io.github.es617/obsidian-sync-mcp

io.github.es617/obsidian-sync-mcp·v0.5.2·Security

Give AI agents access to your Obsidian vault via local files or Self-hosted LiveSync.

Trust verdict · v1 advisory · method

REVIEWstatus: PARTIALfresh until 2026-05-31 01:58 UTC

screened 2026-05-31tier: scannedgranularity: description-level

Semantic screen found no manipulation pattern in the description. Conformance probe not yet run.

mcpindex.integrity.descriptionpassINFO

evidence“Access granted by user”via static_description

Limits of this verdict

- Semantic screen only - the deterministic conformance probe has not run on this server
- Confidence is reported but not yet calibrated (v1)
- Screen reads the tool description, not the live behavior
- advisory

Semantic screen: an LLM judge reads the tool description for hidden instructions (status PARTIAL). A pass means the description is not lying, not that the tool is safe: a high-capability tool with an honest description still warrants caution. The deterministic conformance probe has not been run on this server yet, so the screen here is semantic-only. Posture: advisory. Confidences are reported but not yet calibrated (calibrated=false at v1). History is paid-tier and not shown here.

Own this server? Screen its description →

Embed this badge

A live verdict badge for your README or listing. It reflects the current screen, links back here, and updates when the verdict does.

Markdown

[![mcpindex](https://mcpindex.ai/api/v1/badge/io-github-es617-obsidian-sync-mcp)](https://mcpindex.ai/server/io-github-es617-obsidian-sync-mcp)

HTML

<a href="https://mcpindex.ai/server/io-github-es617-obsidian-sync-mcp"><img src="https://mcpindex.ai/api/v1/badge/io-github-es617-obsidian-sync-mcp" alt="mcpindex verdict" height="20" /></a>

Environment variables

VAULT_PATH

Path to your Obsidian vault directory (filesystem mode)

COUCHDB_URL

CouchDB server URL (CouchDB mode)

COUCHDB_USER

CouchDB username

COUCHDB_PASSWORD

secret

CouchDB password (required in CouchDB mode)

COUCHDB_DATABASE

CouchDB database name

COUCHDB_PASSPHRASE

secret

LiveSync E2E encryption passphrase (must match plugin setting)

COUCHDB_OBFUSCATE_PROPERTIES

Set to 'true' if 'Obfuscate Properties' is enabled in LiveSync (obfuscates file paths, sizes, dates)

VAULT_NAME

Vault name for deep links and index storage

MCP_AUTH_TOKEN

secret

Password for OAuth authentication

BASE_URL

Public URL for OAuth callbacks (required when using a tunnel)

PORT

HTTP port

MCP quality score · maturity, not trust · methodology

freshness

completeness

installability

documentation

stability

Alternatives in Security

ai.dynamicfeed/dynamic-feed

87 keyless tools of live, verifiable data for AI: weather, hazards, space, CVEs. Ed25519-signed.

Helixar Security

ai.helixar/mcp

Security tools for AI agents: scan MCP servers, validate HDP delegation chains, audit releases.

RFP.ai

ai.rfp/rfp-ai

Draft cited RFP and security questionnaire answers from your knowledge base, with human review

Install

Claude Desktop (claude_desktop_config.json)

{
  "mcpServers": {
    "obsidian-sync-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "obsidian-sync-mcp"
      ],
      "env": {
        "VAULT_PATH": "<vault_path>",
        "COUCHDB_URL": "<couchdb_url>",
        "COUCHDB_USER": "<couchdb_user>",
        "COUCHDB_PASSWORD": "<your-couchdb_password>",
        "COUCHDB_DATABASE": "<couchdb_database>",
        "COUCHDB_PASSPHRASE": "<your-couchdb_passphrase>",
        "COUCHDB_OBFUSCATE_PROPERTIES": "<couchdb_obfuscate_properties>",
        "VAULT_NAME": "<vault_name>",
        "MCP_AUTH_TOKEN": "<your-mcp_auth_token>",
        "BASE_URL": "<base_url>",
        "PORT": "<port>"
      }
    }
  }
}

Cursor (.cursor/mcp.json)

{
  "mcpServers": {
    "obsidian-sync-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "obsidian-sync-mcp"
      ],
      "env": {
        "VAULT_PATH": "<vault_path>",
        "COUCHDB_URL": "<couchdb_url>",
        "COUCHDB_USER": "<couchdb_user>",
        "COUCHDB_PASSWORD": "<your-couchdb_password>",
        "COUCHDB_DATABASE": "<couchdb_database>",
        "COUCHDB_PASSPHRASE": "<your-couchdb_passphrase>",
        "COUCHDB_OBFUSCATE_PROPERTIES": "<couchdb_obfuscate_properties>",
        "VAULT_NAME": "<vault_name>",
        "MCP_AUTH_TOKEN": "<your-mcp_auth_token>",
        "BASE_URL": "<base_url>",
        "PORT": "<port>"
      }
    }
  }
}

Cline (cline_mcp_settings.json)

npx -y obsidian-sync-mcp

Verdict API

curl -s mcpindex.ai/api/v1/trust/server/io-github-es617-obsidian-sync-mcp

Free-tier verdict as JSON: decision + dimensions + severity. Call it from your agent before it invokes a tool it just discovered.

Details

version: v0.5.2
category: Security
verdict expires: 2026-05-31
quality: 76 / 100
operator: es617

Provenance

Verdict history is anchored to Bitcoin via OpenTimestamps. The free tier returns the current verdict only; the anchored record is served on the authenticated tier.

Links

Repository →