vault-cortexBLOCK
Standalone MCP server for Obsidian vaults — hybrid search, structured memory, task management, files, OAuth 2.1. Run locally, self-host, or one-click deploy for remote access.
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
[](https://github.com/aliasunder/vault-cortex/actions/workflows/ci.yml) [](https://github.com/aliasunder/vault-cortex/actions/workflows/gitleaks.yml) [](https://github.com/aliasunder/vault-cortex/actions/workflows/trivy.yml) [](https://github.com/aliasunder/vault-cortex/releases) [](https://www.npmjs.com/package/vault-cortex) [](https://scorecard.dev/viewer/?uri=github.com/aliasunder/vault-cortex) [](https://www.bestpractices.dev/projects/14162) [](https://deepwiki.com/aliasunder/vault-cortex) [](https://glama.ai/mcp/servers/aliasunder/vault-cortex)
Vault Cortex is a standalone MCP server that gives any AI agent hybrid search, task management, structured memory, and read/write access to your Obsidian vault. No plugins, no running Obsidian, no separate bridge. One Docker container, your vault folder, a full tool suite + guided prompts. Run it on a remote
d4fe3c474918OBSERVED · 2026-10-10Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.
claude mcp add vault-cortex:0.54.12 --env MCP_AUTH_TOKEN=${MCP_AUTH_TOKEN} -- docker run -i --rm ghcr.io/aliasunder/vault-cortex:0.54.12:NoneExposed tools (6)
6 read · 0 write · 0 destructive.
| Tool | Risk | Description |
|---|---|---|
vault-orientation | read | Survey the vault |
vault_a | read | Read a note. |
vault_a_long_tool_name_left_out_of_the_measure | read | Read a note. |
vault_b | read | List. |
vault_read_note | read | Read a note |
vault_x | read | Plan — 😀 |
Trust audit
BLOCKgrade D · trust 65/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | FAIL |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (9 observation(s))
- Network
- declared (3 observation(s))
- Shell
- declared (5 observation(s))
- Dependencies
- pinned
- Secrets in source
- found
Findings (25)
const keyPath = expandHome(env.LIGHTSAIL_SSH_KEY ?? "~/.ssh/vault-cortex")
` ssh-keygen -t ed25519 -f ~/.ssh/vault-cortex -C vault-cortex-deploy`,
: [expandHome("~/.ssh/vault-cortex.pub")]` ssh-keygen -t ed25519 -f ~/.ssh/vault-cortex -C vault-cortex-deploy\n` +
prompts.print(`\n ${token}\n`)CMD ["node", "-e", "fetch(`http://127.0.0.1:${process.env.PORT||8000}/healthz`).then(r=>process.exit(r.ok?0:1)).catch(()=>process.exit(1))"]token: "fake-sync-token-from-setup-page",
token: "fake-stale-sync-token",
secret: "not-the-lambda-secret",
.coderabbit.yaml
.gitleaks.toml
.markdownlint-cli2.jsonc
.prettierignore
.prettierrc.json
CLAUDE.md
const compileBundle = new Function(
const CLI_BIN = resolve(thisDir, "../../bin.ts")
readFileSync(fileURLToPath(new URL("../../package.json", import.meta.url)), "utf8"),import { loadConfig } from "../../../src/vault-mcp/config.js"readFileSync(fileURLToPath(new URL(`../../../${repoRelativePath}`, import.meta.url)), "utf8")new URL(`../../.github/workflows/${workflowFile}`, import.meta.url),expect(fetchedUrls).toEqual(["http://127.0.0.1:9100/healthz"])
{ url: "http://127.0.0.1:8000/healthz", timeoutMs: 100, intervalMs: 1 },url: "http://127.0.0.1:8000/healthz",
{ url: "http://127.0.0.1:8000/healthz", timeoutMs: 20, intervalMs: 1 },Gates applied: no_behavioural_pass.
d4fe3c474918full audit observations/trust-audit/mcp-server/aliasunder__vault-cortex.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-10 | d4fe3c474918 | BLOCK | D | 65 | first audit |
Questions
What is the vault-cortex MCP server?
Standalone MCP server for Obsidian vaults — hybrid search, structured memory, task management, files, OAuth 2.1. Run locally, self-host, or one-click deploy for remote access.
What tools does vault-cortex expose?
6 in total: 6 read-only, 0 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.
Is vault-cortex safe to connect to an agent?
No — not without reading the findings first. The audit graded it D (65/100) and found 4 critical or high issues in the source. Each one is listed on this page with the file and line it is on.
What credentials does vault-cortex need?
It reads GH_TOKEN and MCP_AUTH_TOKEN from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How does vault-cortex run?
It speaks streamable-http, so it runs as a service you connect to over the network. It is published on npm as vault-cortex at 0.54.12.
How current is this page?
The grade is for one exact copy of the source (d4fe3c474918), read on 2026-10-10. The repository is watched and re-audited when it changes.