Skip to main content
Glama
RasAlGhul96

Obsidian MCP Server

by RasAlGhul96
OverviewSchemaRelated ServersScoreDiscussions
TypeScript
Local

Obsidian MCP Server (Zero Trust)

Servidor MCP en TypeScript que conecta Claude Desktop con una boveda local de Obsidian bajo un modelo de Confianza Cero. Es solo lectura por defecto; la escritura es opt-in mediante OBSIDIAN_ENABLE_WRITE=true y pasa por el mismo sandbox.

Herramientas expuestas

Herramienta

Tipo

Descripcion

read_note

lectura

Lee el contenido de una nota .md de la boveda.

list_notes

lectura

Lista las notas de la boveda (o de una subcarpeta).

search_vault

lectura

Busca texto dentro de las notas de la boveda.

create_note

escritura *

Crea una nota .md nueva. Falla si ya existe.

update_note

escritura *

Sobrescribe una nota existente (escritura atomica).

append_note

escritura *

Anade texto al final de una nota existente.

delete_note

escritura *

Mueve una nota a la papelera .trash (reversible).

* Las herramientas de escritura solo se registran si OBSIDIAN_ENABLE_WRITE=true. Por defecto el servidor es solo lectura.

Related MCP server: Obsidian MCP Server

Modelo de seguridad (Zero Trust)

El servidor asume que toda ruta recibida es hostil hasta ser demostrada segura. El unico limite de confianza es OBSIDIAN_VAULT_PATH (ruta absoluta).

Garantias del sandbox:

  1. Anti path traversal — se resuelve la ruta a su forma canonica absoluta y se verifica que siga estando dentro de la boveda. Se bloquea ../../etc/passwd, ..\\..\\.ssh\\id_rsa, rutas absolutas externas, null bytes, etc.

  2. Ocultos ignorados — cualquier segmento que empiece por . (p. ej. .obsidian, .git, .ssh) queda vetado. La configuracion interna de Obsidian nunca es accesible. Ademas se rechaza : (unidad relativa C:foo y flujos de datos alternativos NTFS).

  3. Enlaces simbolicos confinados — se resuelve el destino real del symlink (fs.realpath) y se rechaza si escapa de la boveda, evitando fugas por enlaces.

  4. Allowlist de extensiones — solo se leen archivos .md (y .markdown).

  5. Un unico portero — cada herramienta MUST pasar por el middleware resolveSafePath antes de tocar el disco. Ninguna herramienta accede al filesystem por su cuenta.

Estructura del proyecto

MCP/
├── src/
│   ├── index.ts            # Entrypoint: crea el server MCP + transporte stdio (Fase 2)
│   ├── config/
│   │   └── env.ts          # Carga y valida OBSIDIAN_VAULT_PATH (Fase 2)
│   ├── security/
│   │   └── pathGuard.ts    # Middleware Zero Trust de validacion de rutas (Fase 2)
│   └── tools/
│       ├── readNote.ts     # Herramienta read_note (Fase 2)
│       ├── listNotes.ts    # Herramienta list_notes (Fase 2)
│       └── searchVault.ts  # Herramienta search_vault (Fase 2)
├── tests/
│   └── security.test.ts    # Red Team: intentos de path traversal, ocultos, symlinks (Fase 3)
├── package.json
├── tsconfig.json
├── .env.example
└── .gitignore

Diseno del middleware de seguridad: resolveSafePath

Contrato de la funcion central que blindara cada herramienta en la Fase 2:

resolveSafePath(relativeInput: string): string  // devuelve ruta absoluta segura o LANZA error

Pipeline de validacion (falla-cerrado, se rechaza ante cualquier duda):

  1. Normalizar entrada — rechazar si contiene \0 (null byte) o esta vacia.

  2. Prohibir rutas absolutas del cliente — el input siempre es relativo a la boveda. Se rechaza path.isAbsolute(input) y esquemas tipo C:\, /, \\servidor.

  3. Resolver contra la boveda — path.resolve(VAULT_ROOT, input).

  4. Verificar contencion — la ruta resuelta debe empezar por VAULT_ROOT + path.sep (comparacion normalizada, case-insensitive en Windows). Si no, PATH_ESCAPE.

  5. Vetar segmentos ocultos — dividir la ruta relativa por separador y rechazar si algun segmento empieza por ..

  6. Resolver symlinks reales — fs.realpathSync del destino y repetir el paso 4 sobre la ruta real. Si el enlace apunta fuera, SYMLINK_ESCAPE.

  7. Validar extension — para lecturas de archivo, exigir .md / .markdown.

Errores estructurados (nunca stack traces crudos al modelo): PATH_ESCAPE, HIDDEN_SEGMENT, SYMLINK_ESCAPE, INVALID_EXTENSION, NOT_FOUND.

Requisitos

  • Node.js >= 20

  • Una boveda de Obsidian local

Estado

  • Fase 1 — Arquitectura y entorno

  • Fase 2 — Core y herramientas

  • Fase 3 — Red Team y tests de seguridad (18/18)

  • Fase 4 — Despliegue e integracion

Available Tools

3 tools
list_notesListar notasA

Lista (recursivamente) las notas .md de la boveda de Obsidian. Opcionalmente restringe a una subcarpeta relativa. Ignora carpetas ocultas como .obsidian. Solo lectura.

ParametersJSON Schema
NameRequiredDescriptionDefault
folderNoSubcarpeta relativa a la boveda. Vacio = raiz de la boveda.

TDQS

A4.1/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full burden for behavioral disclosure. It explicitly states 'Solo lectura' (read-only), notes recursive behavior, and explains that hidden folders like .obsidian are ignored. This discloses key safety and operational traits, though it could additionally mention return format or performance considerations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is three concise sentences with essential information front-loaded. Each sentence adds value: purpose, optional parameter behavior, and key behavioral notes (ignores hidden folders, read-only). No wasted words.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple tool with one parameter and no output schema, the description covers purpose, parameter context, read-only safety, and hidden-folder handling. The return value (list of notes) is implicit in the verb 'Lista', so the description is sufficiently complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, and the parameter 'folder' is already well-documented in the schema. The description restates the subfolder restriction ('restringe a una subcarpeta relativa') without adding new meaning beyond the schema, so baseline 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb ('Lista'), specifies the resource (notas .md de la boveda de Obsidian), and adds scope details ('recursivamente', optional subfolder). It clearly distinguishes from siblings, which read or search, by focusing on listing.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives clear context on how to use the tool (recursive listing, optional subfolder, ignores hidden folders) but does not explicitly mention when to prefer this over sibling tools like search_vault. Usage is implied rather than explicitly contrasted with alternatives.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

read_noteLeer notaA

Lee el contenido de una nota Markdown de la boveda de Obsidian. La ruta es relativa a la raiz de la boveda (p. ej. 'Proyectos/idea.md'). Solo lectura.

ParametersJSON Schema
NameRequiredDescriptionDefault
pathYesRuta relativa a la boveda de la nota .md a leer.

TDQS

A4.3/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the burden of behavioral disclosure. It explicitly states 'Solo lectura' (read-only), which is a key behavioral trait ensuring safety. It also implies the return is the note content, though it doesn't detail error handling or formatting. This is adequate for a simple read tool.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two short sentences with no redundant words. It front-loads the main action, gives a concrete example, and ends with a clear read-only note. Every sentence earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a one-parameter read operation with no output schema, the description is complete. It specifies the input semantics, gives an example, and clarifies the read-only behavior. No additional context is needed for successful use.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%: the single 'path' parameter already has a description in the schema. The tool description repeats the relative-path semantics and adds an example, but this adds little beyond the structured field. Baseline 3 applies because the schema fully documents the parameter.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states a specific verb+resource: 'Lee el contenido de una nota Markdown' (reads the content of a Markdown note). It also clarifies the path is relative to the vault root, which distinguishes it from sibling tools like list_notes and search_vault by focusing on direct content retrieval.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides clear context: it specifies the path format with an example ('Proyectos/idea.md') and states it is relative to the vault root. While it doesn't explicitly name alternative tools or exclusion scenarios, the read-only nature and path guidance make the intended usage obvious.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

search_vaultBuscar en la bovedaA

Busca una cadena de texto (sin distinguir mayusculas/minusculas) en las notas .md de la boveda y devuelve las coincidencias con su ubicacion (nota:linea). Solo lectura.

ParametersJSON Schema
NameRequiredDescriptionDefault
queryYesTexto a buscar.
maxResultsNoMaximo de coincidencias a devolver (por defecto 50).

TDQS

A4.5/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description discloses that the search is case-insensitive, returns matches with note:line locations, and is read-only ('Solo lectura'). With no annotations provided, these details are essential for safe invocation.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is compact, two sentences, and front-loads the primary action. It covers essential behavioral traits without tangential information.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The tool has simple parameters and no output schema, but the description adequately explains the return format and search scope. It provides enough context for an agent to select and invoke it correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema already documents both parameters with descriptions. The tool description adds valuable context for the query parameter by specifying case-insensitivity and the .md scope, which the schema alone does not convey.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description explicitly states the verb 'Busca' (searches), targets '.md' notes in the vault, and specifies the return of matches with location (note:line). This clearly differentiates from sibling tools read_note and list_notes.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description defines the tool's scope (searching .md notes) and its read-only nature, implying it should be used when finding content across notes rather than reading a specific note or listing notes. However, it does not explicitly name alternatives or exclusions.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Install Server
RayrunBuild, deploy, and operate MCP servers without becoming an infrastructure team.ray.runAd

TDQS

A4.4/5.0
Disambiguation5/5

Each tool serves a clearly distinct purpose: reading a single note, listing notes recursively, and searching for content across notes. There is no overlap or ambiguity between them.

Naming Consistency5/5

All tool names follow a consistent verb_noun pattern: read_note, list_notes, search_vault. The naming convention is uniform and predictable.

Tool Count5/5

Three tools is well-scoped for a read-only Obsidian vault server. Each tool earns its place and covers the essential read/query operations without redundancy.

Completeness5/5

For a read-only server, the surface is complete: you can read, list, and search notes. There are no obvious gaps for the stated purpose of accessing and searching vault content.

Maintenance

ActivityMaintained
ResponsivenessSyncing

Resources

Unclaimed servers have limited discoverability.

Looking for Admin?

If you are the server author, to access and configure the admin panel.

Related MCP Connectors

Related MCP Servers

  • obsidian-mcp

    bbdaniels
    A
    license
    A
    quality
    C
    maintenance
    Enables Claude Code read/write access to an Obsidian vault, including creating, editing, searching, and browsing notes.
    8
    MIT

  • obsidian-mcp-server

    FAL1989
    A
    license
    Not graded
    quality
    D
    maintenance
    Enables Claude Desktop to interact with an Obsidian vault through the Local REST API, allowing file listing, reading, searching, creating, and updating markdown notes.
    5,784
    Apache 2.0

  • obsidian-mcp

    jason-c-dev
    A
    license
    Not graded
    quality
    D
    maintenance
    Enables reading, writing, searching, and managing an Obsidian vault through Claude, operating directly on markdown files via Node.js fs without requiring the Obsidian app.
    5,784
    MIT

Latest Blog Posts

MCP directory API

We provide all the information about MCP servers via our MCP API.

curl -X GET 'https://glama.ai/api/mcp/v1/servers/RasAlGhul96/obsidian-mcp-server'

If you have feedback or need assistance with the MCP directory API, please join our Discord server