v0.18.3MIT LicenseFree
AI + Obsidian =
Connect MCP clients to your Obsidian vault.
MCPVault reads, searches, and edits local vault files. Obsidian can stay closed, and frontmatter updates preserve existing formatting.
Recent updates v0.18.3
v0.18.3 (November 2026): Note metadata now recognizes frontmatter in CRLF notes. LF behavior and note contents stay unchanged.
- v0.18.2 (October 2026): CRLF notes keep their tags and line endings. JavaScript frontmatter is treated as note content and never executed (#163, thanks @badigit).
- v0.18.1 (October 2026): Safer note writes preserve in-vault symlinks and POSIX file modes. Updates queue per note within one server instance, and files are replaced atomically (#263, thanks @ErycM).
- v0.18.0 (October 2026): Requires Node.js 22.12.0 or later. Node 20 users should upgrade Node.js or stay on MCPVault 0.17.3 (#261).
- v0.17.3 (October 2026): Updated system-trash support to
trash10.1.1. Exact-filename safeguards remain enabled (#253). - v0.17.2 (October 2026): System trash now uses exact filenames. Brackets and other pattern characters no longer select neighboring notes (#258). Dependencies refreshed.
- v0.17.1 (October 2026): Hardened vault-boundary checks for symlink paths. Clearer
move_notedirectory errors and protection against moves onto the same path (#247, thanks @mvanhorn). - v0.17.0 (October 2026): Added repeatable
--exclude <subtree>defaults for search and directory listings. Per-call exclusions add to those defaults, while direct reads and writes remain available (#235). - v0.16.1 (October 2026): Updated MCP SDK and test dependencies to patched releases, and pinned system-trash support to a dependency chain without the current high-severity
bracesadvisory. - v0.16.0 (August 2026): Moved to MCP v2, the official SDK for the 2026-07-28 specification. One process accepts both protocol generations, with no material slowdown in our benchmarks.
- v0.15.0 (August 2026): Added
--read-onlymode, which exposes read tools only and rejects all vault mutations (#112, thanks @vdhome-dev) - v0.14.1 (August 2026): Security: dotfiles and hidden directories are now denied at any vault depth, closing an extension-filter bypass (#115, thanks @sadegh)
- v0.14.0 (August 2026): Added
get_note_outlineandread_note_linesfor navigating and reading targeted sections of large notes without loading the full file (#146, thanks @kartik7704) - v0.12.6 (August 2026): Refreshed the MCP SDK and development toolchain, standardized the server package on npm, and removed its stale Bun lockfile. No runtime behavior changed (#178)
- v0.12.5 (July 2026): The server now exits cleanly when stdio clients disconnect or terminate, preventing orphaned MCPVault processes (#159)
- v0.12.4 (July 2026): New
wiki_linktool reads Obsidian wiki links —[[Note]],[[Note|Display]], and path-qualified[[folder/Note]]— and returns the note ready for context, with alternative paths when a name is ambiguous (#101) - v0.12.3 (July 2026):
wiki_linklands (#101, thanks @renoirb); Obsidian's.trash/is now excluded from all tools - v0.12.2 (July 2026):
patch_noteno longer corrupts insertions containing$replacement patterns (#149), and paths that accidentally include the vault prefix (absolute or~/) are normalized to vault-relative (#122) - v0.12.1 (June 2026): Security: frontmatter parsing moved off
js-yaml3.x (CVE-2023-44270) to theyamlpackage - v0.12.0 (June 2026):
search_notesnow acceptspathPrefixandexcludePathsto scope searches to (or away from) vault subtrees (#126) - v0.11.5 (June 2026): Security: restricted directories (
.git,.obsidian,node_modules) now denied at any depth (GHSA-9c83); write errors classified by error code, not message (#109) - v0.11.4 (June 2026): Security: deny-list matching is now case-insensitive with canonicalized trailing dots/spaces (GHSA-j99q)
- v0.11.3 (June 2026): Missing
patharguments return a clear error instead of aTypeError(#107) - v0.11.2 (April 2026):
delete_notenow supports soft-delete withtrashMode:none(permanent),local(move to.trash/inside vault), orsystem(OS trash). (#91) - v0.11.1 (April 2026): Frontmatter updates now use AST-aware YAML preservation. Unmodified fields keep their original formatting: plain dates stay as
YYYY-MM-DD, quoted strings keep their quotes, andHH:MMvalues are no longer misread as sexagesimal integers. (#77) - v0.11.0 (March 2026): New
list_all_tagstool scans the vault for all frontmatter tags and inline#hashtagswith occurrence counts. Obsidian skill now routes to CLI for active file, daily notes, backlinks, and open-in-editor. (#80) - v0.10.0 (March 2026): New
createServer()factory for library consumers. TypeScript declarations exported. (#84) - v0.9.1 (March 2026): Security fix: symlinks inside the vault that point outside the vault boundary are now blocked. (#78)
- v0.9.0 (March 2026): Package renamed to
@bitbonsai/mcpvaulton npm at Obsidian's request. Update your config: replacemcpvaultwith@bitbonsai/mcpvault. - v0.8.2 (March 2026): Trailing-slash vault paths no longer truncate search results (PR #48),
get_vault_statsnow handles dotted folder names correctly (PR #42), note tools now support.baseand.canvas(PR #53), string frontmatter inputs are now handled safely (PR #47), vault path is now optional for CLI usage (defaults to current working directory) (#50), and dependency refreshes for the MCP SDK and Node types are merged (PR #43, PR #44) - v0.8.1: Multi-word BM25 search relevance improvements (PR #38), patch_note undefined/null validation hardening (PR #37), new
move_filetool for binary-safe file moves with explicit path confirmation, binary filenames now visible in directory listings (#21) - v0.7.5: Search now matches note filenames, hidden directories filtered from listings, OpenCode install docs
- v0.7.4: New get_vault_stats tool + improved error messages with remediation suggestions
- v0.7.3: Bug fix for folder detection with dots in names + dependency updates (PR #15)
- v0.7.2: Security hardening - TOCTOU fixes, regex injection prevention, comprehensive CI/CD (PR #12)