Obsidian MCP Server — Watchlist

MCP100 Assessment

Watchlist / Tracking

Why we’re tracking it

Track vault operation and Streamable HTTP or stdio support as Obsidian changes

Reviewed Oct 5, 2026 · Documentation review; complete setup workflow not independently tested

Best fit

Structured read/write access to Obsidian vaults through Local REST API

What we know

Community MCP server for reading, searching and modifying Obsidian vault content through the Obsidian Local REST API plugin.

Maintenance / activity evidence

Observed Oct 5, 2026 (UTC)docs(changelog): attribute path-first argument hints to 0.13.9, resta…

Tracking evidence observed Oct 5, 2026. These dated signals do not establish current maintenance. Reviewed enrichment confidence: high.

Activity source · commits ↗Activity source · releases ↗

Verification gaps / watch-outs

Installation and comprehensive security have not been independently audited.
Permissions of Local REST API plugin/vault. Writes: Create/update notes; Delete notes after confirmation.
OBSIDIAN_API_KEY.
Sensitive access: Private notes/vault content

The server can read and modify a private knowledge vault; protect the API key and keep remote HTTP exposure scoped.

Security source · repository notice ↗Security source · policy file ↗

Full authority, access and evidence limits are available in Review context and Access & risk.

Popularity

686 repository stars

Stars observed Sep 25, 2026.

Preserve any already-reviewed adoption metrics in MCP100. Batch 4 did not refresh package downloads because the package-stats provider had insufficient credits.

All limitations / Review context

Which vault operations and transports are documented in the current server?

The bounded assessment reviewed the official README, repository notices, security policy path, and security page for known material public-tracking blockers. No such blocker was identified. This is a public-tracking assessment, not an installation safety certification.

The server can read and modify a private knowledge vault; protect the API key and keep remote HTTP exposure scoped.
Permissions of Local REST API plugin/vault.
OBSIDIAN_API_KEY.
Vault data is exchanged locally between MCP server and Obsidian plugin.
Reviewed write actions: Create/update notes; Delete notes after confirmation
Sensitive access: Private notes/vault content
Installation, client compatibility and comprehensive security have not been independently audited. Authentication and access depend on the configured services.
No independent runtime, installation, or comprehensive security audit was performed.
No installation, runtime, client matrix, or complete tool-contract audit was performed in this review.
Requires Obsidian Local REST API plugin.
Delete requires client elicitation/confirmation.
HTTP/TLS behavior depends on local plugin configuration.

Original activity observations

2026-10-05T07:27:52Z: docs(changelog): attribute path-first argument hints to 0.13.9, resta…

Technical identity

github.com/cyanheads/obsidian-mcp-server

Exact implementation source: https://github.com/cyanheads/obsidian-mcp-server ↗
Reviewed resource type: MCP Server
Repository identity: cyanheads/obsidian-mcp-server
Package identity: npm:obsidian-mcp-server
Service endpoint: http://127.0.0.1:3010/mcp

Evidence & Sources

Evidence basis: Recorded source evidence
Setup runtime verification: Not independently runtime-tested by MCP100 for this setup workflow.

Reviewed Oct 5, 2026 · Latest source observation Oct 6, 2026

GitHub repository ↗
cyanheads/obsidian-mcp-server
Recorded repository material and project history.

Setup · Watchlist

Install & Agents

Publisher instructions.

Source evidence observed Oct 12, 2026.

Additional setup details required — see the specific gaps below.

Install / connect
Publisher instructions
Publisher-specific setup path. Follow prerequisites, then register or connect to your MCP host.
publisher documented install or connect · Publisher instructions
npx -y obsidian-mcp-server@latest

Configure / authenticate

Publisher instructions

Obsidian Local REST API plugin must be enabled. Add stdio config `npx -y obsidian-mcp-server@latest` and OBSIDIAN_API_KEY from plugin settings.

Advanced configuration · claude desktop json · Publisher instructions

claude desktop json · Publisher instructions

{
  "mcpServers": {
    "obsidian-mcp-server": {
      "args": [
        "-y",
        "obsidian-mcp-server@latest"
      ],
      "command": "npx",
      "env": {
        "MCP_LOG_LEVEL": "info",
        "MCP_TRANSPORT_TYPE": "stdio",
        "OBSIDIAN_API_KEY": "your-local-rest-api-key"
      },
      "type": "stdio"
    }
  }
}

Check connection
Suggested check
Check tool discovery and read-only list/search notes before changing the vault.
Remove / uninstall / revoke
MCP100 setup guide
Remove the `obsidian-mcp-server` entry in your client; leave Local REST API plugin installed unless no longer needed.
MCP100 client-scope guidance: each CLI removal example targets only its named client and exact registered entry. Package names, Desktop/Cursor configuration keys and Codex/Claude registration names may differ; use the entry you actually registered. Client removal does not revoke provider credentials.
claude mcp remove obsidian-mcp-server

Official Documentation & Sources

What it does

Community MCP server for reading, searching and modifying Obsidian vault content through the Obsidian Local REST API plugin.

Capability: Files & Knowledge
Resource type: MCP Server
Best fit: Structured read/write access to Obsidian vaults through Local REST API

Representative uses

Read/search notes
Write section-targeted content
Manage periodic notes
Delete notes with confirmation

Limitations

Requires Obsidian Local REST API plugin.
Delete requires client elicitation/confirmation.
HTTP/TLS behavior depends on local plugin configuration.

Reviewed access

Access & risk

Review the exact access boundary before connecting this MCP to accounts, credentials, or sensitive data.

Authentication: OBSIDIAN_API_KEY.
Permissions: Permissions of Local REST API plugin/vault.
Data handling: Vault data is exchanged locally between MCP server and Obsidian plugin.
Cost: free
Risk and cautions: The server can read and modify a private knowledge vault; protect the API key and keep remote HTTP exposure scoped.

Access scope and cautions

Write actions: Create/update notes Delete notes after confirmation
Sensitive access: Private notes/vault content
Risk level: high

FAQ

Based on reviewed evidence as of 2026-10-06. Watchlist tracking is not a recommendation or a security certification.

Which tasks are documented for this implementation?

The reviewed tasks include: Read/search notes; Write section-targeted content; Manage periodic notes; Delete notes with confirmation.

What setup and authentication are documented?

Recorded installation/entrypoint step: npx -y obsidian-mcp-server@latest. Recorded endpoint: http://127.0.0.1:3010/mcp. Recorded transport: stdio, streamable_http. Recorded environment-variable notes: MCP_TRANSPORT_TYPE; MCP_LOG_LEVEL; OBSIDIAN_API_KEY; OBSIDIAN_BASE_URL. No configuration values are supplied here. Prerequisites: Node.js 24+ or Bun 1.4+; Obsidian Local REST API plugin. These are the documented setup details, not a claim that installation or client compatibility was independently tested. Authentication: Obsidian Local REST API key.

Can it modify data or perform write operations?

Documented write actions include: Create/update notes; Delete notes after confirmation. Recorded permission boundary: Permissions of Local REST API plugin/vault.

What data-handling boundary should I consider?

Vault data is exchanged locally between MCP server and Obsidian plugin. Recorded sensitive-access context: Private notes/vault content.

What limitations and risks should I check before use?

The server can read and modify a private knowledge vault; protect the API key and keep remote HTTP exposure scoped. Requires Obsidian Local REST API plugin. Delete requires client elicitation/confirmation. HTTP/TLS behavior depends on local plugin configuration. No independent runtime, installation, or comprehensive security audit was performed.

Is this an official MCP?

Cyanheads is listed as Community implementation in MCP100’s current evidence.