Obsidian VaultSAFE
MCP tool allowing Open WebUI or Claude Desktop to retrieve files from your vault
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
This Obsidian plugin runs an MCP (Model Context Protocol) server directly inside Obsidian, letting external LLM tools access your vault. Supports HTTP transport natively (Open WebUI, remote LLMs). An optional bridge script provides a bridge from HTTP to stdio (Claude Desktop).
Important Notes - Network Use: This plugin runs a local HTTP server on your machine to accept inbound MCP connections. It does not send your vault data to external LLM services by itself. - Privacy: This plugin lets you control vault access through Obsidian APIs and path ACLs instead of giving external tools direct filesystem access. - Desktop Only: This plugin requires a desktop environment and will not work on mobile devices.
Features
- HTTP-based MCP server: Runs a Fastify server implementing the MCP protocol
- Status Bar Indicator: Shows server status (stopped/running/error) with click-to-toggle functionality
- Configurable Settings: Adjust server port, auto-start behavior, logging, and path ACLs to control access to areas of your vault
- CORS Support: Enables access from remote machines via Tailscale or local network
- MCP Tools: Read, search, list, create, edit, rename, and delete notes; templates and periodic notes — see MCP Tools Reference
Installation
Community Plugins
- Open Settings → Community Plugins
- Click "Browse" and search for "Vault as MCP"
- Install and enable the plugin
Manual Installation
- Download the latest release from GitHub
- Extract the files to your vault's
.obsidian/plugins/vault-as-mcp/directory - Reload Obsidian
- Enable "Vault as MCP" in Settings → Community Plugins
Install with BRAT
Assuming you have the BRAT plugin installed and enabled:
- Open BRAT plugin settings
- Click 'Add beta plugin'
- Use `ht
de6137a3f92fOBSERVED · 2026-10-08Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control.
claude mcp add obsidian-vault-mcp -- npx -y [email protected]
{
"mcpServers": {
"obsidian-vault-mcp": {
"command": "npx",
"args": [
"-y",
"[email protected]"
]
}
}
}Exposed tools (12)
6 read · 4 write · 2 destructive. Blast radius: 2 tools can delete or overwrite — an agent that can be talked into calling a tool can be talked into calling this one.
| Tool | Risk | Description |
|---|---|---|
append_to_note | read | Append content to an existing note, |
create_note | write | Create a note or binary file; creates parent folders as needed. |
delete_note | destructive | Move a note to the system trash (recoverable). |
list_notes | read | List notes and subfolders in a directory (non-recursive). |
list_templates | read | List available Templater templates; call before create_note |
patch_note | write | Replace an exact string in a note; |
read_multiple_notes | read | Read multiple notes in one request. |
read_note | read | Read note content by path. Returns raw markdown by |
read_periodic_note | write | Reads or creates a periodic note; pass create:true to create it from the template if missing. |
rename_note | destructive | Rename or move a note; prefer this over delete+create |
search_notes | read | Find notes across the vault by folder, heading, tag, |
update_note | write | Replace the entire content of an existing note. |
Trust audit
SAFEgrade B · trust 89/100 Nothing in the source contradicts what it says it does. Grade A is reserved for packages that have also passed the behavioural sandbox.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | PASS |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | WARN |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (1 observation(s))
- Network
- none-observed
- Shell
- none-observed
- Dependencies
- not all pinned
- Secrets in source
- none-found
Findings (4)
delete_note, rename_note
.gitmodules
const binaryString = atob(base64);
@fastify/cors, fastify, obsidian-daily-notes-interface, @types/moment, @types/node, @typescript-eslint/parser, auto-changelog, esbuild
Gates applied: no_behavioural_pass.
de6137a3f92ffull audit observations/trust-audit/mcp-server/ebullient__obsidian-vault.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-08 | de6137a3f92f | SAFE | B | 89 | first audit |
Questions
What is the Obsidian Vault MCP server?
MCP tool allowing Open WebUI or Claude Desktop to retrieve files from your vault
What tools does Obsidian Vault expose?
12 in total: 6 read-only, 4 that write, and 2 that can delete or overwrite (delete_note, rename_note). Every one is listed on this page with its risk.
Is Obsidian Vault safe to connect to an agent?
The audit found nothing in the source that contradicts what it says it does, and graded it B (89/100). Grade A is held back for packages that have also passed a sandboxed behavioural run, which is why a clean server reads B. Separately from the audit: 2 of its tools can destroy data, so scope the token you give it to what you actually need.
What credentials does Obsidian Vault need?
No credential environment variables were found in its source, so it appears to need none.
How current is this page?
The grade is for one exact copy of the source (de6137a3f92f), read on 2026-10-08. The repository is watched and re-audited when it changes.