Claude cannot see your files by default. On the desktop app you grant access by installing a filesystem extension and naming the folders it may reach. On the web it is not possible at all, because a browser tab has no operating-system permissions to give.
Decide before you connect, not after
note.md runs its AI on your Mac. That is most of the point of it, and this guide describes doing something different, so it is worth being blunt about the trade rather than burying it under the instructions.
Connecting Claude to your vault means the notes Claude reads are processed on Anthropic’s servers. The extension itself runs locally and only reads files you allowed, but the content it passes into the conversation travels the same route as anything else you type into Claude. Local extension, remote model. People conflate those two and assume that because the connector is on their machine, the text stays there. It does not.
That is not an argument against doing it. Claude is genuinely good at restructuring a messy chapter, and no on-device model of a size that fits on a laptop competes with it for that. It is an argument for choosing which folder you point it at with your eyes open. The reasonable position is to use both: note.md’s local search across your indexed library, where nothing leaves, and Claude for the drafting work where you have decided the trade is worth it.
If your vault holds participant data, an unfiled result, or a manuscript you are peer reviewing, the answer is different and the reasoning is set out in pasting unpublished research into cloud AI. The short version: those documents should not be in a connected folder.
Five steps
Find your vault folder
A note.md project is a folder of markdown files and PDFs on disk. Locate it in Finder and note the full path, because you will paste it into the extension configuration. Connect one project rather than a parent folder containing all of them.
Install a filesystem extension in Claude Desktop
Open Claude Desktop, go to Settings, then Extensions, and add the filesystem extension. Extensions are the local counterpart to web connectors: they run on your machine and can reach the operating system, which is why they exist only in Claude Desktop and Claude Code rather than on the web or on mobile. Grant it the vault folder and nothing wider.
Restart Claude Desktop
Quit the app completely rather than closing the window, then reopen it. Filesystem permissions are read at launch, so an extension added mid-session usually will not appear until you have done this.
Install the note.md skills
Upload each skill ZIP under Settings, Customize, Skills. Without them the agent can reach your notes but does not know which markdown note.md renders, which is how you end up with raw syntax in your files.
Test on something you do not care about
Create a throwaway note and ask Claude to add a callout and a wikilink to it. Open the result in note.md. If the callout renders and the link resolves, the skills are loaded and you can point it at real work.
Claude’s settings get reorganised from time to time, so treat the menu names above as a description of where to look rather than an exact click path. The shape stays the same: extensions grant local access, skills teach behaviour, and both live under Settings.
If you already use Claude Code
Then most of this is unnecessary. Claude Code runs in your terminal and reads the directory it was started in, so pointing it at a vault means changing into that folder. No extension, no permission dialog for the folder itself.
cd ~/path/to/your-notemd-project claude
The skills install differently there. They live on your filesystem rather than being uploaded, and the plugin route keeps them current with the repo.
/plugin marketplace add a-aigner/notemd-skills /plugin install notemd@notemd-skills
Same caveat as the desktop app, for the same reason. Claude Code sends the file contents it reads to the model. Running in your terminal makes it local software, not a local model.
What to keep out of a connected folder
Filesystem access is not read-only. An agent working in a connected directory can create files, rewrite existing ones and delete things, each with a confirmation you will eventually stop reading properly. Scope accordingly.
| Content | Connect it? | Why |
|---|---|---|
| Chapter drafts, literature notes, your own writing | Fine | Published or destined to be. Little to lose and the most to gain from restructuring help |
| Reading notes on public papers | Fine | The papers are already public; your annotations are commentary on them |
| Interview transcripts, participant data | No | Usually covered by an ethics approval that names who may process it |
| Unfiled results with commercial potential | No | Disclosure before filing can cost you patentability, and the status of a prompt is untested |
| A manuscript you are peer reviewing | No | You hold it in confidence. Publishers and funders have written rules about this specifically |
| Your whole Documents folder | No | Not because of Claude, but because the blast radius of one bad edit is your entire filesystem |
Why the skills matter once Claude can write
Access alone gets you an agent that can edit your notes badly. note.md reads Obsidian-flavored markdown and renders a subset of it, and a model trained on thousands of public Obsidian vaults defaults to the full vocabulary.
The failure is silent
An embed, a mermaid block, highlight syntax, a callout type outside the five note.md supports: each of those saves cleanly, throws no error, and then renders as literal text or degrades to a plain note. Nothing tells you. You notice weeks later, in the middle of a chapter, staring at raw syntax where a callout should be.
And an eager agent invents things
Ask for a knowledge graph and an agent will happily produce one, except note.md’s graph is derived from your wikilinks, folder layout and citations rather than authored in a file. Ask for an argument map and it may write one, complete with the confidence tiers that are only meaningful when they come from a validator checking real quotes against an indexed source. A hand-written map looks identical and means nothing.
Both skills exist to draw those lines. They are free, MIT licensed, and take about a minute to install from the skills page.
