54
/ 100
1 month ago
glama

Obsidian MCP Server

Enables AI assistants to interact with Obsidian vaults via direct filesystem access for managing notes, folders, and metadata. It features advanced search capabilities and multi-layer caching to provide efficient, real-time access to your personal knowledge base.

Is this your MCP?

Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find.

Install from

M8ven verifies MCPs across every public registry — install directly from whichever one you prefer.

// key findings
⚠️
Known vulnerabilities in dependencies: 6 high
Affects packages this MCP installs at runtime. Upgrade or remove the affected dependency.
No credential exfiltration, no sensitive file access, no obfuscation
Static analysis found nothing flowing your secrets to unexpected places.
// known CVEs in dependencies6 high

Disclosed vulnerabilities in this server's declared npm dependencies (via OSV). Whether each is reachable depends on the installed versions.

high@modelcontextprotocol/sdk@1.12.3GHSA-345p-7cg4-v4c7

@modelcontextprotocol/sdk has cross-client data leak via shared server/transport instance reuse

high@modelcontextprotocol/sdk@1.12.3GHSA-8r9q-7v3j-jr4g

Anthropic's MCP TypeScript SDK has a ReDoS vulnerability

high@modelcontextprotocol/sdk@1.12.3GHSA-w48q-cv73-mx4w

Model Context Protocol (MCP) TypeScript SDK does not enable DNS rebinding protection by default

highminimatch@10.0.1GHSA-23c5-xmqv-rm74

minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions

highminimatch@10.0.1GHSA-3ppc-4f35-3m26

minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern

Depend on this server? Get alerted when its CVEs change.Watch this server free →
// required environment variables
This server reads these from process.env. You'll be asked to provide them before it can run.
configOBSIDIAN_CACHE_PATH
configOBSIDIAN_COMPRESSION_THRESHOLD
configOBSIDIAN_COMPRESS_LARGE_RESULTS
configOBSIDIAN_CONTENT_CACHE_MAX_SIZE
configOBSIDIAN_ENABLE_CACHE_WARMUPfalse Pre-load cache on startup
configOBSIDIAN_ENABLE_FILE_WATCHER
configOBSIDIAN_ENABLE_INVERTED_INDEXtrue Enable fast text search index
configOBSIDIAN_ENABLE_PATH_TRIEtrue Enable fast glob matching
configOBSIDIAN_ENABLE_PERSISTENT_CACHEtrue Enable LMDB persistence
configOBSIDIAN_FILE_LIST_CACHE_TTL
configOBSIDIAN_FILE_WATCHER_DEBOUNCE
configOBSIDIAN_INDEX_MAX_WORDS_PER_FILE
configOBSIDIAN_INDEX_MIN_WORD_LENGTH
configOBSIDIAN_SEARCH_BATCH_SIZE
configOBSIDIAN_SEARCH_CACHE_MAX_SIZE
configOBSIDIAN_SEARCH_CACHE_TTL
configOBSIDIAN_VAULT_PATH"": "/path/to/your/vault"
configOBSIDIAN_WARMUP_FILE_COUNT
// full audit trail
The full breakdown of what we checked, the deductions that landed, the network hosts, the dependency advisories, and concrete fix guidance is available to verified publishers.
// improvement guidance — verified publishers only
We have 3 concrete improvements we can share with the publisher of this MCP. Each comes with specific guidance to raise the trust score.
// embed badge in your README
[![M8ven Score](https://m8ven.ai/badge/mcp/markheramis-obsidian-mcp-ldwygc)](https://m8ven.ai/mcp/markheramis-obsidian-mcp-ldwygc)
commit: 993a9d33a0f99609cac1cb930e022bc56c4baad8
code hash: ad45db190168c5dc3f1b8fdba240c2592b8fb3d1e0f75b80964f6f1cb6ab0643
verified: 6/12/2026, 11:02:23 AM
view raw JSON →