Opening the vault…
Opening the vault…
Field guide · every role, every path
Trova collects website design references, files them by aesthetic family, and forces the note that builds taste: what exactly would you steal?The same library is a corpus your coding agent queries mid-build — over MCP or a Trovafile — so its output argues from curated taste, not the internet's average.
The rule that is the product: an entry cannot be saved without an aesthetic family and at least one steal-note. A library that lets you save without tagging becomes Pinterest.
| You are | You get |
|---|---|
| The owner (one account, ever) | The whole app: capture, tag, edit, export — everything below |
| A subscriber (MCP Access) | A trova_sk_… bearer key for the hosted MCP server and the Trovafile export — no account |
| A visitor | The landing page and the public vault, steal-notes in the open |
01 · The owner
On a fresh deployment, the first visit lands on sign-in and the “claim vault” tab creates the one and only account. Sign-ups close permanently the moment it exists — there is exactly one master key. (Resetting means deleting the row in the user table; the next visitor claims the vault again.)
+ Capture in the header (or press c). Three sections, in order:
1 · The reference. Paste a URL — the server renders the page headlessly, takes a real full-page screenshot, and reads the actual computed fonts from the DOM. Or upload an image (≤25 MB) for posters, packaging, editorial — the preview shows how it will hang. Titles auto-fill from the page.
2 · The taxonomy. Aesthetic family and medium are required; section, source, fonts, palette, and tags are optional. ✳ Suggest from image has Claude propose the taxonomy from the screenshot — you confirm or correct everything. It never writes steal-notes; that part is the practice.
3 · The steal. At least one steal-note — the specific thing worth taking, with its type (typography, grid/layout, color, motion/interaction, copywriting, texture/material, component pattern). Up to six. No note, no entry. If a capture fails validation, everything you typed is echoed back — the app never eats a hand-written note.
The capture page also carries a bookmarklet — drag ✳ Steal this to your bookmarks bar and any site opens capture with its URL prefilled.
The home wall filters by family × steal-type × medium × section × source with full-text search across notes, titles, fonts, and tags. Filters live in the URL, so every view is shareable. Hover a card and the steal veil rises — the note, not more image. The masthead links straight to entries still owing a note and to thin ones needing another pass.
The entry page is the study card: palette with hex codes, full metadata, and the notes. Everything is revisable — ✎ Edit entryfor the taxonomy, ✎ on any note to rewrite it, ✕ to delete one (two-step, and the last note can never be deleted). Mark a family's five canonical references with ✦ make canon; walk the wall with ↑ Newer / ↓ Older.
Families trains the eye — one aesthetic side by side. Steals shows the same move across families — the queryable half of taste. Sources is the tiered hunting registry.
Export filters a slice and downloads a Trovafile — a structured brief that opens with instructions addressed to the agent. Or drop context into any project from the CLI:
npx trova init --family print-tech
init writes the Trovafile and wires the pickup rule into the project's AGENTS.md or CLAUDE.md automatically — agents read the brief without being told. Headless auth: set TROVA_TOKEN.
For live queries mid-build, the local MCP server:
claude mcp add trova -- node /path/to/trova/bin/trova-mcp.mjs
This one speaks stdio rather than HTTP, so harnesses that configure servers by file take it as a command:
{ "command": "node", "args": ["/path/to/trova/bin/trova-mcp.mjs"] }Three tools land in the agent: design_context (the brief), list_families (the taxonomy), search_steals (full-text note search). Agents don't reach for tools unprompted — keep a standing rule in AGENTS.md or CLAUDE.md: “call design_context before writing any UI code.”
/ focuses search · c opens capture · Esc clears · ? shows the cheat-sheet (all disableable from the footer). ◐ toggles the museum-at-night and warm-paper themes. GET /api/usage (owner-only) reports each subscriber key's last 28 days.
02 · The subscriber
Strangers don't get accounts. MCP Access ($49/month · $490/year list; during launch, monthly is $24 and the first fifty keys sell at $149/year, numbered) buys a trova_sk_… bearer key, shown the moment Stripe checkout clears. Returning to that success page's URL re-shows the key — keep it; that URL is the recovery path.
The key unlocks the hosted MCP server. It is a standard streamable HTTP endpoint — https://trova.design/api/mcp, authenticated with the key as a bearer token — so any harness that speaks MCP can reach it. The four most common:
Claude Codeone command, any shell
claude mcp add --transport http trova https://trova.design/api/mcp --header "Authorization: Bearer trova_sk_YOUR-KEY"
Codex~/.codex/config.toml
[mcp_servers.trova] url = "https://trova.design/api/mcp" bearer_token_env_var = "TROVA_KEY"
Codex reads the key from the environment rather than the file — set TROVA_KEY=trova_sk_YOUR-KEY where your shell will find it.
Cursor~/.cursor/mcp.json (or .cursor/ per project)
{
"mcpServers": {
"trova": {
"url": "https://trova.design/api/mcp",
"headers": { "Authorization": "Bearer trova_sk_YOUR-KEY" }
}
}
}GitHub Copilot / VS Code.vscode/mcp.json
{
"servers": {
"trova": {
"type": "http",
"url": "https://trova.design/api/mcp",
"headers": { "Authorization": "Bearer trova_sk_YOUR-KEY" }
}
}
}VS Code keys the object servers, not mcpServers, and wants the transport named. To keep the key out of the file, declare a promptString input and reference it as ${input:trova-key}.
Anything else that speaks MCP — Windsurf, Zed, Cline, your own client — takes the same URL and the same Authorization: Bearer header. Whatever the harness, agents don't reach for tools unprompted: keep a standing rule in the project's AGENTS.md or CLAUDE.md — “call design_context before writing any UI code.”
The key also unlocks the Trovafile export as a plain file:
curl -H "Authorization: Bearer trova_sk_YOUR-KEY" \ https://trova.design/api/export > Trovafile.md
Filters ride as query params: ?family=dark-premium&steal=typography.
Keys are metered at 500 billable calls per UTC day across MCP tool calls and the export — leak insurance, not a usage ceiling for humans. Handshake and discovery are free. The raw corpus (vault.json) is not part of the subscription at any price — the corpus is the moat.
03 · The visitor
The public vault shows every entry with its steal-notes in the open, filterable by family, each linking to the original work. The notes are the content, not the pixels — study use only, with a no-questions takedown contact on the page.
And the whole thing is portable: the trova CLI (ships with the source at launch) run against an instance yields vault.json (format trova-vault v1.0.0) — every entry carries author, license, and vault id, and a self-hosted Trova imports it with provenance intact. Entries without steal-notes are rejected on import; the invariant survives sharing.
04 · Your own
Trova self-hosts from a checkout of its source. The repository opens at launch — until then the source is private, and these are the commands it will take:
npm install npx playwright install chromium # once — enables real screenshot capture npm run dev # http://localhost:3000
One Neon Postgres database via Prisma 7 holds everything — entries, sources, images, auth. Set DATABASE_URL and BETTER_AUTH_SECRET (see .env.example for the full list). An empty database seeds itself: 8 families, 35 registry sources, 24 tagged reference entries. Reset with npx prisma db push --force-reset and restart. Without Chromium, URL capture falls back to title/og:image/font-hint extraction; both paths sit behind an SSRF guard.