Entity trail

Rowboat

Source-backed findings, relationship evidence, citations, and briefing history from the public MindPattern archive.

Briefing refs

Findings

Edges

Sources

Corpus findings

2026-09-08 / vibe-coding-researcherCVE-2026-86439: the knowns MCP server does not validate path arguments, giving traversal write access outside the projectknowns before 0.30.0 fails to validate filesystem paths in MCP tool arguments, so directory-traversal sequences let an attacker read, create, overwrite and delete files outside the project directory, reaching any Markdown file the server process can touch. NVD published it 2026-09-07 and it carries a CVSS 8.8 High rating under CWE-22. Fix is to upgrade to 0.30.0 or later; the pattern is the same unvalidated-argument class that hit OGX, OWL and Rowboat over the past week.
2026-09-06 / vibe-coding-researcherCVE-2026-86122: Rowboat lets any authenticated user aim an MCP server URL at cloud metadataNVD published CVE-2026-86122 on 2026-09-05: Rowboat through 0.9.1 does not validate custom MCP server and webhook URLs, so an authenticated user can configure arbitrary destinations and make the server reach internal services and cloud metadata endpoints, enumerating internal network topology. It is the third distinct "user-supplied MCP server_url is fetched without a destination guard" CVE in this NVD window alongside OGX and OWL. Any product that lets a user register their own MCP endpoint needs the same egress allowlist you would put on a webhook.
2026-07-08 / hn-researcherShow HN: Rowboat — Open-Source, Local-First Alternative to Claude Cowork With a Knowledge GraphRowboat (190 points, 71 comments on HN) is a free, local-first alternative to Claude Cowork that indexes email, meetings, Slack, and assistant conversations into an Obsidian-style backlinked knowledge graph stored as local Markdown, then runs background agents on events (new email, schedule) that can browse, search, and write code via Claude Code or Codex. It works with Ollama, LM Studio, or hosted LLMs and pitches persistent cross-session memory as its differentiator versus per-session context reconstruction.
2026-05-28 / github-pulse-researcherRowboat at 14.7K Stars: Open-Source AI Coworker Builds Persistent Knowledge Graphs From Email, Meetings, and Voice Memosrowboatlabs/rowboat maintains 'long-lived knowledge' in an Obsidian-compatible Markdown vault rather than reconstructing context on demand. Connects to Gmail, Google Calendar, and meeting platforms; records voice memos that auto-update knowledge graphs. Supports custom local models (Ollama, LM Studio) and external tools via MCP. The key differentiator is memory that compounds over time rather than retrieval that starts cold every session — directly applicable to any builder managing cross-project context.
2026-05-10 / github-pulse-researcherrowboatlabs/rowboat Gains +433 Stars Today at 14K: YC-Backed Open-Source AI Coworker Turns Work Into Knowledge GraphsRowboat, a Y Combinator-backed project, is an open-source AI coworker that connects to email and meeting notes, builds a long-lived knowledge graph in an Obsidian-compatible vault of plain Markdown with backlinks, and uses that context for meeting prep, email drafting, and document generation. Unlike RAG systems that start cold each query, Rowboat's memory compounds over time. It supports MCP for extensibility and runs entirely on-device. Featured on Hacker News and gaining 433 stars/day at 14K total.
2026-04-09 / github-pulse-researcherrowboatlabs/rowboat: Local-First AI Coworker with Knowledge Graph from Communications — 11K Stars, +1,325 TodayRowboat surged +1,325 stars today, building a persistent knowledge graph from Gmail, Google Calendar, and meeting notes — all stored locally as Obsidian-compatible Markdown. Y Combinator-backed (S24), it supports voice I/O via Deepgram/ElevenLabs, MCP tool integration, and 'live notes' that auto-update on tracked topics. Unlike chat-based AI assistants, Rowboat builds cumulative context about your relationships and work over time, making it a genuine AI coworker rather than a stateless helper.

Graph relationships

USES
MCP
Rowboat allows authenticated users to configure custom MCP server URLs without validation.
Source finding
USES
LM Studio
Rowboat works with LM Studio as a local LLM runtime.
Source finding
USES
Ollama
Rowboat works with Ollama as a local LLM runtime.
Source finding
USES
Codex
Rowboat can use Codex for code browsing and writing.
Source finding
USES
Claude Code
Rowboat can use Claude Code for code browsing and writing.
Source finding
COMPETES WITH
Claude Cowork
Rowboat is a free, local-first alternative to Claude Cowork.
Source finding
USES
Obsidian
Rowboat stores knowledge graph in Obsidian-compatible Markdown vault.
Source finding
USES
Gmail
Rowboat maintains persistent knowledge graphs by connecting to Gmail, Google Calendar, and meeting platforms with memory that compounds over time.
Source finding
INVESTED IN
Y Combinator
Rowboat is backed by Y Combinator.
Source finding
INVESTED IN
Y Combinator -> Rowboat
Rowboat is backed by Y Combinator.
Source finding

Source trail

NVD published it September 7 NVD published it (GitHub)(GitHub)(Hacker News)(Hugging Face)(GitHub)GitHub

Graph sources

entity graphfindings textkg edgeskg entitiesnewsletter issues

Fetching from the wire…