obsidian-mcp — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited obsidian-mcp (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Guide the user through getting started with obsidi-mcp.
An Obsidian community plugin that exposes vault operations as an MCP server. Provides 28+ built-in vault tools (read, write, search, tag, link, manage notes) plus 7 CLI bridge tools for Sync history and file recovery. Supports stdio, HTTP (StreamableHTTP), and SSE transports. Other plugins can register additional tools at runtime via the Tool Provider Registry.
Check that the user has the following installed/configured:
obsidian --version to verify)Walk the user through initial setup:
git clone https://github.com/cameronsjo/obsidi-mcp.git
cd obsidi-mcp npm install
npm run build ln -sfn /path/to/obsidi-mcp /path/to/your-vault/.obsidian/plugins/obsidi-mcpGuide the user through their first interaction with the product:
curl http://localhost:3000/health {
"mcpServers": {
"obsidian": {
"command": "obsidian",
"args": ["--vault", "Your Vault Name", "--mcp"]
}
}
} {
"mcpServers": {
"obsidian": {
"url": "http://localhost:3000/mcp",
"transport": "streamable-http"
}
}
}list_notes or get_vault_stats to confirm connectivity.Point the user to the most important files for understanding the project:
main.ts — Plugin entry point, onload()/onunload() lifecyclesrc/mcpServer.ts — MCP server implementation, transport setup, tool dispatchsrc/obsidianTools.ts — 28 built-in vault tool definitions and handlerssrc/cliBridge/ — CLI bridge tools for Sync history and file recoverysrc/vaultResources.ts — MCP resource subscriptions with live vault change notificationssrc/settingsTab.ts — Plugin settings UI configurationmanifest.json — Obsidian plugin manifest (id, version, min app version) npm run devThen reload the plugin in Obsidian (Ctrl/Cmd+P > "Reload app without saving").
npm run build npm testonload(): const mcp = this.app.plugins?.plugins?.['obsidi-mcp'];
if (mcp?.registerToolProvider) {
mcp.registerToolProvider({ id: 'my-plugin', name: 'My Plugin', tools: myTools });
}~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.