obsidian-web-mcp
by Dikoloko
Server Configuration
Describes the environment variables required to run the server.
| Name | Required | Description | Default |
|---|---|---|---|
| VAULT_PATH | Yes | Absolute path to your Obsidian vault directory. | ~/Obsidian/MyVault |
| VAULT_MCP_HOST | No | Bind address. Loopback by default; set 0.0.0.0 only for deliberate LAN exposure. | 127.0.0.1 |
| VAULT_MCP_PATH | No | HTTP path the MCP transport mounts at. Must be absolute and must not collide with auth-exempt routes. | / |
| VAULT_MCP_PORT | No | Port the HTTP server listens on. | 8420 |
| VAULT_MCP_TOKEN | No | 256-bit bearer token validated on every MCP request. Required in the default auth mode; not used in Cloudflare Access mode. | |
| VAULT_AUDIT_LOG_PATH | No | Append-only JSONL audit log path for vault mutations. Must resolve outside the vault or the server fails closed. | |
| VAULT_MCP_PUBLIC_URL | No | Canonical public origin (e.g. https://vault-mcp.yourdomain.com) for every URL the server advertises. Recommended for reverse-proxy deployments. | |
| VAULT_OAUTH_PASSWORD | No | Password for the interactive login at /oauth/authorize. Required in the default auth mode; the server fails closed without it. Not used in Cloudflare Access mode. | |
| VAULT_OAUTH_USERNAME | No | Username for the interactive OAuth login. | obsidian |
| VAULT_OAUTH_CLIENT_ID | No | Client ID for the headless client_credentials grant. | vault-mcp-client |
| VAULT_SEMANTIC_SEARCH | No | Master switch for semantic search. Accepts 1/true/yes/on or 0/false/no/off. | off |
| VAULT_SEMANTIC_DB_PATH | No | SQLite index path for semantic search. Must resolve outside the vault. | ~/.local/share/vault-mcp/embeddings.db |
| VAULT_UPLOAD_MAX_BYTES | No | Largest file a signed upload URL can accept. | 100000000 |
| VAULT_MCP_ALLOWED_HOSTS | No | Comma-separated hostnames allowed through DNS-rebinding protection, appended to loopback defaults. Set to your tunnel/proxy hostname for remote deployments. | |
| VAULT_MCP_CF_ACCESS_AUD | No | Cloudflare Access application audience (AUD) tag. Set together with VAULT_MCP_CF_ACCESS_TEAM_DOMAIN to enable Cloudflare Access mode. | |
| VAULT_MCP_HEARTBEAT_URL | No | Optional push URL for an uptime monitor. Must be http(s); empty disables it. | |
| VAULT_UPLOAD_URL_SECRET | No | Master switch and HMAC key for signed uploads. Unset disables the upload tool and route. | |
| VAULT_DAILY_NOTES_FOLDER | No | Folder for daily-note tools; empty means the vault root. | |
| VAULT_DAILY_NOTES_FORMAT | No | strftime pattern for the daily-note filename. | %Y-%m-%d |
| VAULT_UPLOAD_STAGING_DIR | No | Directory where upload grants and in-flight bodies live. Must resolve outside the vault. | ~/.local/share/vault-mcp/uploads |
| VAULT_DOWNLOAD_URL_SECRET | No | Master switch and HMAC key for signed downloads. Unset disables the download tool and route. | |
| VAULT_OAUTH_CLIENT_SECRET | No | Client secret for the headless client_credentials grant. Not needed for Claude/ChatGPT browser OAuth flow. | |
| VAULT_OAUTH_REDIRECT_URIS | No | Comma-separated allowlist of redirect URIs for the static VAULT_OAUTH_CLIENT_ID browser flow. | |
| VAULT_DAILY_NOTES_TEMPLATE | No | strftime template prepended when a daily note is first created. | |
| VAULT_MCP_HEARTBEAT_INTERVAL | No | Seconds between heartbeat pings. Must be a positive integer. | 60 |
| VAULT_UPLOAD_URL_TTL_SECONDS | No | Default lifetime of an upload URL. | 900 |
| VAULT_AUDIT_LOG_INCLUDE_READS | No | Also record read/search operations. Accepts 1/true/yes/on. | false |
| VAULT_MCP_FORWARDED_ALLOW_IPS | No | Client IPs uvicorn trusts to set X-Forwarded-* headers. Loopback-only by default; never set to *. | 127.0.0.1 |
| VAULT_DOWNLOAD_URL_TTL_SECONDS | No | Default lifetime of a download URL. | 300 |
| VAULT_MCP_CF_ACCESS_TEAM_DOMAIN | No | Cloudflare team domain, e.g. myteam.cloudflareaccess.com. Set together with VAULT_MCP_CF_ACCESS_AUD to enable Cloudflare Access mode. | |
| VAULT_UPLOAD_URL_MAX_TTL_SECONDS | No | Upper bound for a requested upload URL lifetime. | 3600 |
| VAULT_DOWNLOAD_URL_MAX_TTL_SECONDS | No | Upper bound for a requested download URL lifetime. | 3600 |
| VAULT_EXTRA_BINARY_MEDIA_TYPES_JSON | No | Extra media types for vault_write_binary and signed uploads, as a JSON object mapping media type to extensions. |
Instructions
Guidance the server publishes about itself, which clients place ahead of the tool catalog so the model reads it before choosing anything.
This server publishes no instructions, or was last inspected before Glama recorded them.
Capabilities
Server capabilities have not been inspected yet.
Tools
Functions exposed to the LLM to take actions
| Name | Description |
|---|---|
No tools | |
Prompts
Interactive templates invoked by user choice
| Name | Description |
|---|---|
No prompts | |
Resources
Contextual data attached and managed by the client
| Name | Description |
|---|---|
No resources | |
This server cannot be deployed
Maintenance
ActivityMaintained
ResponsivenessNo issues