Brain for your team.

A shared knowledge base with a built-in MCP server. ChatGPT and Claude read it. Single sign-on, SCIM provisioning, role-based folder access, and a per-team audit log come with it. The same simple product, ready for the company that runs security review on the tools its team adopts.

Talk to us See pricing

What can an enterprise Hjarni knowledge base do?

Hjarni is a team knowledge base with a built-in MCP server that ChatGPT and Claude read directly, plus the controls a security review asks for: SAML single sign-on, SCIM user provisioning, role-based folder access that cascades to every sub-folder, and a per-team audit log. It is the same simple product individuals use, with enterprise access enabled by our team (email support today, not yet a self-serve toggle) and SCIM Groups not yet mapped to roles.

Who this is for

Companies past the indie stage where IT or security reviews the tools the team adopts. Small engineering organizations standardizing on a shared AI context. Agencies and consultancies who hold client knowledge and need a clear audit trail. If your team is choosing between Notion-with-MCP and a purpose-built knowledge base, this page is for you.

The four questions a security reviewer asks

Who can sign in. Who can change what. Who provisioned them. What did they do. All four are answered inside the same knowledge base the rest of your team already uses.

Roles and permissions

Every team has owners and members. Owners manage the team, invite people, set defaults, transfer ownership, and read the audit log. Members read the team's shared folders, and write and organize the ones their role allows. Each folder can also override the team-wide role with its own. Viewer, editor, or admin. The role cascades to every sub-folder unless an inner folder overrides it.

That cascade is what makes it usable on day two. Give the whole team editor access to Runbooks. Then narrow Runbooks/Release process so only the couple of people who own it can edit, and the rest of the team keeps read access. No rebuilding the folder tree.

Read the teams and sharing docs

SAML single sign-on

Plug Hjarni into any SAML 2.0 identity provider. Okta, Microsoft Entra, Auth0, OneLogin, or your own. Hjarni publishes service-provider metadata at a stable URL. The connector accepts the common attribute name variants for email and name claims. Users are provisioned on first login.

Pin a team to a single email domain if you want. Enforce SSO and password or OAuth logins are refused.

Read the SSO docs

SCIM provisioning

Generate a SCIM 2.0 bearer token from the team settings and hand it to your IdP. Hjarni auto-creates user accounts and adds them to your team when they're assigned the application. Deactivation in the IdP removes the team membership immediately. SCIM Users is fully supported. Filter queries work on userName, externalId, and emails. The token digest is stored, never the token itself. You can rotate it at any time.

Configure SCIM

Team audit log

A per-team record of who did what to the team's notes and folders: edits, deletes, access changes, and the reads that happen when someone opens a note or folder. It covers the web app, the REST API, the built-in MCP server, public-link reads, and SCIM provisioning, so a teammate reading through Claude shows up next to one reading in the browser. Folder paths are snapshotted on the event, so the log stays readable even after a folder is renamed or deleted.

Two things it is not, worth knowing before a security review. It is not a complete record of everything read: search results and some listing and history views return note content without writing a row. And it is not an access counter: repeat views collapse into a single entry within a five-minute window. It answers "who has been working in this folder, and what changed" rather than "every byte this account has ever seen". The audit log docs list what is and is not captured, including the paths that write nothing today.

The audit log is owner-only. Team members see a disclosure banner so they know it exists.

Read the audit log docs

How a deployment looks

You email us and we turn on SSO, SCIM, and the audit log for your team.
You configure the SAML connection in your IdP using Hjarni's published metadata URL.
You generate a SCIM token in the team settings and paste it into your IdP.
You assign the app to the right groups; users land in Hjarni on first login.
You set team-wide and per-folder roles. The audit log starts recording from day one.

Enabling these features is currently done by us, not a self-serve toggle. Most setups are a single call.

Simple on purpose, even here

No on-prem or self-hosted. Hjarni runs as a hosted service. If a self-hosted deployment is a hard requirement, talk to us first.
No bundled AI. Your team brings its own ChatGPT or Claude subscription. No per-message billing, no token caps, no AI surprises on the invoice.
No SCIM group sync yet. SCIM Users provisioning works today. Group-to-role sync is on the roadmap. For now, roles are set inside Hjarni.
No enterprise procurement theater. One contract, one invoice, one URL. The product your engineers see is the product your CFO pays for.

One brain. Every teammate. Every AI.

Everything on the small-teams page still applies. Shared folders that ChatGPT and Claude read. Folder-level AI instructions. Per-folder roles. A decision log your new hires can ask questions of. SSO, SCIM, and the audit log are not a different product. They are the controls IT signs off on, wrapped around the same knowledge base.

Give your team's AI a memory.

Talk to us See pricing

Common questions

How do we turn on SSO, SCIM, and the audit log?

Email evert@hjarni.com from a team owner account. Most teams are set up the same day.

Which identity providers are supported?

Any SAML 2.0 IdP. We have customers on Okta, Microsoft Entra, Auth0, and OneLogin. The SSO docs include the field locations for each.

What's in the audit log?

Who did what to the team's notes and folders: edits, deletes, access changes such as invites, role changes and public-link toggles, and the reads that happen when someone opens a note or folder. It spans the web app, the REST API, the MCP server, public-link reads, and SCIM. Two deliberate gaps: it is not a complete record of everything read, because searches and some listing and history views return content without writing a row, and it is not an access counter, because repeat views collapse within a five-minute window. The audit log docs list exactly what is and is not captured.

Can IT see which MCP clients the team connects to Hjarni?

Partly, and the line is worth being precise about. Inside your team's Hjarni the log shows what an AI client changed and which notes and folders it opened, alongside the same activity from the web app and REST API, so you can see a client working in a folder. It is not a complete record of everything that client read: searches and some listing and history views return note content without leaving a row. Separately, it is not an inventory of which MCP servers your employees connect Claude and ChatGPT to elsewhere; that needs endpoint or network tooling, and no single SaaS vendor can give it to you.

Does SCIM sync groups to roles?

Not yet. SCIM Users provisioning works today. Group-to-role mapping is on the roadmap. Roles are set inside Hjarni.

Where does Hjarni run?

Hjarni is a hosted service. We don't offer self-hosted today. If it's a hard requirement, talk to us before you commit.

Talk to us

One brain. Every teammate. Every AI.

SSO, SCIM, and the audit log, wrapped around the same knowledge base.

Talk to us Start your team free

Most teams are enabled the same day.