obsidian-agi-workspace-mcp
This server exposes an Obsidian vault workspace with note/folder management, search/analysis, and X Article publication-request workflows.
Create and list folders; get a filtered vault tree.
Read, write, overwrite, patch, and delete (trash/permanent) Markdown notes with frontmatter support.
Search notes by keyword/tags/frontmatter/folder; list tasks by tag, folder, completion.
Analyze workspace wikilink graph: nodes, edges, orphans, dangling links.
Render X Article previews, create/deduplicate X publish requests, and read publication status.
The schema also includes sync_vault_ob for ob sync status/sync/configure, though the README states this tool is deliberately not exposed.
Provides tools for managing Obsidian vaults, including searching, reading, writing, and patching notes, managing folders and tasks, resolving wikilinks and backlinks, analyzing the workspace graph, and syncing with Obsidian Headless Sync.
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@obsidian-agi-workspace-mcpaggregate all unchecked tasks in my vault and show them by project"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
obsidian-agi-workspace-mcp
A security-boundary-first MCP workspace for an Obsidian vault, with controlled X Article publication requests.
v0.2 status: local development and manifest validation are supported. The checked-in Kubernetes manifests are intentionally not production-ready until the encrypted Talos volume, pinned release images, MCP token, Obsidian login, allowed hostname, and target node have been supplied and verified.
Architecture
Obsidian desktop vault
⇅ Obsidian Sync E2EE
Talos LUKS2 UserVolume / one PVC
├── vault/ mounted only by ob sync
│ └── projects/x-blog/ the only subtree mounted into MCP
│ └── .x-publish/ non-secret requests and receipts
└── ob-home/ mounted only by ob sync
Authenticated Streamable HTTP MCP
├── read/search/edit allowed notes
├── render_x_preview
├── request_x_publish no X network call
└── get_x_publication_status
Local obsidian-x-publisher
├── reads the synced request
├── verifies the current Markdown SHA-256
├── requires --yes + --expected-sha
└── invokes local xurl credentials to create/publish an ArticleTrust boundaries
The MCP container does not mount the complete vault, Obsidian credentials, or X credentials.
The
obsidecar mounts the complete vault and its own persistent home; MCP does not.X OAuth remains in the local
xurlhome. It is never placed in Git, the Obsidian vault, the MCP Pod, Kubernetes manifests, or publication receipts.obruns continuously in one sidecar. MCP clients cannot invoke or reconfigure it.Network MCP uses stateless Streamable HTTP at
/mcp, a Bearer token, an HTTP Host allowlist, a 1 MiB request limit, and no wildcard CORS.X writes are two-stage: the MCP creates an immutable request; the local publisher creates a draft and later publishes it.
A request ID is a deterministic idempotency hash over schema version, publication type, account, source path, and source SHA-256.
Encryption at rest does not protect plaintext from a compromised running Pod. The runtime boundaries above remain necessary even with LUKS2.
Related MCP server: Obsidian MCP Server
MCP tools
Tool | Side effect | Purpose |
| Vault write | Create a folder inside the configured boundary. |
| None | List permitted folders. |
| None | Return only permitted paths; sibling folders are filtered. |
| None | Read a Markdown note and metadata. |
| Vault write | Create or overwrite a note. |
| Vault write | Patch body, sections, regex matches, or frontmatter. |
| None | Search permitted notes. |
| None | Collect Markdown tasks. |
| None | Build the permitted wikilink graph. |
| Vault write | Trash an item by default; deleting the vault root is rejected. |
| None | Render the verified X Article payload and source hash. |
| Queue write | Create/deduplicate a non-secret publication request. |
| None | Read requested/draft-created/published status. |
There is deliberately no sync_vault_ob, arbitrary shell, X token inspection, or direct X publish MCP tool.
Local development
Requirements: Node.js 22+, pnpm 11, and go-task.
pnpm install --frozen-lockfile
task checkStdio mode:
OBSIDIAN_VAULT_PATH=/absolute/path/to/vault \
OBSIDIAN_ALLOWED_SUBPATHS=projects/x-blog \
pnpm devAuthenticated HTTP mode:
# Create the token file outside the repository and chmod it 0600.
OBSIDIAN_VAULT_PATH=/absolute/path/to/vault \
OBSIDIAN_ALLOWED_SUBPATHS=projects/x-blog \
X_PUBLISH_QUEUE_PATH=projects/x-blog/.x-publish \
MCP_TRANSPORT=streamable-http \
MCP_AUTH_TOKEN_FILE=/absolute/private/path/mcp-token \
MCP_ALLOWED_HOSTS=127.0.0.1,localhost \
HOST=127.0.0.1 PORT=8080 \
pnpm devHealth endpoints are /healthz and /readyz; the MCP endpoint is /mcp.
Hermes HTTP client shape:
mcp_servers:
obsidian-workspace:
url: "https://mcp.example.invalid/mcp"
headers:
Authorization: "Bearer <load-this-from-your-secret-management-workflow>"
sampling:
enabled: falseDo not commit a real token in Hermes configuration examples or this repository.
X Article workflow
One-time local setup
Install and authenticate the official xurl CLI manually, outside an agent session. Never paste X credentials into chat or add inline secrets to commands. The safe agent-visible check is:
xurl auth statusThe account with X credentials is the only Publisher.
Request from MCP
Call
render_x_previewwithsourcePath.Review title, body length, payload, and
sourceSha256.Call
request_x_publishwith the same path and target X handle.Wait for Obsidian Sync to report
Fully syncedon the local publisher copy.
Create and publish locally
Use the request ID and exact source hash returned by MCP:
export OBSIDIAN_VAULT_PATH=/absolute/path/to/local/vault
export OBSIDIAN_ALLOWED_SUBPATHS=projects/x-blog
export X_PUBLISH_QUEUE_PATH=projects/x-blog/.x-publish
obsidian-x-publisher status <request-id>
obsidian-x-publisher draft <request-id> \
--expected-sha <source-sha256> --app <xurl-app-name> --yes
obsidian-x-publisher publish <request-id> \
--expected-sha <source-sha256> --app <xurl-app-name> --yesThe publisher refuses a stale or mismatched source hash. Receipts contain only request/hash/status/timestamp and public Article/Post IDs.
Current scope is X Articles. The public API does not provide unrestricted editing of published Articles. Ordinary Post editing has separate X account, plan, and time-window constraints and is not represented as an always-available tool.
Talos encrypted storage gate
The example deploy/talos/obsidian-workspace-volume.example.yaml targets Talos 1.13+ and defines a LUKS2 UserVolumeConfig using TPM with lockToState. It intentionally contains a nonfunctional WWID placeholder.
Before any apply:
Inspect the real node with
talosctl get disks -o yamlandtalosctl get discoveredvolumes -o yaml.Prove the selected WWID is the intended non-system data disk.
Confirm TPM 2.0 and SecureBoot. If unavailable, design and review a KMS key path instead; do not downgrade to a committed static passphrase.
Copy the example into the infra repository and replace the WWID there.
Preview the exact live-node patch:
talosctl patch machineconfig \ --talosconfig <repo-local-talosconfig> \ --nodes <verified-node> \ --patch @<reviewed-volume-patch.yaml> \ --dry-runApply only in an approved storage maintenance workflow with a rollback/recovery plan.
Verify
volumestatus u-obsidian-workspace,mountstatus u-obsidian-workspace, and the LUKS2 mapper/filesystem chain indiscoveredvolumes.
The Kubernetes PV example maps /var/mnt/obsidian-workspace, pre-binds the exact claim, uses node affinity, and retains data. Replace REPLACE_WITH_VERIFIED_NODE_NAME before use.
Kubernetes deployment gate
deploy/k8s/deployment.yaml expects:
published
0.2.0MCP and ob-sync images, pinned by digest in the production overlay;StorageClass/PV
obsidian-workspace-encryptedbacked by the verified Talos LUKS2 volume;Secret
workspace-mcp-authwith keytoken;Hermes clients in the
devboxnamespace;the selected node label and
edge-ustoleration;the manual bootstrap in
deploy/k8s/bootstrap.example.yamlto complete before either long-running service starts.
The ob-sync and MCP containers run in separate Pods. The sync Pod can reach DNS and HTTPS; the MCP Pod accepts port 8080 only from devbox and has no egress. The only MCP-mounted content is vault/projects/x-blog.
Create the MCP Secret from a private file rather than an inline shell value:
kubectl -n obsidian-workspace create secret generic workspace-mcp-auth \
--from-file=token=/absolute/private/path/mcp-token \
--dry-run=client -o yaml > /private/path/workspace-mcp-auth.generated.yaml
kubectl apply -f /private/path/workspace-mcp-auth.generated.yamlKeep the generated Secret manifest outside Git and delete it securely after application.
Bootstrap Obsidian only after the encrypted PVC is Bound. Do not add the bootstrap Pod to Flux:
kubectl apply -f deploy/k8s/bootstrap.example.yaml
kubectl exec -it -n obsidian-workspace pod/obsidian-workspace-bootstrap -- ob login
kubectl exec -it -n obsidian-workspace pod/obsidian-workspace-bootstrap -- ob sync-list-remote
kubectl exec -it -n obsidian-workspace pod/obsidian-workspace-bootstrap -- \
ob sync-setup --vault oh-my-obsidian --path /vault --device-name prod-us-workspace-mcp
kubectl exec -it -n obsidian-workspace pod/obsidian-workspace-bootstrap -- \
ob sync-config --path /vault --mode pull-only --conflict-strategy conflict
kubectl exec -it -n obsidian-workspace pod/obsidian-workspace-bootstrap -- ob sync --path /vaultWait for Fully synced; a running Pod is not enough. Stop the old cluster-side continuous sync writer, run one final pull, switch the new client to bidirectional mode, and only then create the sentinel:
kubectl exec -it -n obsidian-workspace pod/obsidian-workspace-bootstrap -- \
ob sync-config --path /vault --mode bidirectional --conflict-strategy conflict
kubectl exec -it -n obsidian-workspace pod/obsidian-workspace-bootstrap -- ob sync --path /vault
kubectl exec -n obsidian-workspace pod/obsidian-workspace-bootstrap -- \
sh -c 'touch /home/obsidian/.bootstrap-complete'
kubectl delete -n obsidian-workspace pod/obsidian-workspace-bootstrapBoth Deployments wait for that sentinel, preventing an empty or partially initialized vault from being exposed through MCP.
Security notes
Symbolic-link traversal is rejected for every resolved path.
Allowed-subpath ancestors may be traversed only for filtered tree display; ordinary reads and writes must be inside an allowed subtree.
Publication requests use atomic no-clobber creation and receipts use atomic replacement.
HTTP token comparison uses constant-sized SHA-256 digests with timing-safe comparison.
The Kubernetes service is ClusterIP-only and guarded by a default-deny NetworkPolicy.
All containers run non-root, drop Linux capabilities, disallow privilege escalation, use a read-only root filesystem, and do not receive a service-account token.
src/crypto.tsremains a field/envelope utility; it is not presented as full-vault encryption. Talos LUKS2 protects persistent storage and Obsidian Sync E2EE protects the remote copy.
Verification
task check
task manifests:validate
task images:buildProduction acceptance additionally requires a real authenticated MCP client call, an Obsidian bidirectional sync probe, LUKS2 readback, and an X draft call before any public Article publish.
License
MIT © 2026 yunzaixi-dev
Available Tools
11 toolsanalyze_workspace_graphA
Analyze knowledge graph topology: nodes, wikilink edges, orphan notes, and dangling (broken) links.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the behavioral transparency burden. The verb 'Analyze' implies a read-only operation, and the listed analysis categories add useful context. Still, it does not explicitly state that the tool makes no changes, nor does it describe side effects or the nature of the returned result.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single focused sentence that front-loads the primary action and then uses a colon to list the exact analysis outputs. Every word adds information and there is no filler or redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a zero-parameter tool, invocation requirements are minimal and the description clearly states what will be analyzed. However, there is no output schema and no explicit description of the return format, so it is unclear whether results are counts, lists, or a report. Some usage and side-effect context is also missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool has zero parameters and the schema is an empty object with 100% coverage, so there are no parameter semantics to clarify. The baseline for zero-parameter tools is 4, and the description appropriately aligns with a no-argument invocation.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb ('Analyze') with a clear resource ('knowledge graph topology') and enumerates concrete outputs: nodes, wikilink edges, orphan notes, and dangling links. This distinguishes it from sibling tools like get_vault_tree or search_vault, which are about tree structure or content search rather than graph-level topology analysis.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies when to use the tool: whenever an agent needs graph topology information such as links, orphans, or broken links. However, it does not explicitly state when not to use it or name any sibling alternatives, leaving the usage context to inference.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
create_folderB
Create a new folder or directory hierarchy inside the Obsidian vault.
| Name | Required | Description | Default |
|---|---|---|---|
| path | Yes | Relative folder path to create (e.g. "projects/agi" or "vault/ops/cluster-health") |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
There are no annotations, so the description carries full responsibility for behavioral disclosure. It only says 'create' and gives no information about whether existing folders cause errors, whether intermediate directories are created automatically, or any side effects. The phrase 'directory hierarchy' hints at recursive creation but does not confirm behavior.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single sentence that is front-loaded with the core action and resource. There is no filler or redundant information.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The tool is relatively simple with one well-documented parameter, so the description covers the basic call. However, it omits behavioral details like what happens if the folder already exists or whether nested directories are created, which an agent would benefit from knowing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already documents the 'path' parameter clearly with examples. The tool description adds no additional meaning about how the path is interpreted beyond the phrase 'directory hierarchy', which is already implied by the schema example.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb, 'Create', a clear resource, 'a new folder or directory hierarchy', and the location, 'inside the Obsidian vault'. This clearly distinguishes it from sibling tools like read_note, write_note, or delete_item.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives no guidance about when to use this tool versus alternatives, nor does it mention any exclusions or prerequisites. The intended use is implied but never made explicit.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
delete_itemA
Safely delete a note or folder (moves to .trash by default).
| Name | Required | Description | Default |
|---|---|---|---|
| path | Yes | Relative note or folder path | |
| permanent | No | Permanently delete instead of moving to .trash (default: false) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description explicitly discloses that deletion is soft by default ('moves to .trash by default'), which is meaningful behavioral context beyond the schema. It does not restate the irreversibility of permanent deletion, but the schema's 'permanent' parameter description already conveys that. No annotation contradiction exists.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single sentence front-loads the action, target, and safety behavior with no filler. Every part of the description earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple two-parameter delete tool, the description covers the affected resource and the default trash behavior, while the schema covers parameter semantics. It does not mention return or error behavior, but no output schema exists and the core deletion semantics are clear enough for correct invocation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema already describes both parameters thoroughly, so the description does not need to repeat them. The phrase 'moves to .trash by default' reinforces the permanent parameter's default behavior but does not add new semantic detail beyond what the schema provides.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description names the exact verb ('delete') and resource ('note or folder'), and immediately states the key default behavior: moving to .trash. No sibling tool is a delete operation, so an agent can distinguish this tool without needing extra disambiguation.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description clearly establishes what the tool operates on and what its safe default is, so invocation context is clear. It does not list alternatives, but none of the sibling tools compete for this action, so an explicit when-not-to-use clause is not necessary.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_vault_treeA
Retrieve hierarchical directory tree of folders and notes in the vault for workspace overview.
| Name | Required | Description | Default |
|---|---|---|---|
| maxDepth | No | Maximum folder traversal depth (default: 5) | |
| subfolder | No | Scope tree overview to a subfolder |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the behavioral transparency burden. It clearly marks the operation as read-only ('Retrieve') and states what is returned, but it does not disclose traversal defaults, pagination, size limits, or any side-effect caveats.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single front-loaded sentence delivers the verb, object, scope, and purpose with no filler. Every word earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple two-parameter getter with no output schema, the description adequately conveys core intent and the return concept. It could go slightly further by describing the shape of tree nodes, but the schema already covers parameter behavior, so nothing essential is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so maxDepth and subfolder are already documented in the schema. The description adds only the conceptual context of a tree/overview and does not meaningfully enrich the parameter semantics beyond the baseline.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with a specific verb ('Retrieve') and a precise resource ('hierarchical directory tree of folders and notes in the vault'). The phrase 'for workspace overview' signals an aggregate, structural view, which distinguishes it from flat list_folders and query-based search_vault even without naming them.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It explicitly states the intended context ('for workspace overview'), so an agent can infer when this tool is appropriate. However, it provides no explicit exclusions or alternative routing guidance relative to sibling tools.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_foldersB
List folders and directory structure in the vault with note counts.
| Name | Required | Description | Default |
|---|---|---|---|
| parentFolder | No | Filter by parent directory path (e.g. "projects" or "vault/tju") |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description must carry the behavioral disclosure burden. It states the tool lists folders and note counts but does not mention whether it is read-only, whether the structure is recursive, or how results are ordered or paginated. This is minimal behavioral transparency for a directory-listing operation.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single concise sentence that states the action and key output detail (note counts). It is front-loaded with the main purpose and contains no wasted words, making it appropriately sized for a simple listing tool.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a tool with one optional parameter, no annotations, and no output schema, the description is minimal. It tells the agent what it does but does not specify the return format, whether the parentFolder filter is absolute or relative, or any behavioral details. While adequate for a basic list operation, gaps remain in output expectations and filter semantics.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema provides 100% description coverage for the single parameter parentFolder, including an example. The tool description itself adds no extra meaning beyond what the schema already specifies. Per the rubric, high schema coverage sets a baseline of 3, and the description does not enhance parameter understanding.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool lists folders and directory structure with note counts. It specifies a verb and resource, making the primary purpose obvious. However, it does not explicitly differentiate from the sibling get_vault_tree, which likely also exposes directory structure, so it lacks clear sibling differentiation.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides no guidance on when to use this tool versus alternatives like get_vault_tree or search_vault. It does not mention exclusions, prerequisites, or typical use cases. An agent cannot infer when to choose this tool over a sibling without additional context.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_tasksA
Aggregate markdown task checkboxes (- [ ] / - [x]) across the Obsidian vault.
| Name | Required | Description | Default |
|---|---|---|---|
| tag | No | Scope to notes with a specific tag | |
| folder | No | Scope to a specific subfolder | |
| completed | No | Filter by task completion state (true for [x], false for [ ]) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the behavioral transparency burden. It usefully discloses that the tool scans the entire vault rather than a single note. It does not mention return format, sorting, or performance characteristics, but the aggregation framing makes unintentional mutation unlikely.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single front-loaded sentence with no filler. Every word contributes meaning, and the checkbox syntax is concrete and useful.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The tool is simple and the schema covers parameters, but there is no output schema and the description does not clarify whether the result is a detailed list or a summary count. It also does not explain how list_tasks relates to search_vault, which would help an agent choose correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
All three parameters are fully documented in the input schema, so the baseline is 3. The description adds no further detail about tag, folder, or completed semantics beyond what the schema already provides.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description names a specific operation—aggregating markdown task checkboxes—across a clear resource, the Obsidian vault. It also specifies the relevant syntax (- [ ] / - [x]), making the tool's purpose unambiguous and distinct from siblings like search_vault.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies when to use the tool: to collect task checkboxes across the vault. However, it does not explicitly contrast it with alternatives like search_vault or state when not to use it, leaving some routing to inference.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
patch_noteA
Perform fine-grained updates on an existing Obsidian note (append, prepend, replace under heading, regex patch, update frontmatter).
| Name | Required | Description | Default |
|---|---|---|---|
| path | Yes | Relative note path or title | |
| append | No | Text to append to the end of the note body | |
| prepend | No | Text to prepend to the beginning of the note body | |
| patchRegex | No | Regex-based targeted substitution | |
| replaceSection | No | Replace or add an entire markdown heading section | |
| updateFrontmatter | No | Frontmatter keys to merge or update |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden, yet it only lists operation types and says 'existing note'. It does not disclose how multiple operations interact, whether they are applied atomically or in order, failure behavior when the note/heading is missing, frontmatter merge semantics, or any side effects. Some schema descriptions hint at behavior (e.g., replaceSection 'Replace or add'), but the tool description itself remains shallow.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single sentence with the core action front-loaded, followed by a complete parenthetical list of supported operations. No filler or redundant information; every word earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a tool with 6 parameters, nested objects, and no output schema, the description plus schema covers parameter meaning well but leaves out critical behavioral context: whether operations can be combined, execution order, edge-case handling for missing headings or notes, and what the tool returns. It is adequate for a simple single-operation call but incomplete for complex patch scenarios.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the baseline is 3. The description adds a lightweight semantic grouping by naming the operations, which helps map natural language to parameters, but it does not explain parameter syntax or nuances beyond what the schema already provides.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the verb ('Perform'), resource ('existing Obsidian note'), and distinguishes this as 'fine-grained updates' rather than full writes. The parenthetical enumerates specific operation types (append, prepend, replace under heading, regex patch, update frontmatter), which makes the tool's purpose unmistakable and differentiates it from sibling tools like write_note.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage for partial modifications to an existing note through 'fine-grained updates' and the operation list, but it never explicitly states when to prefer this over write_note or read_note, nor does it mention any exclusions. The context is inferable but not explicitly guided.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
read_noteA
Read an Obsidian note with frontmatter, body, metadata, wikilinks, and backlinks.
| Name | Required | Description | Default |
|---|---|---|---|
| pathOrTitle | Yes | Relative path (e.g. "ops/cluster.md") or note title / wikilink target (e.g. "Cluster Health") |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description must carry behavioral disclosure. It explicitly communicates a non-mutating read operation and lists exactly what will be returned, which is strong for a read-only tool. It does not describe ambiguity/error behavior, but that is a minor gap for this simple read operation.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single front-loaded sentence with no filler. Every element—the read operation and the returned note components—adds useful information for an agent.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The tool is simple, has one fully documented parameter, and no output schema. The description compensates for the missing output schema by enumerating the return scope. It is complete for a straightforward read operation, even though it lacks explicit sibling-routing guidance.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already fully documents pathOrTitle with examples and meaning. The description adds no parameter-level detail beyond the schema, so the baseline of 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Description states a specific verb ('Read') and resource ('an Obsidian note'), then details the returned components: frontmatter, body, metadata, wikilinks, and backlinks. This clearly distinguishes it from write_note, patch_note, delete_item, and search_vault.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The read verb implies the tool is for retrieving a full note, but there is no explicit guidance on when to use it instead of search_vault or other siblings. No 'use this when...' or 'use X instead...' guidance is provided; context is only implied.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
search_vaultA
Search vault notes by keyword, tags, frontmatter filters, or directory subpath.
| Name | Required | Description | Default |
|---|---|---|---|
| tags | No | Filter by one or more tags (e.g. ["#tju", "ops"]) | |
| limit | No | Max results to return (default: 50) | |
| query | No | Full-text or title search keyword | |
| folder | No | Restrict search to a specific relative subfolder | |
| offset | No | Pagination offset (default: 0) | |
| frontmatterFilter | No | Filter notes having exact frontmatter key-value matches |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
There are no annotations, so the description carries the burden of behavioral disclosure. It conveys a read-only search operation and lists the searchable facets, but it does not disclose result ordering, default pagination behavior, or how filters combine. Search inherently implies non-destructive behavior, so this is acceptable but not rich.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, front-loaded sentence with no filler. Every phrase contributes a distinct search dimension, making it easy for an agent to parse quickly.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The schema fully documents all 6 parameters, and the description names the main search modes, so the tool is callable as-is. However, there is no output schema and no mention of return shape or matching behavior, which leaves a moderate gap for an agent predicting results.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the baseline is 3. The description restates the main filter dimensions (keyword, tags, frontmatter, folder) but does not add meaning beyond the schema, especially for limit/offset or the exact frontmatter filter syntax.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb and resource ('Search vault notes') and enumerates the search dimensions: keyword, tags, frontmatter filters, and directory subpath. This clearly distinguishes it from sibling tools like read_note, get_vault_tree, or list_tasks.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies when to use the tool—when finding notes by keyword, tags, frontmatter, or folder—but it does not explicitly contrast it with alternatives or state when not to use it. Since no other search-specific sibling exists, the usage context is adequate but not fully explicit.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
sync_vault_obB
Trigger an immediate Obsidian Sync cycle or inspect synchronization state via obsidian-headless (ob).
| Name | Required | Description | Default |
|---|---|---|---|
| mode | No | Sync mode for configure action | |
| action | Yes | Action to execute: "status", "sync", or "configure" | |
| conflictStrategy | No | Conflict resolution strategy for configure action |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden of disclosing behavior. It does say the tool triggers an immediate sync cycle, implying side effects, but it does not explain consequences, synchronization semantics, or the behavior of the `configure` action. The read-only `status` path is vaguely referenced as 'inspect synchronization state' but no return or failure behavior is disclosed.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single efficient sentence with no filler. It front-loads the primary action (trigger sync) and then mentions the inspection capability, though it could be improved by also covering the `configure` action.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The tool has no annotations, no output schema, and a description that covers only two of the three available actions. The `configure` action and its mode/conflict strategy parameters are missing from the narrative, leaving a meaningful gap for an agent deciding how to invoke this tool correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema provides 100% description coverage for all three parameters, including enum values and per-action descriptions. The tool description itself adds no parameter-level meaning, so the baseline of 3 is appropriate because the schema already does the heavy lifting.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific purpose: triggering an Obsidian Sync cycle or inspecting synchronization state via obsidian-headless. It is clearly distinct from the sibling file/folder tools, though it omits the `configure` action that appears in the schema, so the purpose is not fully exhaustive.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies the tool should be used when the agent needs an immediate sync or wants to check sync state. It provides no explicit when-not-to-use guidance, no alternatives, and no indication of how to choose among `status`, `sync`, and `configure` actions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
write_noteA
Create or overwrite a note in the Obsidian vault with structured YAML frontmatter and body.
| Name | Required | Description | Default |
|---|---|---|---|
| body | Yes | Markdown body text | |
| path | Yes | Relative note path (e.g. "projects/agi-workspace.md") | |
| overwrite | No | Whether to overwrite if file exists (default: true) | |
| frontmatter | No | YAML frontmatter key-value pairs (tags, aliases, status, etc.) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full behavioral burden. It is transparent about being a mutating operation by saying 'Create or overwrite,' but it does not disclose that overwrite defaults to true, whether the operation is destructive to existing content, or what side effects may occur. The schema covers the overwrite parameter, but the description itself adds only partial behavioral context.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single sentence with no filler. It front-loads the core action ('Create or overwrite') and includes the two most important content aspects, frontmatter and body, making it efficient and easy to parse.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a 4-parameter tool with full schema coverage, the description is largely sufficient: it states the core purpose and the content structure. It does not describe the return value or the default overwrite behavior, but the schema documents the overwrite parameter, and the absence of an output schema makes return-value documentation less critical for correct invocation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the parameters are already documented in the schema. The description adds some context by mentioning 'structured YAML frontmatter and body,' which maps to the frontmatter and body properties, but it does not provide extra meaning beyond the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb ('Create or overwrite') and resource ('note in the Obsidian vault'), and it clarifies that both frontmatter and body are handled. It is clear enough to distinguish the tool from read_note and patch_note, though it does not explicitly name sibling alternatives.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The intended use case is implied by 'Create or overwrite a note,' so an agent can infer when to choose it. However, there is no explicit guidance about when to prefer patch_note for a non-destructive update or when overwrite should be avoided, leaving some routing decisions to inference.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
11 tool updates
v0.1.0- First observed
analyze_workspace_graph - First observed
create_folder - First observed
delete_item - First observed
get_vault_tree - First observed
list_folders - First observed
list_tasks - First observed
patch_note - First observed
read_note - First observed
search_vault - First observed
sync_vault_ob - First observed
write_note
TDQS
Scored across 11 tools
Most tools have clear boundaries: note operations (read/write/patch), folder operations (create/list/delete), and analysis (search/tasks/graph/sync) are distinct. Minor overlap exists between list_folders and get_vault_tree, but their descriptions (note counts vs. hierarchical tree) differentiate them enough.
The dominant pattern is verb_noun (create_folder, read_note, patch_note, search_vault). Exceptions are delete_item, which is generically named instead of delete_note_or_folder, and sync_vault_ob, where the '_ob' suffix is opaque and inconsistent with the rest of the API.
11 tools is well-scoped for an Obsidian workspace server. Each tool addresses a concrete operational need without excessive redundancy, and the count feels appropriate for the feature set.
The surface covers core workspace operations well: folder creation, note CRUD, search, task aggregation, graph analysis, sync, and deletion. Obvious gaps are rename/move operations for notes or folders, which would make the lifecycle more complete, but agents can generally work around this.
Maintenance
Related MCP Connectors
Search and reason over your Obsidian-style Markdown vault, right from ChatGPT.
Connect AI assistants to your GitHub-hosted Obsidian vault to seamlessly access, search, and analy…
Personal wiki and memory layer for AI assistants. Persistent, structured memory across sessions.
Agent-native notes, tasks, dev-docs, vaults, sync & handoffs. MCP + OpenAPI dual surface.
Related MCP Servers
- AlicenseAqualityBmaintenanceEnables AI agents to explore, search, and manage local Obsidian vault documents with tools for document search, automatic frontmatter property generation, and attachment organization.520 npm2ISC
- FlicenseNot gradedqualityNot gradedmaintenanceEnables AI assistants to read, write, search, and navigate Obsidian vault notes with support for CRUD operations, full-text search, graph navigation, daily notes, and frontmatter management.2,545 npm-
- AlicenseNot gradedqualityDmaintenanceEnables AI agents to manage Obsidian vaults through full CRUD operations, wikilink management, and section-level manipulation. It supports frontmatter editing, tag-based searching, and automated link updates to maintain vault integrity.MIT
- AlicenseBqualityDmaintenanceEnables AI assistants to search, create, and manage notes in an Obsidian vault via 40+ local tools.5210 npmMIT