Is io.github.The-40-Thieves/obsidian-tc safe to use?

io.github.The-40-Thieves/obsidian-tc has no known CVEs as of the latest MCPpedia security scan. Authentication requirements were not detected automatically - check the project's documentation before connecting in a shared environment. Licensed under AGPL-3.0.

How do I install io.github.The-40-Thieves/obsidian-tc?

io.github.The-40-Thieves/obsidian-tc supports copy-paste install configs on its MCPpedia page for Claude Desktop, Cursor, and Claude Code. Scroll to the Quick Install section and select your client.

What AI clients work with io.github.The-40-Thieves/obsidian-tc?

io.github.The-40-Thieves/obsidian-tc is compatible with claude-desktop, cursor, claude-code. It uses stdio and sse and http transport.

Is io.github.The-40-Thieves/obsidian-tc actively maintained?

io.github.The-40-Thieves/obsidian-tc is actively maintained - last commit was 2 days ago.

io.github.The-40-Thieves/obsidian-tc

obsidian-tc

Governed Obsidian vault access: hybrid retrieval, Markdown-native memory, HITL confirmations.

1.3k/wk GitHub npm

No known CVEs

AGPL-3.0 license

Actively maintained

Last commit 2d ago

Works with most clients

Transport: stdio, sse, http

0 tools

Grade F

MCPpedia last refreshed this data 2d ago

Edit this pageView history

io.github.The-40-Thieves/obsidian-tc is an MCP server that governed Obsidian vault access: hybrid retrieval, Markdown-native memory, HITL confirmations. Its tool list has not been published yet over stdio, sse and http, requires no API key, and scores 64/100 on MCPpedia's security, maintenance and efficiency rubric.

Productivity Security

Step 1

Install in your client

Config is the same across clients - only the file and path differ.

Supported in Claude Desktopstdio, sse, http · Node 18+

Paste into ~/Library/Application Support/Claude/claude_desktop_config.json

{
  "mcpServers": {
    "io-github-the-40-thieves-obsidian-tc": {
      "args": [
        "-y",
        "obsidian-tc"
      ],
      "command": "npx"
    }
  }
}

Are you the author?

Add this badge to your README to show your security score and help users find safe servers.

Embed in your READMEAbout badges →

[![MCPpedia Score](https://mcppedia.org/api/badge/io-github-the-40-thieves-obsidian-tc)](https://mcppedia.org/s/io-github-the-40-thieves-obsidian-tc)

Read me

What io.github.The-40-Thieves/obsidian-tc does

Governed Obsidian vault access: hybrid retrieval, Markdown-native memory, HITL confirmations.

Test This Server

This server supports HTTP transport. Be the first to test it - help the community know if it works.

Loading README…

Scored, not listed

Why this score

Five weighted categories - click any category to see the underlying evidence.

Score breakdown

64/100across 5 weighted dimensions

How we score →

0255075100

−36

Security

Maintenance

Efficiency

Documentation

Compatibility

Categoriesclick a row to see evidence

Security

OSV.dev

7 fixed

CVE-2026-115478high · fixed

obsidian-tc: Memory-lifecycle tools overwrite unowned notes or partially commit lifecycle changes

### Summary `create_entity`, `link_entities`, `rename_entity`, `unlink_entities` and `delete_entity` regenerate a memory note's body from SQLite at the computed `memory/<type>/<name>.md` path. When a note already existed at that path and was not owned by the entity being written (a hand-authored note, or an orphan left by a different entity whose name sanitized to the same path), its entire body was overwritten on the next write naming that `(type, name)`, keeping only its frontmatter. Separatel

Affected: >= 1.0.1Fixed in 1.31.4source →

CVE-2026-77363critical · fixedCVSS 9.6

obsidian-tc HTTP transport lacks Origin/DNS-rebinding protection, enabling drive-by vault access on loopback

### Impact The Streamable HTTP transport was constructed without `enableDnsRebindingProtection`/`allowedHosts`/`allowedOrigins` and performed no `Origin`-header validation. With the documented `auth.mode: "none"` loopback default, a **drive-by web page could `POST http://127.0.0.1/mcp`** and receive caller `http-local` with scopes `["*"]` — full vault read/write — via DNS rebinding / a forged Origin. ### Patches Fixed in **1.3.1**. Upgrade to `>= 1.3.1`. The transport now enables DNS-rebinding

Affected: >= 0Fixed in 1.3.1source →

CVE-2026-77362medium · fixedCVSS 4.3

obsidian-tc Bridge tools leak denied-note data via unfiltered sibling fields

### Impact Bridge tool results filtered only the `items` array against the read ACL and passed sibling fields through unfiltered: `tasks_filter` emitted `groups` whose counts reflected denied notes, `makemd_query` returned `...result` siblings, and `list_templates` enumerated Templater template paths and parsed user-function bodies with no read-whitelist gate. A caller could infer or read data from notes outside its read ACL. ### Patches Fixed in **1.3.1**. Upgrade to `>= 1.3.1`. All path-attri

Affected: >= 0Fixed in 1.3.1source →

CVE-2026-115477high · fixed

obsidian-tc: Declined human-in-the-loop confirmations can permit destructive calls over HTTP

### Summary On a Streamable HTTP deployment with `auth.jwtSecret` configured, serving a 2026-07-28-era client that declared `elicitation.form` support, a call to a dispatch-gated tool (`destructive: true`, or a scope with an HITL floor) that was offered an `inputRequired` confirmation could still complete after the human declined, cancelled, or the elicitation response was omitted or malformed, provided the client echoed the validly bound `requestState` on resubmission. The server trusted an aut

Affected: >= 1.13.0Fixed in 1.31.4source →

CVE-2026-77366critical · fixedCVSS 9.9

obsidian-tc tokens can access arbitrary configured vaults

### Impact Tool dispatch did not check the caller-supplied `input.vault` against the caller's bound vault (`ctx.vaultId`); the folder ACL was a single global instance and the JWT carried no vault claim. As a result, **any valid token could read, write, or delete any configured vault** by passing `input.vault`, defeating multi-tenant isolation across ~90 tool sites. (`resources/read` was the only surface that already guarded this.) ### Patches Fixed in **1.3.1** (the fix was developed on the `v1

Affected: >= 0Fixed in 1.3.1source →

Community

Reviews

Be the first to review

Have you used this server?

Share your experience - it helps other developers decide.

How easy was setup?Did it work reliably?How was the documentation?

Frequently Asked Questions

Is io.github.The-40-Thieves/obsidian-tc safe to use?: io.github.The-40-Thieves/obsidian-tc has no known CVEs as of the latest MCPpedia security scan. Authentication requirements were not detected automatically - check the project's documentation before connecting in a shared environment. Licensed under AGPL-3.0.
How do I install io.github.The-40-Thieves/obsidian-tc?: io.github.The-40-Thieves/obsidian-tc supports copy-paste install configs on its MCPpedia page for Claude Desktop, Cursor, and Claude Code. Scroll to the Quick Install section and select your client.
What AI clients work with io.github.The-40-Thieves/obsidian-tc?: io.github.The-40-Thieves/obsidian-tc is compatible with claude-desktop, cursor, claude-code. It uses stdio and sse and http transport.
Is io.github.The-40-Thieves/obsidian-tc actively maintained?: io.github.The-40-Thieves/obsidian-tc is actively maintained - last commit was 2 days ago.

Similar servers

Others in productivity / security

View all →

Anytype Mcp95

Official MCP server for Anytype API - your encrypted, local and collaborative wiki.

542 4

io.github.vmoranv/jshookmcp95

Search-first MCP server for JavaScript reverse engineering: 735 tools across 36 domains.

2.1k 2

com.monday/monday.com93

MCP server for monday.com integration.

437 4

Obsidian Sync MCP Server93

Give AI agents access to your Obsidian vault via local files or Self-hosted LiveSync.

72 9

MCP Security Weekly

Get CVE alerts and security updates for io.github.The-40-Thieves/obsidian-tc and similar servers.

Community

Discussion

Start a conversation

Ask a question, share a tip, or report an issue.

Has anyone used this with Cursor?How do you handle auth?Any alternatives?

Edit this pageView history

Productivity Security

Step 1

Install in your client

Config is the same across clients - only the file and path differ.

Supported in Claude Desktopstdio, sse, http · Node 18+

Paste into ~/Library/Application Support/Claude/claude_desktop_config.json

{
  "mcpServers": {
    "io-github-the-40-thieves-obsidian-tc": {
      "args": [
        "-y",
        "obsidian-tc"
      ],
      "command": "npx"
    }
  }
}

Are you the author?

Add this badge to your README to show your security score and help users find safe servers.

Embed in your READMEAbout badges →

[![MCPpedia Score](https://mcppedia.org/api/badge/io-github-the-40-thieves-obsidian-tc)](https://mcppedia.org/s/io-github-the-40-thieves-obsidian-tc)

Read me

What io.github.The-40-Thieves/obsidian-tc does

Governed Obsidian vault access: hybrid retrieval, Markdown-native memory, HITL confirmations.

Test This Server

This server supports HTTP transport. Be the first to test it - help the community know if it works.

README

Reliquary-TC

Governed, agent-ready Obsidian vault access over MCP.

Formerly obsidian-tc. Renamed in 2.0. The obsidian-tc command, OBSIDIAN_TC_* variables, obsidian-tc:// resource URIs, obsidian_tc_* metrics and an existing ~/.obsidian-tc folder all keep working through 2.x; see Upgrading from obsidian-tc.

What it is

reliquary-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults, for humans and agents alike. Instead of raw filesystem access to years of notes, every tool call runs through one pipeline — auth, folder ACLs, a read-only kill switch, HITL confirmation on destructive ops, and an audit log. It also adds fused retrieval (full-text, vector, graph) and a memory tier — episodes, decay, forgetting — living inside your vault under that same ACL. A full tool surface across every domain (all visible by default; a smaller set with opt-in profile: "core"), via a 3-tool discovery facade plus the standard search/fetch pair, listed in the tool catalog. Pitch: docs/WHY.md.

60-second start

No install:

npx reliquary-tc /path/to/vault

Every note tool and lexical search work immediately. Semantic search defaults to a bundled embedder — see When NOT to use for which install methods it reaches.

For multi-vault, auth, or ACLs, use a config file:

npm install -g reliquary-tc
reliquary-tc ./reliquary-tc.config.json   # Node >= 24 or Bun >= 1.1

The default local embedder is an opt-in install, so npm install -g reliquary-tc leaves it out. To use it, install the same version: npm install -g @the-40-thieves/reliquary-tc-embedder-local@<same version> (drop -g for a project install), or let reliquary-tc setup offer to. Ollama and hosted embedding providers need no local embedder; without any embedder, semantic search is off and everything else still works.

Also ships as a Docker image, .mcpb bundle, and standalone binaries. More: docs/QUICKSTART.md.

When NOT to use reliquary-tc

Honest guidance — this is a heavier product than most:

Smallest possible footprint, read-only access, or no MCP at all. A single trusted human over one vault, a read-only wrapper, or the Obsidian URI/Local REST API plugin may be all you need — see the full comparison.
Zero setup, source checkouts only. The vault is read off disk; semantic search defaults to a bundled offline embedder; npm/Docker need an explicit provider until published — see Embeddings.
Zero-config trades away auth/ACLs. reliquary-tc /path/to/vault boots with auth off, no folder ACL — fine only because it's local-only; governance is opt-in. Detail: SECURITY.md.
Single-maintainer project.
Everything inside Obsidian, or vault-independent memory. See the comparison above.

Migrating from another MCP server: docs/CUTOVER.md.

How it compares

Most Obsidian MCP projects are vault-access servers, retrieval engines, or memory engines, rarely more than on

... View full README on GitHub

Loading README…

Scored, not listed

Why this score

Five weighted categories - click any category to see the underlying evidence.

Score breakdown

64/100across 5 weighted dimensions

How we score →

0255075100

−36

Security

Maintenance

Efficiency

Documentation

Compatibility

Categoriesclick a row to see evidence

Security

OSV.dev

7 fixed

CVE-2026-115478high · fixed

obsidian-tc: Memory-lifecycle tools overwrite unowned notes or partially commit lifecycle changes

Affected: >= 1.0.1Fixed in 1.31.4source →

CVE-2026-77363critical · fixedCVSS 9.6

obsidian-tc HTTP transport lacks Origin/DNS-rebinding protection, enabling drive-by vault access on loopback

Affected: >= 0Fixed in 1.3.1source →

CVE-2026-77362medium · fixedCVSS 4.3

obsidian-tc Bridge tools leak denied-note data via unfiltered sibling fields

Affected: >= 0Fixed in 1.3.1source →

CVE-2026-115477high · fixed

obsidian-tc: Declined human-in-the-loop confirmations can permit destructive calls over HTTP

Affected: >= 1.13.0Fixed in 1.31.4source →

CVE-2026-77366critical · fixedCVSS 9.9

obsidian-tc tokens can access arbitrary configured vaults

Affected: >= 0Fixed in 1.3.1source →

Community

Reviews

Be the first to review

Have you used this server?

Share your experience - it helps other developers decide.

How easy was setup?Did it work reliably?How was the documentation?

Frequently Asked Questions

Is io.github.The-40-Thieves/obsidian-tc safe to use?: io.github.The-40-Thieves/obsidian-tc has no known CVEs as of the latest MCPpedia security scan. Authentication requirements were not detected automatically - check the project's documentation before connecting in a shared environment. Licensed under AGPL-3.0.
How do I install io.github.The-40-Thieves/obsidian-tc?: io.github.The-40-Thieves/obsidian-tc supports copy-paste install configs on its MCPpedia page for Claude Desktop, Cursor, and Claude Code. Scroll to the Quick Install section and select your client.
What AI clients work with io.github.The-40-Thieves/obsidian-tc?: io.github.The-40-Thieves/obsidian-tc is compatible with claude-desktop, cursor, claude-code. It uses stdio and sse and http transport.
Is io.github.The-40-Thieves/obsidian-tc actively maintained?: io.github.The-40-Thieves/obsidian-tc is actively maintained - last commit was 2 days ago.