This tool reads personal notes, writes launchers, and installs one small script that runs on every prompt you send. Those are the three things worth being careful about, so here is exactly what it does.

• Your Claude Code memory files, under your home directory.
• Any folder you explicitly name when it asks where your projects and notes are.

Nothing else. It does not search your drive, and it does not read a path you did not give it. If a permission prompt names somewhere you did not expect, deny it — setup continues with the rest.

You can point the read root elsewhere with /setup --home <path>.

• A vault, at the folder you choose.
• A working folder beside it, containing the configuration file, a set of agent definitions (plain Markdown), a prompt hook and its settings file (JavaScript and JSON), and a local link-graph viewer (JavaScript and HTML).
• Launchers: a .cmd on your Desktop, one in the working folder, and one in %USERPROFILE%\.local\bin. On Windows your PowerShell profile is not touched. On macOS and Linux, one line is added to the file your shell reads at startup.
• If a Claude Code memory file already exists for the working folder, its contents are replaced with a pointer to the vault.

Nothing is written to a system-wide location, and nothing is registered as a service or a startup item. Everything outside your vault and the launchers is inside that one working folder.

That is the complete list. UNDO.md reverses all of it.

Setup writes two JavaScript files. Neither is fetched from anywhere; both are copied from this repo, and you can read them here before running anything.

.claude/hooks/library-reminder.js runs on every prompt you send, because Claude Code is configured to call it as a UserPromptSubmit hook. It reads the text of your prompt from standard input, tests it against a fixed list of words, and prints a short reminder when one matches. It makes no network calls, opens no files, and writes nothing to disk. Your prompt is not stored, forwarded, or logged anywhere by it. Delete the file and .claude/settings.json beside it to remove it entirely.

vault-graph/serve.js only runs when you start it by hand. It reads the Markdown files in your vault, extracts the [[links]], and serves a graph on 127.0.0.1:8731. It binds to loopback, so nothing outside your machine can reach it, and it serves exactly two fixed routes rather than acting as a general file server. It writes nothing.

Both are short enough to read in full, and that is the intended way to trust them.

• Never moves, renames, or deletes any file of yours. Migration copies.
• Never copies credentials. Files matching .env, .env.*, anything named like a secret, token, password, or credential, any .pem, .key, .p12, or .pfx, and any file containing a long opaque value assigned to a key-shaped name are all skipped. They are listed as skipped, with the reason, so you can see they were found and passed over rather than missed.
• Never prints a credential value. Only the filename and the reason.
• Never writes a token, key, or password into the state file, a note, or a summary. Linear uses OAuth precisely so there is nothing to write down. If you offer an API key instead, it declines.
• Never writes before you approve twice — once at the start, and once on the full list of what it found and where each thing would go.

Authorization is OAuth, handled by Claude Code's MCP integration. No credential reaches this tool or your disk through it.

Revoke it any time in Linear under Settings, Security and access, and disconnect with claude mcp remove linear-server.

The installer itself is Markdown — instructions a model follows, with no build step and no dependency. The only executable things it ships are the two scripts described above, both vendored in this repo in full.

• .claude/skills/setup/SKILL.md is the control flow, deliberately kept short.
• .claude/skills/setup/references/ holds one file per phase.
• migration.md is the one to read if you only read one. It contains the rules about copying and credentials.
• .claude/skills/setup/references/templates/hooks/library-reminder.js is the hook that will run on every prompt. Read it — it is about 150 lines, most of them a word list.
• .claude/skills/setup/references/templates/vault-graph/serve.js is the graph server.
• .claude/skills/setup/references/templates/agents/ holds the agent definitions. They are Markdown instructions, not programs, but they describe what those helpers are allowed to write, which is worth reading before you accept them.

Read it before running it. That is the point of shipping it as a repo rather than a package.

For anything that looks like a real security issue — a path it reads that it should not, a credential that reaches disk, a file that gets modified rather than copied — open an issue:

https://github.com/matthewmernaugh/brain-setup/issues

Include your operating system and what you observed. If the report would require including sensitive content to explain, say so in the issue without the content and it can be handled from there.

The installer has not been run end to end. The guarantees above are how it is written, reviewed against the source, and checked by 24 structural tests. They are not yet confirmed by observing a complete run.

That distinction matters most for the credential-skipping rule and the two approval gates, since both are instructions to a model rather than enforced mechanisms. Judge accordingly, and consider running it against copies first.