mdai isn't open source. Here's everything instead.

Last updated: September 12, 2026

It's a fair question, and it deserves a straight answer rather than a page of adjectives. So: mdai is closed source, it is going to stay that way, and this page says why — and then does the thing you probably wanted open source for in the first place.

Why it's closed

mdai costs €14.99 once. There is no subscription, no server you rent from us, no cloud tier, no upsell inside the app. That is the whole business — one payment, and then the app keeps working forever, offline, on your own machine.

A licence check is a small piece of code. Published, it is an afternoon's work to remove, and nothing else is holding the lights on. For a program with a server behind it, open source is survivable, because the paid thing isn't the code. For this one, the code is the paid thing. Opening it wouldn't make mdai more trustworthy — it would make the next version not exist.

This is not an unusual position. Every Markdown editor that writers actually pay for is closed source — Typora, Obsidian, iA Writer, all of them. The open-source alternatives are free forever, which is exactly why there is nobody whose job it is to keep them going.

What you wanted from open source, you get anyway

When people ask for open source, they usually mean two specific worries. Both of them have an answer here that doesn't depend on reading the source.

“Will I lose my writing if this app dies?”

No, because mdai never holds it. Your vault is an ordinary folder on your own disk and your notes are ordinary .md files — the same files any other editor, any other operating system, and any plain text window can open, today and in twenty years. There is no database, no proprietary container, and no export step. The format is open even though the app isn't, and the format is the part you can't afford to lose.

If the trial ends and you don't buy, mdai locks editing and nothing else: reading, copying, exporting and opening your folders keep working. Your files are never held hostage.

“How do I know it isn’t watching me?”

Because you can watch it back. You don't need the source code for this — you need the list below, and a way to check it, and both are here.

Every network request mdai makes

This is the complete list. It was read out of the code on September 12, 2026, request by request, and there is nothing else in it.

To us — five requests, and that's all of them

Two addresses belong to us: license.mdai.me, a small Cloudflare Worker, and dl.mdai.me, the bucket the downloads sit in.

None of the five is periodic, scheduled, or made in the background beyond the two throttled checks described above. There is no mdai account to make them about.

To an AI provider — only the one you chose, only with your key

The assistant is off until you paste in an API key of your own. When you then run an AI action, your selected text goes straight from your machine to that provider, under your account, and never through us. We have no proxy to log it with and no key of yours to read it with.

Two of them are also asked to count tokens before you spend any, at /v1/messages/count_tokens and :countTokens — but only when you press the Count button, never while you type.

Google Drive and OneDrive

If you go looking through the app you will find Google and Microsoft sign-in addresses in it. They belong to a cloud-vault feature that is declared but not finished: no application id is configured for either provider, so the code fails before it can open anything, and the app shows both options as coming soon. Nothing is sent to either of them today.

What isn't on the list, because it doesn't exist

No analytics. No usage tracking. No crash reporting. No telemetry of any kind. Which files you open, what you write, how long you work and whether you use the app at all are never transmitted anywhere. The editor window itself is locked down by a content-security policy that permits no remote connections and no remote images — it can talk to the program it lives in, and nowhere else.

Don't take our word for it

This list is checkable without us, and checking it is the point. Put mdai behind any network monitor — Little Snitch, a proxy, your router's log — and compare what you see against the five requests above. It should match exactly. If it doesn't, that is a bug and we want to hear about it.

Every release is published with its SHA-256 so you can confirm the file you downloaded is the file we built, before you ever run it.

The legal version of all this, including what our licensing service stores and for how long, is on the privacy page.