changes your habits.

The bottom line

MCP isn't just about connecting AI clients to tools — it's about control. Control over where your data lives, control over who sees what, control over your own infrastructure.

I spent six years over-engineering this knowledge base, got 99.4% ROI negative (true story, I calculated it), and then MCP came along and made it actually useful again. All I had to do was add 150 lines of code to expose it as an MCP server.

The privacy angle wasn't even the main reason I did it at first — it was just something that fell out of the architecture. But now that I have it, I can't imagine going back. Knowing that my private notes stay private even when I'm using AI is pretty great.

---

So what about you? Are you worried about putting all your personal notes into AI services? Have you tried building an MCP server for your own data? I'd love to hear what privacy architectures you're using in the comments below.

Do you think MCP changes the privacy game for personal AI, or is it still more trouble than it's worth?