ObsidianSAFE
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
A lightweight Model Context Protocol (MCP) server that enables AI assistants like Cursor & Claude to read from and write to your Obsidian vault.
Example Interactions
- "Create a new note for standup tomorrow describing the code changes I've made today" (should also use Git)
- "Check my notes about project ideas"
- "Check what todos I have related to refactoring"
Tools
Read
- getAllFilenames
- Gets a list of all filenames in the Obsidian vault
- Useful for discovering what files are available
- readMultipleFiles
- Retrieves the contents of specified files from the Obsidian vault
- Supports exact filenames, partial filenames, or case-insensitive matches
- Each file's content is prefixed with '# File: filename' for clear identification
- getOpenTodos
- Retrieves all open TODO items from markdown files in the Obsidian vault
- Finds unchecked checkbox items (lines containing '- [ ] ')
- Returns them with their file locations
Write
- updateFileContent
- Updates the content of a specified file in the Obsidian vault with new markdown content
- If the file doesn't exist, it will be created
- Automatically creates any necessary directories
Install & build
npm install obsidian-mcp-server npm run build
Integrating with Claude Desktop and Cursor
To use your MCP server with Claude Desktop add it to your Claude configuration:
{
"mcpServers": {
"obsidian": {
"command": "node",
"args": [
"obsidian-mcp-server/build/index.js",
"/path/to/your/vault"
]
}
}
}For Cursor go to the MCP tab Cursor Settings (command + shift + J). Add a server with this command:
node obsidian-mcp-server/build/index.js /path/to/your/vault
Comparison with Other Solutions
While this implementation is intentionally lightweight, other solutions like [jacksteamdev/obsidian-mcp-tools
9cd1f140b07bOBSERVED · 2026-10-08Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control.
claude mcp add obsidian-mcp-server -- npx -y [email protected]
{
"mcpServers": {
"obsidian-mcp-server": {
"command": "npx",
"args": [
"-y",
"[email protected]"
]
}
}
}Exposed tools (8)
8 read · 0 write · 0 destructive.
| Tool | Risk | Description |
|---|---|---|
appendToFile | read | Appends content to the end of a file in the Obsidian vault. If the file doesn |
deleteFile | read | Permanently deletes a markdown file from the Obsidian vault. Only .md files can be deleted as a safety guard. Provide a file path ending in .md. |
getAllFilenames | read | Get a list of all filenames in the Obsidian vault. Useful for retrieving their contents later. |
getOpenTodos | read | Retrieves all open TODO items in the Obsidian vault with their file locations. Useful for getting an overview of pending tasks. |
moveFile | read | Moves or renames a file within the Obsidian vault. Creates destination directories if they don |
readMultipleFiles | read | Retrieves the contents of specified files from the Obsidian vault. You can provide exact filenames (with or without path), partial filenames, or case-insensitive matches. Each file |
searchNotes | read | Searches the full text of all markdown files in the Obsidian vault for a query string. Returns matching lines with their file path and line number. Case-insensitive by default (set caseSensitive: true to override). Use this to find notes about a topic without knowing the filename. |
updateFileContent | read | Updates the content of a specified file in the Obsidian vault with new markdown content. If the file doesn |
Trust audit
SAFEgrade B · trust 89/100 Nothing in the source contradicts what it says it does. Grade A is reserved for packages that have also passed the behavioural sandbox.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | PASS |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- none-observed
- Network
- none-observed
- Shell
- none-observed
- Dependencies
- not all pinned
- Secrets in source
- none-found
Findings (2)
@modelcontextprotocol/sdk, @types/glob, glob, obsidian-mcp-server, zod, @types/node, @vitest/coverage-v8, typescript
Gates applied: no_behavioural_pass, no_license.
9cd1f140b07bfull audit observations/trust-audit/mcp-server/marcelmarais__obsidian-3.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-08 | 9cd1f140b07b | SAFE | B | 89 | first audit |
Questions
What tools does Obsidian expose?
8 in total: 8 read-only, 0 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.
Is Obsidian safe to connect to an agent?
The audit found nothing in the source that contradicts what it says it does, and graded it B (89/100). Grade A is held back for packages that have also passed a sandboxed behavioural run, which is why a clean server reads B.
What credentials does Obsidian need?
No credential environment variables were found in its source, so it appears to need none.
How does Obsidian run?
It speaks stdio, so it runs as a local process your client starts. It is published on npm as obsidian-mcp-server at 1.0.0.
How current is this page?
The grade is for one exact copy of the source (9cd1f140b07b), read on 2026-10-08. The repository is watched and re-audited when it changes.