High-performance Model Context Protocol (MCP) server for Obsidian that provides AI tools with direct vault access through semantic operations and HTTP transport.
Drift inferred · capture-to-capture
No drift recorded — single capability capture; advisories appear once its surface changes.
transport streamable-http · http counts 0 tools · 0 res
· 0 prompts
permission surface via code analysis
No tools enumerated yet for this server.
prompt-surface
shipped agent-instruction files + hidden-content / dangerous-code findings —
quoted from the analyzed source
analyzed commit caaf4da · analyzer v33 · 1w ago
skills & prompt files 1
- agent-rules aaronsb-obsidian-mcp-plugin-caaf4da/CLAUDE.md
danger signals6
- suspicious endpoint 93.184.216.34 aaronsb-obsidian-mcp-plugin-caaf4da/tests/security/safe-fetch.test.ts :38
'http://93.184.216.34/a': redirect('http://93.184.216.34/b', 301), - suspicious endpoint 169.254.169.254 (cloud metadata) aaronsb-obsidian-mcp-plugin-caaf4da/tests/security/url-validator.test.ts :66
'http://169.254.169.254/latest/meta-data/', // cloud metadata - suspicious endpoint 93.184.216.34 aaronsb-obsidian-mcp-plugin-caaf4da/tests/security/url-validator.test.ts :75
const target = await validateOutboundUrl('http://93.184.216.34/', ENABLED); - suspicious endpoint 172.32.0.1 aaronsb-obsidian-mcp-plugin-caaf4da/tests/security/url-validator.test.ts :81
await expect(validateOutboundUrl('http://172.32.0.1/', ENABLED)).resolves.toBeDefined(); - suspicious endpoint 11.0.0.1 aaronsb-obsidian-mcp-plugin-caaf4da/tests/security/url-validator.test.ts :82
await expect(validateOutboundUrl('http://11.0.0.1/', ENABLED)).resolves.toBeDefined(); - suspicious endpoint 9.9.9.9 aaronsb-obsidian-mcp-plugin-caaf4da/tests/security/url-validator.test.ts :83
await expect(validateOutboundUrl('http://9.9.9.9/', ENABLED)).resolves.toBeDefined();
evidence-backed
findings quoted directly from the published source artifact — not inferred
code files: 144
filesystem 16
- fs (weak) aaronsb-obsidian-mcp-plugin-caaf4da/scripts/build-mcpb.mjs :5
import { readFileSync, writeFileSync } from 'node:fs'; - fs (weak) aaronsb-obsidian-mcp-plugin-caaf4da/scripts/coverage-map.mjs :14
import { readFileSync } from 'fs'; - fs (weak) aaronsb-obsidian-mcp-plugin-caaf4da/scripts/make-mcpb.mjs :6
import { readFileSync, writeFileSync } from 'node:fs'; - fs (weak) aaronsb-obsidian-mcp-plugin-caaf4da/scripts/scorecard-baseline.mjs :13
import { writeFileSync } from 'node:fs'; - fs (weak) aaronsb-obsidian-mcp-plugin-caaf4da/scripts/scorecard-gate.mjs :26
import { readFileSync } from 'node:fs'; - fs (weak) aaronsb-obsidian-mcp-plugin-caaf4da/scripts/scorecard.mjs :17
import { readFileSync } from 'node:fs'; - fs (weak) aaronsb-obsidian-mcp-plugin-caaf4da/scripts/set-description.mjs :6
import { readFileSync, writeFileSync } from 'fs'; - fs aaronsb-obsidian-mcp-plugin-caaf4da/src/security/path-validator.ts :3
import * as fs from 'fs'; - fs aaronsb-obsidian-mcp-plugin-caaf4da/src/utils/certificate-manager.ts :1
import { readFileSync, existsSync, writeFileSync, mkdirSync } from 'fs'; - fs aaronsb-obsidian-mcp-plugin-caaf4da/sync-version.mjs :3
import { readFileSync, writeFileSync } from 'fs'; - fs (weak) aaronsb-obsidian-mcp-plugin-caaf4da/tests/network-exposure-integration.test.ts :1
import { readFileSync } from 'fs'; - fs (weak) aaronsb-obsidian-mcp-plugin-caaf4da/tests/security/path-validator.test.ts :4
import * as fs from 'fs';
show 4 more
- fs (weak) aaronsb-obsidian-mcp-plugin-caaf4da/tests/security/tls-cert-verification.test.ts :1
import { readFileSync } from 'fs'; - fs (weak) aaronsb-obsidian-mcp-plugin-caaf4da/tests/security/tls-min-version.test.ts :11
import { mkdtempSync, writeFileSync } from 'fs'; - fs (weak) aaronsb-obsidian-mcp-plugin-caaf4da/tests/test-contract.test.ts :21
import { readFileSync, readdirSync, statSync } from 'fs'; - fs aaronsb-obsidian-mcp-plugin-caaf4da/version-bump.mjs :1
import { readFileSync, writeFileSync } from "fs";
shell / exec 4
- shell (weak) aaronsb-obsidian-mcp-plugin-caaf4da/scripts/scorecard-baseline.mjs :14
import { spawnSync } from 'node:child_process'; - shell (weak) aaronsb-obsidian-mcp-plugin-caaf4da/scripts/scorecard-gate.mjs :27
import { spawnSync } from 'node:child_process'; - shell (weak) aaronsb-obsidian-mcp-plugin-caaf4da/scripts/scorecard.mjs :18
import { execSync } from 'node:child_process'; - shell (weak) aaronsb-obsidian-mcp-plugin-caaf4da/tests/bridge-bootstrap.test.ts :19
import { spawn } from 'node:child_process';
network 11
- net aaronsb-obsidian-mcp-plugin-caaf4da/mcpb/server.js :67
const response = await fetch(MCP_URL, { - net (weak) aaronsb-obsidian-mcp-plugin-caaf4da/scripts/scorecard.mjs :107
const res = await fetch(URL, { headers: { 'User-Agent': 'obsidian-mcp-scorecard/1' } }); - net aaronsb-obsidian-mcp-plugin-caaf4da/src/main.ts :374
const http = require('http') as typeof import('http'); - net aaronsb-obsidian-mcp-plugin-caaf4da/src/mcp-server.ts :4
import { createServer as createHttpServer, Server } from 'http'; - net aaronsb-obsidian-mcp-plugin-caaf4da/src/node-mcp-server.ts :3
import type { IncomingMessage, ServerResponse, Server } from 'http'; - net aaronsb-obsidian-mcp-plugin-caaf4da/src/security/safe-fetch.ts :1
import * as http from 'http'; - net aaronsb-obsidian-mcp-plugin-caaf4da/src/security/url-validator.ts :1
import * as net from 'net'; - net aaronsb-obsidian-mcp-plugin-caaf4da/src/utils/certificate-manager.ts :4
import { createServer as createHttpServer, Server as HttpServer } from 'http'; - net (weak) aaronsb-obsidian-mcp-plugin-caaf4da/test-concurrent.js :7
const http = require('http'); - net (weak) aaronsb-obsidian-mcp-plugin-caaf4da/tests/bridge-bootstrap.test.ts :20
import http from 'node:http'; - net (weak) aaronsb-obsidian-mcp-plugin-caaf4da/tests/security/tls-min-version.test.ts :15
import { AddressInfo } from 'net';
secrets 2
- secrets aaronsb-obsidian-mcp-plugin-caaf4da/mcpb/server.js :7
const API_KEY = process.env.MCP_API_KEY || ''; - secrets (weak) aaronsb-obsidian-mcp-plugin-caaf4da/tests/bridge-self-heal.test.ts :21
process.env.MCP_API_KEY = 'test-key';
declared dependencies 29
- @modelcontextprotocol/sdk@^1.29.0
- @types/cors@^2.8.19
- @types/express@^5.0.6
- @types/node-forge@^1.3.14
- @types/turndown@^5.0.5
- cors@^2.8.6
- express@^5.2.1
- expression-eval@5.0.1
- minimatch@^10.2.6
- node-forge@^1.4.0
- turndown@^7.2.4
- yaml@2.9.0
show 17 more
- zod@^4.4.3
- @eslint/js@^10.0.1
- @types/jest@^30.0.0
- @types/minimatch@^5.1.2
- @types/node@^24.13.3
- @typescript-eslint/utils@^8.68.0
- esbuild@^0.28.2
- eslint@^10.9.1
- eslint-plugin-obsidianmd@^0.4.2
- globals@^17.11.0
- jest@^30.5.0
- jiti@^2.7.0
- obsidian@^1.13.1
- ts-jest@^29.4.12
- tslib@^2.8.1
- typescript@^6.0.3
- typescript-eslint@^8.68.0