Skip to content
Back to skills

Granola

ASecurity

Search and read Granola meeting notes and transcripts through Granola's OAuth-backed MCP server.

  • 69,003 stars
  • 0 votes
  • 0 copies
  • 1 view
  • Added October 4, 2026
ai-agents

Works with

  • cli
  • mcp

Security analysis

A100/100

Pro scans all 3 files and shows the line behind each finding

Scanned October 4, 2026

npx -y skills add asgeirtj/system_prompts_leaks --skill granola --agent claude-code

Installs into .claude/skills of the current project.

Are you the author of Granola?

Add the live security badge to your README. It updates with every re-scan.

Security grade badge for Granola
[![Security: A — Skills Directory](https://www.skillsdirectory.com/api/skills/asgeirtj-granola/badge)](https://www.skillsdirectory.com/skills/asgeirtj-granola)

More formats (shields.io, HTML) on the badges page. Keep it an A: scan every change in CI with Pro.

Download with Pro
SKILL.md
---
name: "granola"
description: "Search and read Granola meeting notes and transcripts through Granola's OAuth-backed MCP server."
icon: "granola"
metadata: { "includeInPrompt": false }
---

# Granola

## Purpose
Search Granola meeting notes, summaries, and transcripts through the hosted  
Granola MCP server (`https://mcp.granola.ai/mcp`).

## Tooling
Use `exec` to run:

```sh
granola-cli <subcommand> [options]
```

### Connection management

```sh
granola-cli status
granola-cli authorize-url
granola-cli exchange-code --code <code> [--redirect-uri <url>]
granola-cli refresh
granola-cli disconnect
```

### MCP operations

```sh
granola-cli list-tools
granola-cli call-tool --name <tool> --arguments-json '<json-object>'
```

`--arguments-json` must be a JSON object; arrays or scalars are rejected. Use
`list-tools` first to discover the tool catalogue and each tool's  
`input_schema`.

## Auth
OAuth is handled by authd via Dynamic Client Registration + PKCE (S256). The
credential stays behind authd; do not read or edit connector auth files.

## First-use setup flow

1. Run `granola-cli status`.
2. If status is `not_connected`, run `granola-cli authorize-url`. When
   `connect_url` is present, replace `<connect_url>` with the returned URL
   and share exactly this Markdown link: `[Connect Granola](<connect_url>)`; do not paste the raw
   URL separately. Wait for the user to complete authorization.
3. After the user authorizes, the browser is redirected via the Muse relay
   back to this VM, and authd completes the code exchange automatically. The
   agent resumes once the token lands.
4. Re-run `granola-cli status`. When status flips to `connected` the output also
   includes the discovered MCP tool catalogue.

For manual environments where the relay is not wired up, call
`granola-cli exchange-code --code <auth-code>` after receiving the code.

## Operating Rules
1. Run `granola-cli status` before any MCP work. If not `connected`, complete
   the setup flow first.
2. Call `list-tools` before `call-tool` unless you already know the tool name
   and its argument shape. Never guess tool names.
3. `arguments-json` must be a JSON object; wrap every argument appropriately.
4. Prefer `query_granola_meetings` for natural-language questions,
   `list_meetings` for metadata, `get_meetings` for known meeting IDs, and
   `get_meeting_transcript` only when the user needs verbatim detail. Use
   `get_account_info` to answer which account/workspace is connected and,
   when results come back empty, to check `mcp_note_access.scopes` — a
   workspace whose MCP access is `public`-only excludes personal notes.
   `list_meetings` defaults to the last 30 days; when it returns zero
   meetings, retry with `time_range: "custom"` plus `custom_start` and
   `custom_end` before concluding the account has no meetings, and use
   `list_meeting_folders` to see what the workspace actually holds.
5. Preserve Granola citation links in user-facing answers.
6. Do not use Granola for calendar scheduling or upcoming-event planning.
7. Token refresh happens automatically on 401. If `call-tool` keeps failing
   with `unauthorized`, run `granola-cli refresh` explicitly or ask the user to
   re-authorize.

Files in this skill

  • SKILL.md3.1 KB
  • connector_auth_config.yaml242 B
  • manifest.yaml1.6 KB

Attribution

Is this your skill, or is something wrong with this listing? Request removal or report an issue. Author removals are honored within 72 hours.

Comments

Loading comments…

Newsletter

Get the weekly list of safe new skills, and the ones we pulled.