# Postern

## Docs

- [Frequently asked questions](https://docs.getpostern.com/about/faq.md): What Postern is, where your data lives, what an agent can reach, and what ships today.
- [Connect Apple Health](https://docs.getpostern.com/connect/apple-health.md): Your iPhone pushes health data to an address the Console creates for it. Postern never pulls, and keeps what your phone sends from the day you start.
- [Connect ChatGPT](https://docs.getpostern.com/connect/chatgpt.md): ChatGPT connects from OpenAI's cloud, so Postern needs a public HTTPS address on port 443 before you start.
- [Connect Google and Gmail](https://docs.getpostern.com/connect/google.md): Gmail with an app password. Calendar and contacts with your own Google Cloud app. The two parts are independent — do either one, or both.
- [Connect Home Assistant](https://docs.getpostern.com/connect/home-assistant.md): Stream your Home Assistant devices into Postern. It is the only source an agent can act on.
- [Connect iCloud](https://docs.getpostern.com/connect/icloud.md): One app-specific password from Apple gives Postern three read-only connections: mail, calendar and contacts.
- [Connect Microsoft](https://docs.getpostern.com/connect/microsoft.md): Register your own app at Microsoft, approve one consent, and get three read-only connections: Outlook mail, calendar and contacts.
- [Connect Plaid](https://docs.getpostern.com/connect/plaid.md): One trip through Plaid's own window links one bank, and each bank becomes its own read-only connection. Plaid bills per bank, so use Plaid for the banks SimpleFIN cannot reach.
- [Connect SimpleFIN](https://docs.getpostern.com/connect/simplefin.md): Accounts, balances and transactions from the banks you link at SimpleFIN Bridge. You paste one token — nothing to install, no developer account.
- [Connect WHOOP](https://docs.getpostern.com/connect/whoop.md): Recovery, sleep, strain, workouts and day-cycles, through a developer app you register once under your own WHOOP account.
- [Postern](https://docs.getpostern.com/index.md): A personal context gateway you run yourself. AI assistants ask Postern; Postern answers from your own machine.
- [Back up, export and erase](https://docs.getpostern.com/operate/backup-and-export.md): Save the master key and the database in one file, restore them on another machine, export your cached data as JSON, and erase it.
- [Agent keys: create, expire, revoke, rotate](https://docs.getpostern.com/reference/agent-keys.md): What an agent key is, the deadline it can carry, and the four operator verbs that change or end one — with the exact Console clicks and what the agent sees.
- [The audit log](https://docs.getpostern.com/reference/audit-log.md): What one row holds, what gets a row, and what does not.
- [Grants and sectors](https://docs.getpostern.com/reference/grants-and-sectors.md): The six sectors, which sectors a sign-in turns on, what one grant covers, and where every control that changes a grant lives in the Console.
- [Act on a source: list_actions, invoke_action](https://docs.getpostern.com/reference/mcp-actions.md): The write side: what the sources let an agent do, how one action is dispatched, why `ok: false` is a successful call, and what Postern never runs.
- [Freshness and live reads: describe_context, fetch_live](https://docs.getpostern.com/reference/mcp-freshness.md): How old the data is, what to do about it, the one read that leaves the cache, and how often Postern checks each source.
- [MCP tools](https://docs.getpostern.com/reference/mcp-primitives.md): How an agent connects: the address, the transport, the key it sends, what every tool call returns, and where each tool is documented.
- [Read data: get_schema, query, get_record](https://docs.getpostern.com/reference/mcp-reading.md): The three tools that read the local cache — every parameter, both response shapes, the traps that make a successful answer wrong, and every refusal by name.
- [The OAuth bridge, for hosted agents](https://docs.getpostern.com/reference/oauth-bridge.md): Why a hosted agent cannot hold your agent key, how Postern signs it in instead, the eight addresses the internet reaches, and the one key it refuses.
- [Which computers can reach Postern](https://docs.getpostern.com/reference/ports.md): The two ports Postern opens, the one line in docker-compose.yml that protects them, what guards each route group, and the one route the internet may reach.
- [Provider sign-ins](https://docs.getpostern.com/reference/provider-sign-ins.md): The redirect address Postern pins, what each provider needs and why, why the failures say so little, and the credentials that behave like passwords.
- [Read the record](https://docs.getpostern.com/reference/read-the-record.md): The ledger screen and GET /api/audit — the columns, every filter, paging, and Export CSV.
- [What the record cannot promise](https://docs.getpostern.com/reference/record-limits.md): How durable the record is, why nothing enforces immutability, and the five questions the record cannot answer.
- [Why an agent was refused](https://docs.getpostern.com/reference/refusals.md): Where the sector check happens, the two refusal shapes on each surface, the three reasons a key itself fails, and which refusals leave a row.
- [Security model](https://docs.getpostern.com/reference/security-model.md): The premise every other rule follows from, the three properties Postern holds by design, and what nobody outside the project has reviewed.
- [The vault and the master key](https://docs.getpostern.com/reference/vault.md): What Postern encrypts and what it does not, where the master key comes from, how to rotate it, and the one command that destroys it for good.
- [Connect an agent](https://docs.getpostern.com/start/connect-an-agent.md): Paste one config block into Claude Code or Cursor. Claude Desktop needs a bridge. claude.ai and ChatGPT need a public address first.
- [Mint your first key](https://docs.getpostern.com/start/first-key.md): Create one agent key in the Console: name it, tick the sectors it may reach, set when it expires, and store it before you leave the screen.
- [Install Postern](https://docs.getpostern.com/start/install.md): Run Postern under Docker on a machine you own, then open its Console.
- [Set up remote access](https://docs.getpostern.com/start/remote-access.md): Open two ports to your own devices, and one port to the internet only if claude.ai or ChatGPT needs it.