LockIn

[Try it](https://lockin.namankhandelwal.dev) · Self-host · Connect your agents · Ask your notes · Develop

You learn things inside Claude, Codex and Cursor every day, and most of it is gone when the session ends. LockIn keeps it. Your agents save notes into it over MCP, you file them by subject, and any model you choose answers questions from them.

The launch film, 45 seconds, with sound:

https://github.com/user-attachments/assets/3ae46572-283e-49fd-a3dc-e178dd269e40

How it fits together

Monday: Claude Code saves a note to Project-X, and you witness it. Thursday: Codex picks up where it left off.

flowchart LR

cc["Claude Code"] -- save_note --> mcp cx["Codex"] -- search_notes --> mcp more["Cursor, Claude.ai, ChatGPT, any MCP client"] --> mcp mcp(["LockIn's MCP server /api/mcp"]) --> nb[("Your notebook notes filed by subject")] nb --> you["You witness, read, plan"] nb --> ask["Ask a model you choose, answers cite your pages"]

What's in it

Agents write here

Claude Code, Codex, Cursor or any MCP client can save, search and read your notes. Everything an agent saves says who recorded it and waits for you to witness it.

Ask your notes

Chat with a model in your browser (WebGPU), on your own machine (Ollama, LM Studio), or from Anthropic, OpenAI, Gemini or OpenRouter with your own key. Answers cite the pages of your notes they came from.

Notes by subject

Markdown with code, plus the PDFs and links you're reading, filed under the subject they belong to.

Read without distraction

Any note opens full screen.

A plan when you want one

Tasks, focus time, exam pace and spaced revision live in each subject's Plan tab, out of the way until you need them.

Yours

AGPL-3.0, self-hostable with one command, and everything exports to Markdown or JSON.

Self-hosting

You need Docker with Compose.

git clone https://github.com/Sky-walkerX/LockIn.git && cd LockIn

cp .env.example .env

set AUTH_SECRET in .env: openssl rand -base64 32

docker compose up -d

Open http://localhost:3000 and create an account. The port answers only on the machine itself; for a server, see HTTPS below. The first start pulls the released images, waits for Postgres and applies the database migrations before the app starts. Images are published for amd64 and arm64; where there's none for your version, Compose builds from the checkout instead.

What runs:

To add text extraction and server-side embeddings, set INGEST_SECRET (any long random string) and INGEST_URL=http://ingest:8080 in .env, then:

docker compose --profile ingest up -d

The ingest image carries its embedding model, so it's about 1 GB. Without it, keyword search works, and the browser does embeddings itself. It reads two documents at a time and stops one that takes over 140 seconds; a third waits 20 seconds for a slot and is then told the service is busy. PARSE_CONCURRENCY in .env raises the first number, on a machine with a core and a few hundred MB to spare per document.

To update, pull the new release. The compose file names the version it goes with, so the images always match the checkout. Migrations run on start:

git pull && docker compose pull && docker compose up -d

To run the code in your checkout instead of a release, build it: docker compose up -d --build.

docker compose ps shows whether the app is healthy; the same check is at /api/health (200 when the app can reach its database) for an uptime monitor.

Backups

Everything lives in two volumes: db (Postgres) and uploads (note images and PDFs). Back up both, and take a backup before updating.

# back up

docker compose exec -T db pg_dump -U lockin -Fc lockin > lockin.dump docker compose cp app:/data/uploads ./uploads-backup

restore, into a stack that is up

docker compose exec -T db pg_restore -U lockin -d lockin --clean --if-exists < lockin.dump docker compose cp ./uploads-backup/. app:/data/uploads docker compose exec -u root app chown -R lockin /data/uploads # copied files arrive owned by the host user

Keep AUTH_SECRET with the backups. A restored copy with a different secret signs everyone out.

Settings in .env:

HTTPS

On a machine the internet can reach, LockIn needs HTTPS: without it sessions and agent tokens cross the network in the clear, and browsers won't run a local model. The https profile adds Caddy, which gets a certificate from Let's Encrypt and renews it. Point your domain at the machine, open ports 80 and 443, and set in .env:

PUBLIC_URL=https://notes.example.com   # no trailing slash

docker compose --profile https up -d

The proxy's settings are in Caddyfile: a year of Strict-Transport-Security, and a 60 MB cap on a request's body.

With a proxy of your own on the machine (nginx, Traefik) leave the profile off, set PUBLIC_URL, point the proxy at 127.0.0.1:3000 and have it send Strict-Transport-Security. That's the one security header LockIn leaves out, since only the proxy knows the site is served over HTTPS; the rest (a content security policy, no framing by other sites, no content sniffing) it sends itself.

Port 3000 isn't open to the network, so the proxy can't be gone around. To use LockIn from other machines without a proxy, on a home network say, set LOCKIN_BIND=0.0.0.0 and TRUSTED_PROXY_HOPS=0. Docker publishes that port past most host firewalls, and everything, passwords and agent tokens included, then travels unencrypted.

Accounts

Anyone who can open the address can sign up, unless you set SIGNUP=closed: make your own account first, then close it.

With SMTP_HOST set, LockIn sends two emails. A new account gets a link to confirm its address and can't sign in until it's opened, and "Forgot password" sends a link that sets a new one. The links are built from PUBLIC_URL, so set it to the address people really use. Without SMTP there's no email: accounts sign in straight away, and you reset a forgotten password yourself:

scripts/set-password.sh someone@example.com

Changing or resetting a password signs that account out everywhere. Resetting one, by the emailed link or with the script, also disconnects every agent and connected app, in case someone else had been in: a token they made would outlast the new password. Connect them again in Settings. Settings has "Change password" and "Delete account", which removes the notebook, its files and every agent's access.

A notebook you run for yourself has no privacy or terms page. If other people sign up on yours, set OPERATOR_EMAIL, and OPERATOR_NAME if you like: /privacy and /terms appear, linked from the landing and sign-up pages, and name you as the one to write to. OPERATOR_HOSTING is a sentence of your own, shown on the privacy page, on where the data is kept and how long backups are. Both pages describe what LockIn does and make a few promises in your name (that you don't read people's notes, that you'll give notice before closing), so read them before turning them on.

"Continue with Google" makes a new account, or opens the existing one with that address if the address was confirmed. It won't attach to an account made with a password whose address was never confirmed, so nobody can claim an address ahead of its owner.

Limits

LockIn counts a few things so one caller can't wear the instance out, and answers 429 with Retry-After past