Your brain can search the web, fetch pages, research people and companies, and work with your connected email and calendar. Those same tools are available outside the brain too: from your own terminal, and from AI assistants you already use, like Claude Code. Three things are true no matter where a tool is called from: 1. **Nothing runs until you allow it.** A freshly connected terminal can do nothing at all. Access comes from a permission you hook it up to, and every refusal explains, in plain words, how to grant what was missing. 2. **Every call is recorded.** Who called what, when, the outcome, and the cost. So is every change you make to access itself: connecting a terminal, changing a permission, turning access off and on. You can watch it all happen live. 3. **Your accounts stay yours.** Keys and account credentials never leave our servers. Tools that change things, like sending email, exist only if you grant them, are clearly marked, and are off unless you switch them on. ## Connect a terminal Install the `gbrainio` command, then sign in: ``` gbrainio login ``` `login` prints one link and opens it in your browser. On that screen you do two things: give the terminal a name you'll recognize later ("Hermes Mac Mini"), and pick how long it stays signed in. That's it. The terminal connects with no access, and you land on its page to give it some. If the browser can't open on that machine (a server over SSH, for example), paste the printed link into any browser. For fully headless setups (CI), mint a token ahead of time and use `gbrainio auth `. ## Permissions: what a terminal can reach A **permission** is a named policy of what a terminal can do: "Search the web", "Web + read email", whatever you shape. You can have as many as you like, and hook any number of terminals up to each one. Change a permission and every terminal hooked up to it follows, from its very next call. No restarts, no signing in again. Build them at **Workspace → Permissions**. Start from a template and tweak it, clone one you already have, or start blank. Access levels are cumulative: Read, then Manage, then Full, so a terminal that can send email can always read it too. A terminal that isn't hooked up to a permission can carry its own custom access, set on its page the same way. ## Your terminals **Workspace → Terminals** lists everything you've connected, across all your workspaces: each terminal's name, whether it's on or off, which permission it's hooked up to, and when it was last used. Click one for the whole story: what it can reach, its activity streaming in live, and its controls. - **Turn off** stops its calls immediately. Turn it back on any time; if something was still trying to use it while off, you'll see those refused calls on its page, so you know before you flip the switch. - **Extend** gives it another 30 days. - **Revoke** is forever. The terminal is signed out, and its history stays as your record. A terminal you forget about revokes itself after 14 days unused. ## From your terminal Three levels, each showing what is under it: ``` gbrainio tool ls # the services this terminal can reach gbrainio tool gmail # one service's commands gbrainio tool gmail search -h # one command's arguments ``` Then call one: ``` gbrainio tool exa search "planning agendas" gbrainio tool firecrawl scrape https://example.com gbrainio tool perplexity research "what has the SF planning commission approved this year" gbrainio tool x search "from:garrytan" gbrainio tool crustdata person https://www.linkedin.com/in/jane-doe gbrainio tool captain company stripe.com gbrainio tool captain investors "Jane Doe" gbrainio tool happenstance research "Jane Doe, Acme, CEO" gbrainio tool gmail search "invoices from June" gbrainio call ls # your recent activity log gbrainio logout # sign out and revoke this terminal ``` Every argument a command takes is also a flag, so you can say what you want one piece at a time instead of composing a search string: ``` gbrainio tool gmail search --from billing@stripe.com --newer-than 7d --unread gbrainio tool gmail search --subject "Action needed" --has-attachment ``` Searching your mail takes `--from`, `--to`, `--subject`, `--label`, `--after`, `--before`, `--newer-than`, `--older-than`, `--has-attachment`, `--unread` and `--max-results`, and a phrase alongside them if you want one. On a search, `--from` is the sender you are looking for; `--account` is always which of your connected addresses to look in. Writing one you'll send yourself: ``` gbrainio tool gmail draft --to jenny@example.com --subject "Tuesday" --body "Works for me." gbrainio tool gmail draft --reply-to --body "Noon works." # answers in the same thread gbrainio tool gmail draft --to a@b.com --body "Attached." --attachments receipt.pdf cat message.eml | gbrainio tool gmail draft --eml - gbrainio tool gmail drafts # what's waiting for you ``` Drafts are the half of email that can't get you in trouble: your brain writes it, it lands in your Drafts folder, and nothing goes anywhere until you read it, edit whatever you like, and press send yourself. Writing drafts and sending email are separate things to allow, and most people should only ever allow the first. Organizing it: ``` gbrainio tool gmail labels # what labels you have gbrainio tool gmail label --name Receipts # file it, by name gbrainio tool gmail label --name Flights --create gbrainio tool gmail move --to archive # or inbox, trash, spam gbrainio tool gmail mark --read --starred ``` Add `--thread ` in place of the message id and the whole conversation moves as one thing. Nothing here deletes mail for good: the furthest anything goes is your trash, which Gmail keeps for 30 days and you empty yourself. Reading one message: ``` gbrainio tool gmail read # the message as readable text gbrainio tool gmail read -m text/html # the markup, exactly as sent gbrainio tool gmail read --attachment-id # read what came attached gbrainio tool gmail read --attachment-id --out receipt.pdf # save it gbrainio tool gmail read -f eml > message.eml # the whole message, as delivered ``` Four flags work the same way on every command: ``` -a, --account one of several connected addresses -f, --format json|text|eml readable text on a terminal, JSON when piped -d, --dry-run what a call would do, without running it -h what this command takes ``` Anything the command does not recognize is an error that names the flags it does take, so a mistyped flag never quietly ends up inside your search text. ## Research tools Beyond plain search, your brain can research: ask an open question across the web and get a cited answer (`perplexity research`), search posts on X (`x search`), read a LinkedIn profile (`crustdata person`), look up a company's funding and investors (`captain company`, `captain investors`), or pull a person's career history (`happenstance research`). These are on for your brain from the start and metered against your credits; each one is a checkbox on the brain's Research tools page (in Settings), so turning any of them off is your call, not a support request. For your own terminal, the people and company lookups start off until you switch them on. Like everything else, every call shows up in your activity log with its cost. ## From another AI assistant Any assistant that speaks MCP (Claude Code, Cursor, and others) can use your tools. Add our server to the assistant's configuration: ``` claude mcp add gbrain https://gbrain.io/mcp \ --header "Authorization: Bearer " ``` The assistant sees only the tools its permission allows, calls them through our servers, and every call lands in the same activity log as everything else. ## Your email and calendar Connect your Google account once, from your workspace. Reading and changing are separate grants: a permission can allow reading your email without allowing sending, and the grant screens always show exactly which of your connected addresses a grant reaches. Tools that change things are marked, and they start off. Reading a message gives you its text whether the sender wrote it as plain text or as a web page, along with a list of whatever came attached, so you can read an attachment by name. If you would rather have the message untouched, ask for it as it was delivered with `-f eml` and hand the file to whatever you like. ## Seeing what happened Every call, including refused ones, is on your record with what was asked, the outcome, and the cost. So is every access change you've ever made. Read it on any terminal's page as it happens, click any entry for the full detail, run `gbrainio call ls`, or ask your brain. If something looks wrong, revoke the terminal from its page and it stops working immediately.