Skip to content

Where noticebox is going

noticebox started on 2026-10-10 as the inbox behind the contact and report forms of a few static sites, with an assistant able to read and decide over MCP. It is becoming a self-contained app: its own sign-in, its forms in its own database, and every action reachable by an assistant, a script or a person.

This page says what is planned and why, inside the values, and what has shipped. Each step links its issue and the value it serves. Planned steps have no dates, only now, next or later; shipped steps carry the day they shipped.

The idea behind all of it

One container that keeps the cases people send you, lets you and your assistant decide them on the record, and lets nothing personal leave or linger.

Now
Ordered migrations, then typed queries#46#48ADR 0003V4

Every schema change becomes a numbered migration, and the store moves to better-sqlite3 and kysely.

Next
MCP covers everything#27V7

Every tool result says what to do next, and boxes, deleting forms, connections and the export get tools of their own.

Later
An end for the anonymised record#11V2

An optional second retention step per form that deletes a closed case entirely, history included.

12 Nov 2026
Files on forms#101ADR 0007

A form takes files through file fields, kept with the submission in the database, shown in the inbox, handed over by MCP and the API, and removed by retention.

11 Nov 2026
A REST API with tokens#47#96V7

The same actions under /api/v1, with an OpenAPI description and API tokens that work on REST only.

11 Nov 2026
Sign-in of its own#28#95ADR 0002V3V4

Magic links and your OAuth providers through Better Auth, an email allowlist, and no login proxy needed in front.

Details

A forged header no longer opens the inbox, and every action has a signed-in person behind it. Existing MCP connections reconnect once.

11 Nov 2026
Forms in the database#51#94ADR 0004V8

Boxes and forms move from the JSON file into the database; an existing file is imported once.

Details

One source and one backup: an edit in the inbox can no longer be undone by a deploy. An existing forms file is imported at the first start and then no longer read; NOTICEBOX_CONFIG is deprecated.

16 Oct 2026
Forms over MCP0.7.0V7

An assistant reads and writes forms, not only submissions.

10 Oct 2026
Boxes and forms made in the inbox0.3.0V8

New boxes and forms, a settings tab per form, notification targets, and MCP connections you can revoke.

10 Oct 2026
The first release0.1.0V3

An endpoint for static forms, an inbox with states and reasons, an append-only history, retention, and MCP.

Parked

  • A new look for the inbox (#20): a deliberate visual direction for every page, waiting for that direction to be chosen.

Decided against

  • Creating GitHub issues through the API: shipped in 0.8.0 and 0.9.0, then replaced by filled-in links, because a token and an automatic issue would let personal data leave without a person (V1, ADR 0001).

Keep it true

The timeline is rendered from docs/roadmap.yml; on GitHub, read that file. Finish a step in the pull request that finishes it: set status: done, replace when with a date, add the link to its pull request, and move it to the top of the shipped entries. Change the file in the pull request that changes the plan.