Back to MCP Trust Indexm8ven
54
/ 100
1 month ago
glama

obsidian-mcp-router

Routes Claude MCP tool calls to multiple Obsidian vaults (local or remote) via a single server, enabling unified read/write/search operations across all vaults.

→ tboome33/obsidian-mcp-router· listed on glama
Is this your MCP?

Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find.

Install from

Glama

M8ven verifies MCPs across every public registry — install directly from whichever one you prefer.

// key findings
⚠️
Known vulnerabilities in dependencies: 5 high
Affects packages this MCP installs at runtime. Upgrade or remove the affected dependency.
✅
No credential exfiltration, no sensitive file access, no obfuscation
Static analysis found nothing flowing your secrets to unexpected places.
✅
Open source with a license and README
Anyone can audit the code, the license is declared, and the publisher documents what it does.
🔐
You'll be asked for 2 credentials: OBSIDIAN_ROUTER_SMART_LINK_SECRET, OBSIDIAN_ROUTER_VIEW_AGENT_TOKEN
These are read from process.env at runtime. Make sure you trust where they’ll be sent.
// known CVEs in dependencies5 high5 low

Disclosed vulnerabilities in this server's declared npm dependencies (via OSV). Whether each is reachable depends on the installed versions.

high@modelcontextprotocol/sdk@1.0.4GHSA-8r9q-7v3j-jr4g

Anthropic's MCP TypeScript SDK has a ReDoS vulnerability

high@modelcontextprotocol/sdk@1.0.4GHSA-w48q-cv73-mx4w

Model Context Protocol (MCP) TypeScript SDK does not enable DNS rebinding protection by default

highundici@7.0.0GHSA-f269-vfmq-vjvj

Undici: Malicious WebSocket 64-bit length overflows parser and crashes the client

highundici@7.0.0GHSA-v9p9-hfj2-hcw8

Undici has Unhandled Exception in WebSocket Client Due to Invalid server_max_window_bits Validation

highundici@7.0.0GHSA-vrm6-8vpv-qv8q

Undici has Unbounded Memory Consumption in WebSocket permessage-deflate Decompression

Depend on this server? Get alerted when its CVEs change.Watch this server free →
// required environment variables
This server reads these from process.env. You'll be asked to provide them before it can run.
configCLAUDE_PROJECT_DIR
configMARKITDOWN_PATH— To use a system-wide install instead of the bundled venv: pipx install "markitdown[all]" and set =/abs/path/to/markitdown.
configMD_ALLOWED_PATHS— MD_SHARE_DIR Legacy single-directory alias for , kept for backward compatibility with markdownify-mcp setups. Prefer MD_ALLOWED_PATHS.
configMD_SHARE_DIR— Legacy single-directory alias for MD_ALLOWED_PATHS, kept for backward compatibility with markdownify-mcp setups. Prefer MD_ALLOWED_PATHS.
configOBSIDIAN_ROUTER_ALLOWED_VAULTS— "": "roland,tribu,projects",
configOBSIDIAN_ROUTER_AUTO_ENRICH
configOBSIDIAN_ROUTER_AUTO_UPDATE
configOBSIDIAN_ROUTER_CONFIG
configOBSIDIAN_ROUTER_DEFAULT_VAULT— 1. env var — explicit per-process override. Set this in your project's .env to force a specific default regardless of cwd.
configOBSIDIAN_ROUTER_ENFORCE_WG_OR_LOOPBACK— 10.8.0.x baseUrl; WG can be enforced deployment-wide ().
configOBSIDIAN_ROUTER_LOCKED— tradingview
configOBSIDIAN_ROUTER_NO_AUTO_INSTALL_HOOKS
configOBSIDIAN_ROUTER_NO_DOC_PROPAGATION_CHECK
configOBSIDIAN_ROUTER_NO_DOC_STARTUP_CHECK
configOBSIDIAN_ROUTER_NO_HOT_CACHE_GUARD— hot-cache-update-prompt — deterministic guard: blocks the turn (exit 2) until wiki-meta/hot.md is refreshed when this session wrote a wiki/ note (per-vault, transcript-scoped; opt-out )
configOBSIDIAN_ROUTER_NO_LINT_VAULT_LINKS
configOBSIDIAN_ROUTER_NO_SESSION_JOURNAL
configOBSIDIAN_ROUTER_NO_UPDATE_CHECK— true (any truthy value)
configOBSIDIAN_ROUTER_NO_WATCH
configOBSIDIAN_ROUTER_NO_WIKI_QUERY_FIRST
configOBSIDIAN_ROUTER_READONLY
configOBSIDIAN_ROUTER_REQUIRE_WIREGUARD
configOBSIDIAN_ROUTER_SESSION_LIVE_WINDOW_MIN
configOBSIDIAN_ROUTER_SKIP_MARKITDOWN— Skip the postinstall with =1 or npm install --ignore-scripts. Re-run manually any time with npm run install-markitdown.
🔐 secretOBSIDIAN_ROUTER_SMART_LINK_SECRET
configOBSIDIAN_ROUTER_SMART_LINK_URL
configOBSIDIAN_ROUTER_USER_ID— "": "roland"
🔐 secretOBSIDIAN_ROUTER_VIEW_AGENT_TOKEN
configOBSIDIAN_ROUTER_VIEW_AGENT_URL
configREPOMIX_PATH— Absolute path to the repomix executable. Override when not using the bundled node_modules/.bin/repomix.
configVAULT_PATH— C:\VAULTS\TradingView
// full audit trail
The full breakdown of what we checked, the deductions that landed, the network hosts, the dependency advisories, and concrete fix guidance is available to verified publishers.
// improvement guidance — verified publishers only
We have 4 concrete improvements we can share with the publisher of this MCP. Each comes with specific guidance to raise the trust score.
// embed badge in your README
[![M8ven Score](https://m8ven.ai/badge/mcp/tboome33-obsidian-mcp-router-zaaznt)](https://m8ven.ai/mcp/tboome33-obsidian-mcp-router-zaaznt)
commit: 46b0ec53f157b63cf0f8ec4969ddfca9a006e986
code hash: 9f4cc8f854b74272a3bd3c2830586d9d4b10e8311a743b03dd54936a1e7a6b2f
verified: 6/13/2026, 9:33:27 AM
view raw JSON →