Obsidian MCP Server - Enhanced

Enhanced Obsidian MCP Server with Claude.ai Remote Integration, Tailscale Support, and Advanced Query Capabilities!

> 🔥 Enhanced Fork Notice: This is an enhanced version of the excellent cyanheads/obsidian-mcp-server with additional features specifically tailored for remote Claude.ai integration, advanced task querying, and security via Tailscale.

An MCP (Model Context Protocol) server providing comprehensive access to your Obsidian vault. Enables LLMs and AI agents to read, write, search, and manage your notes and files through the Obsidian Local REST API plugin.

Built on the `cyanheads/mcp-ts-template`, this server follows a modular architecture with robust error handling, logging, and security features.

🚀 Enhanced Features (This Fork)

🏛️ Multi-Vault Support

Simultaneous access to multiple Obsidian vaults through a single MCP server:

• Multiple Vault Management: Connect to multiple Obsidian instances on different ports simultaneously
• Vault-Specific Routing: Tools automatically route to the correct vault based on `vault` parameter
• Individual Authentication: Separate API keys for each vault with centralized MCP authentication
• Backwards Compatible: Existing single-vault configurations continue to work unchanged
• Dynamic Configuration: JSON-based vault configuration with validation and error handling

🌐 Claude.ai Remote Integration

Perfect integration with Claude.ai's Remote MCP feature:

• Stateless HTTP Mode: Dedicated stateless transport for Claude.ai compatibility (`MCP_HTTP_STATELESS=true`)
• Session-Based Mode: Traditional session management for other MCP clients
• Simplified Authentication: Uses dedicated MCP_AUTH_KEY for server access
• Zero Configuration: Works out-of-the-box with Claude.ai Remote MCP servers
• Production Ready: Enterprise-grade stability and error handling

🔒 Tailscale Secure Remote Access

Access your Obsidian vault securely from anywhere:

• Tailscale Funnel Integration: Secure HTTPS endpoints with automatic certificates
• End-to-End Encryption: All traffic encrypted through Tailscale network
• No Port Forwarding: Zero network configuration required
• Access Control: Built-in Tailscale ACL support for enterprise security

📊 Enhanced Task & Query System

Advanced querying capabilities beyond the original:

• Tasks Plugin Integration: Deep integration with Obsidian Tasks plugin
• Advanced Date Parsing: Natural language date recognition
• Priority Detection: Visual and text-based priority parsing
• Multiple Output Formats: Table, list, and summary views

🔧 Production Monitoring & Reliability

Enterprise-grade monitoring and auto-restart capabilities:

• Health Check Script: Comprehensive component validation (`scripts/health-check.sh`)
• Intelligent Monitoring: Auto-restart with process lifecycle management (`scripts/monitor-mcp.sh`)
• macOS Auto-Start: Launch agent configuration for system startup (`scripts/setup-autostart.sh`)
• Dynamic Port Management: Automatic port conflict resolution (3010-3013 range)
• Enhanced Logging: Detailed connection debugging and API key validation

🚀 Core Capabilities: Obsidian Tools 🛠️

This server equips your AI with specialized tools to interact with your Obsidian vault:

Table of Contents

Overview

The Obsidian MCP Server acts as a bridge, allowing applications (MCP Clients) that understand the Model Context Protocol (MCP) – like advanced AI assistants (LLMs), IDE extensions, or custom scripts – to interact directly and safely with your Obsidian vault.

Instead of complex scripting or manual interaction, your tools can leverage this server to:

• Automate vault management: Read notes, update content, manage frontmatter and tags, search across files, list directories, and delete files programmatically.
• Integrate Obsidian into AI workflows: Enable LLMs to access and modify your knowledge base as part of their research, writing, or coding tasks.
• Build custom Obsidian tools: Create external applications that interact with your vault data in novel ways.

Built on the robust `mcp-ts-template`, this server provides a standardized, secure, and efficient way to expose Obsidian functionality via the MCP standard. It achieves this by communicating with the powerful Obsidian Local REST API plugin running inside your vault.

> Developer Note: This repository includes a .clinerules file that serves as a developer cheat sheet for your LLM coding agent with quick reference for the codebase patterns, file locations, and code snippets.

Features

Core Utilities

Leverages the robust utilities provided by the `mcp-ts-template`:

• Logging: Structured, configurable logging (file rotation, console, MCP notifications) with sensitive data redaction.
• Error Handling: Centralized error processing, standardized error types (`McpError`), and automatic logging.
• Configuration: Environment variable loading (`dotenv`) with comprehensive validation.
• Input Validation/Sanitization: Uses `zod` for schema validation and custom sanitization logic.
• Request Context: Tracking and correlation of operations via unique request IDs.
• Type Safety: Strong typing enforced by TypeScript and Zod schemas.
• HTTP Transport Option: Native Node.js HTTP server with session management, CORS support, and API key authentication.

Obsidian Integration

• Obsidian Local REST API Integration: Communicates directly with the Obsidian Local REST API plugin via HTTP requests managed by the `ObsidianRestApiService`.
• Comprehensive Command Coverage: Exposes key vault operations as MCP tools (see Tools section).
• Vault Interaction: Supports reading, updating (append, prepend, overwrite), searching (global text/regex, search/replace), listing, deleting, and managing frontmatter and tags.
• Targeting Flexibility: Tools can target files by path, the currently active file in Obsidian, or periodic notes (daily, weekly, etc.).
• Vault Cache Service: An intelligent in-memory cache that improves performance and resilience. It caches vault content, provides a fallback for the global search tool if the live API fails, and periodically refreshes to stay in sync.
• Safety Features: Case-insensitive path fallbacks for file operations, clear distinction between modification types (append, overwrite, etc.).

Installation

Prerequisites

1. Obsidian: You need Obsidian installed.

2. Obsidian Local REST API Plugin: Install and enable the Obsidian Local REST API plugin within your Obsidian vault.

3. API Key: Configure an API key within the Local REST API plugin settings in Obsidian. You will need this key to configure the server.

4. Node.js & npm: Ensure you have Node.js (v18 or later recommended) and npm installed.

5. Tailscale (for remote access): Install Tailscale and enable Tailscale Funnel for secure remote Claude.ai integration.

> 💡 Quick Setup: For automatic startup on boot, see the Auto-Start Setup Guide after installation.

Installation

1. Clone this enhanced repository:

git clone https://github.com/BoweyLou/obsidian-mcp-server-enhanced.git
    cd obsidian-mcp-server-enhanced

2. Install dependencies:

npm install

3. Build the project:

npm run build

This compiles the TypeScript code to JavaScript in the `dist/` directory and makes the entry point executable.

Configuration

Environment Variables

Configure the server using environment variables.

These variables must be set in the MCP client configuration (e.g., `cline_mcp_settings.json`) or in your environment before starting the server (if running directly).

If running directly, they can be set in a `.env` file in the project root or directly in your environment.

Multi-Vault Configuration

The server supports both single-vault (backwards compatible) and multi-vault modes:

Single-Vault Mode (Legacy)

# .env file
MCP_AUTH_KEY=your-generated-mcp-auth-key
OBSIDIAN_API_KEY=your-obsidian-plugin-api-key
OBSIDIAN_BASE_URL=http://127.0.0.1:27123
MCP_TRANSPORT_TYPE=http
MCP_HTTP_STATELESS=true

Multi-Vault Mode (Recommended)

# .env file
MCP_AUTH_KEY=your-generated-mcp-auth-key
OBSIDIAN_VAULTS='[
  {
    "id": "work",
    "name": "Work Vault", 
    "apiKey": "work-vault-api-key",
    "baseUrl": "http://127.0.0.1:27123",
    "verifySsl": false
  },
  {
    "id": "personal",
    "name": "Personal Vault",
    "apiKey": "personal-vault-api-key", 
    "baseUrl": "http://127.0.0.1:27122",
    "verifySsl": false
  }
]'
MCP_TRANSPORT_TYPE=http
MCP_HTTP_STATELESS=true

Setup Process

1. Generate MCP Auth Key: `openssl rand -hex 32`

2. Configure Multiple Obsidian Instances: Install Local REST API plugin on different ports

3. Get API Keys: Extract API keys from each Obsidian instance's plugin settings

4. Configure Vaults: Update `.env` with `OBSIDIAN_VAULTS` JSON configuration

5. Start Server: `npm run start:http`

6. Access via Claude.ai: Use your Tailscale URL with MCP_AUTH_KEY

Connecting to the Obsidian API

Single-Vault Mode

To connect in single-vault mode, configure the base URL (`OBSIDIAN_BASE_URL`) and API key (`OBSIDIAN_API_KEY`). The Obsidian Local REST API plugin offers two connection types:

1. Encrypted (HTTPS):

2. Non-encrypted (HTTP) - Recommended:

Multi-Vault Mode

For multi-vault mode, configure each vault individually in the `OBSIDIAN_VAULTS` JSON array with its own API key and base URL. Each vault can use either HTTP or HTTPS as needed.

Example configurations:

_Single-vault with HTTP:_

"env": {
  "MCP_AUTH_KEY": "your-generated-mcp-auth-key",
  "OBSIDIAN_API_KEY": "your-obsidian-api-key",
  "OBSIDIAN_BASE_URL": "http://127.0.0.1:27123"
}

_Multi-vault configuration:_

"env": {
  "MCP_AUTH_KEY": "your-generated-mcp-auth-key",
  "OBSIDIAN_VAULTS": "[{\"id\":\"work\",\"name\":\"Work\",\"apiKey\":\"work-key\",\"baseUrl\":\"http://127.0.0.1:27123\"},{\"id\":\"personal\",\"name\":\"Personal\",\"apiKey\":\"personal-key\",\"baseUrl\":\"http://127.0.0.1:27122\"}]"
}

Local MCP Client Settings (Optional)

> Note: For Claude.ai Remote MCP integration, skip this section and use the Tailscale Remote Access Setup instead.

For local MCP clients (e.g., Cline), add to your settings (e.g., `cline_mcp_settings.json`):

Single-vault configuration:

{
  "mcpServers": {
    "obsidian-mcp-server": {
      "command": "node",
      "args": ["/path/to/your/obsidian-mcp-server-enhanced/dist/index.js"],
      "env": {
        "MCP_AUTH_KEY": "your-generated-mcp-auth-key",
        "OBSIDIAN_API_KEY": "your-obsidian-api-key",
        "OBSIDIAN_BASE_URL": "http://127.0.0.1:27123",
        "OBSIDIAN_ENABLE_CACHE": "true"
      }
    }
  }
}

Multi-vault configuration:

{
  "mcpServers": {
    "obsidian-mcp-server": {
      "command": "node",
      "args": ["/path/to/your/obsidian-mcp-server-enhanced/dist/index.js"],
      "env": {
        "MCP_AUTH_KEY": "your-generated-mcp-auth-key",
        "OBSIDIAN_VAULTS": "[{\"id\":\"work\",\"name\":\"Work Vault\",\"apiKey\":\"work-api-key\",\"baseUrl\":\"http://127.0.0.1:27123\"},{\"id\":\"personal\",\"name\":\"Personal Vault\",\"apiKey\":\"personal-api-key\",\"baseUrl\":\"http://127.0.0.1:27122\"}]",
        "OBSIDIAN_ENABLE_CACHE": "true"
      }
    }
  }
}

🌐 Remote Access Setup (Tailscale)

For remote access to your Obsidian vault from anywhere, you can use Tailscale to securely expose your MCP server over the internet.

Prerequisites

1. Tailscale Account: Sign up at tailscale.com

2. Tailscale Installed: Install Tailscale on your machine running the MCP server

3. Tailscale Funnel Enabled: Enable Tailscale Funnel for your account

Setup Steps

1. Generate MCP Auth Key:

openssl rand -hex 32

2. Configure Environment: Set up your `.env` file with the generated key:

MCP_AUTH_KEY=your-generated-auth-key
   MCP_TRANSPORT_TYPE=http
   MCP_HTTP_PORT=3010
   MCP_HTTP_STATELESS=true

3. Configure Vaults: Set up single or multi-vault configuration (see Multi-Vault Configuration)

4. Start the MCP Server:

npm run build && npm run start:http

5. Enable Tailscale Funnel:

tailscale funnel 3010

6. Get Your Public URL: Check your Tailscale device URL:

tailscale status --self | grep "Funnel on"

Claude.ai Remote MCP Configuration

Add to your Claude.ai Remote MCP servers using your MCP authentication key:

Single-vault setup:

{
  "url": "https://your-device.your-tailnet.ts.net/mcp?api_key=your-mcp-auth-key",
  "name": "Obsidian Vault"
}

Multi-vault setup:

{
  "url": "https://your-device.your-tailnet.ts.net/mcp?api_key=your-mcp-auth-key",
  "name": "Obsidian Multi-Vault"
}

> Authentication Note: Claude.ai Remote MCP uses the `MCP_AUTH_KEY` for server authentication. Individual vault operations use the vault-specific API keys configured in your environment.

Security Considerations

• Dual Authentication: MCP server authentication via MCP_AUTH_KEY, vault authentication via individual API keys
• Tailscale Encryption: All traffic is encrypted end-to-end by Tailscale
• Private Network: Only you can access the server through your Tailscale network
• Automatic SSL: Tailscale Funnel provides automatic HTTPS certificates
• Vault Isolation: Each vault uses its own API key for secure access control

Example Usage

Once set up, you can use tools remotely from Claude.ai:

Single-vault commands (uses default vault):

Use obsidian_task_query to show me tasks due today with format="table"

Multi-vault commands (specify vault):

Use obsidian_task_query with vault="work" to show me work tasks due today

Use obsidian_read_file with filePath="daily-note.md" and vault="personal"

Use obsidian_dataview_query with vault="work" to run: TABLE file.name FROM #meeting WHERE file.cday = date(today)

> 🚀 Pro Tip: For production use, set up automatic startup on boot so your server and Tailscale Funnel start automatically without manual intervention.

ChatGPT Connector Facade

Claude and local MCP clients can connect directly to `/mcp`. Hosted ChatGPT

connectors should use the separate `obsidian-chatgpt` facade instead. The

facade reuses the existing vault, search, and task logic internally, but it has

its own process, port, OAuth/PKCE authorization flow, scoped capabilities, and

write audit log.

Use the facade for public HTTPS or Tailscale Funnel routes. Keep the full MCP

server on localhost or private tailnet-only routes unless you are doing an

explicit local/dev test.

Starting the Facade

Configure a public resource URL and admin approval secret, then start the

facade:

export CHATGPT_FACADE_PUBLIC_URL="https://your-device.your-tailnet.ts.net"
export CHATGPT_FACADE_ADMIN_SECRET="$(openssl rand -hex 24)"
npm run build
npm run start:chatgpt

If the same Funnel hostname also exposes another ChatGPT connector, give this

facade a path-scoped resource URL such as

`https://your-device.your-tailnet.ts.net/obsidian` and route the `/obsidian`

prefix to the facade port. The facade serves both root and path-qualified

well-known metadata paths for that setup. In that shared-host setup, create the

connector with `https://your-device.your-tailnet.ts.net/obsidian/mcp`.

Check health:

curl "http://127.0.0.1:3020/health"

For facade HTTP-surface tests without a live Obsidian API, set

`CHATGPT_FACADE_SKIP_OBSIDIAN_CHECK=true`. Leave it unset for normal operation.

Expose only the facade through Funnel:

make tailscale-funnel-chatgpt

OAuth and Scopes

The facade publishes OAuth discovery metadata:

• `/.well-known/oauth-protected-resource`
• `/.well-known/oauth-authorization-server`
• `/.well-known/openid-configuration`

It stores authorization-code, access-token, and refresh-token hashes locally

under `CHATGPT_FACADE_STORE_PATH`, not raw tokens. It requires PKCE S256 for

initial token exchange, supports refresh-token rotation, and validates bearer

tokens by resource, expiry, and scope before executing actions.

Scopes:

• `obsidian:read`: `search`, `fetch`, `task_query`, `latest_note`
• `obsidian:write`: `create_task`, `update_task`, `append_note`, `create_note`, `create_daily_note`
• `obsidian:dangerous-write`: `overwrite_note`

Read-only connector setup is the default and is supported by granting only

`obsidian:read`.

`overwrite_note` is not available unless `obsidian:dangerous-write` is

explicitly granted.

Facade Actions

All actions use `POST /chatgpt/actions` with `Authorization: Bearer `.

They accept an optional `vault` field. The default public surface is intentionally

smaller than the full local MCP tool set.

Successful action responses use the same envelope for HTTP actions and facade

MCP tool calls:

{
  "success": true,
  "action": "create_daily_note",
  "vault": "default",
  "resultPath": "Daily/2026-07-03.md",
  "data": {
    "filePath": "Daily/2026-07-03.md"
  }
}

Write actions include `resultPath` when the affected vault path is known.

Task-creation and task-update actions also include `taskLineNumber` when the

line number is available.

Writes are appended to the local JSONL audit log at

`CHATGPT_FACADE_AUDIT_PATH`. The audit entry records action, client id, scopes,

target path, mode, result path, status, and a capped input summary; it does not

store raw ChatGPT transcripts or full note bodies. Operators can inspect recent

entries with:

curl "http://127.0.0.1:3020/audit/recent?admin_secret=$CHATGPT_FACADE_ADMIN_SECRET"

Legacy In-Process Layer

`CHATGPT_LAYER_ENABLED=true` still enables the older in-process

manifest/actions layer on the main HTTP transport for local/dev compatibility.

That layer uses `MCP_AUTH_KEY` query-string auth and exposes broader actions

including page overwrite. Do not use it as the recommended hosted ChatGPT

connector path.

Project Structure

The codebase follows a modular structure within the `src/` directory:

src/
├── index.ts           # Entry point: Initializes and starts the server
├── config/            # Configuration loading (env vars, package info)
│   └── index.ts
├── mcp-server/        # Core MCP server logic and capability registration
│   ├── server.ts      # Server setup, transport handling, tool/resource registration
│   ├── resources/     # MCP Resource implementations (currently none)
│   ├── tools/         # MCP Tool implementations (subdirs per tool)
│   └── transports/    # Stdio and HTTP transport logic, auth middleware
├── services/          # Abstractions for external APIs or internal caching
│   ├── obsidianRestAPI/ # Typed client for Obsidian Local REST API
│   └── vaultManager/    # Multi-vault configuration and service management
├── types-global/      # Shared TypeScript type definitions (errors, etc.)
└── utils/             # Common utility functions (logger, error handler, security, etc.)

For a detailed file tree, run `npm run tree` or see docs/tree.md.

Vault Cache Service

This server includes an intelligent in-memory cache designed to enhance performance and resilience when interacting with your vault.

Purpose and Benefits

• Performance: By caching file content and metadata, the server can perform search operations much faster, especially in large vaults. This reduces the number of direct requests to the Obsidian Local REST API, resulting in a snappier experience.
• Resilience: The cache acts as a fallback for the `obsidian_global_search` tool. If the live API search fails or times out, the server seamlessly uses the cache to provide results, ensuring that search functionality remains available even if the Obsidian API is temporarily unresponsive.
• Efficiency: The cache is designed to be efficient. It performs an initial build on startup and then periodically refreshes in the background by checking for file modifications, ensuring it stays reasonably up-to-date without constant, heavy API polling.

How It Works

1. Initialization: When enabled, the `VaultCacheService` builds an in-memory map of all `.md` files in your vault, storing their content and modification times.

2. Periodic Refresh: The cache automatically refreshes at a configurable interval (defaulting to 10 minutes). During a refresh, it only fetches content for files that are new or have been modified since the last check.

3. Proactive Updates: After a file is modified through a tool like `obsidian_update_file`, the service proactively updates the cache for that specific file, ensuring immediate consistency.

4. Search Fallback: The `obsidian_global_search` tool first attempts a live API search. If this fails, it automatically falls back to searching the in-memory cache.

Configuration

The cache is enabled by default but can be configured via environment variables:

• `OBSIDIAN_ENABLE_CACHE`: Set to `true` (default) or `false` to enable or disable the cache service.
• `OBSIDIAN_CACHE_REFRESH_INTERVAL_MIN`: Defines the interval in minutes for the periodic background refresh. Defaults to `10`.

Tools

The Obsidian MCP Server provides a suite of tools for interacting with your vault(s), callable via the Model Context Protocol.

Multi-Vault Support

All tools support an optional `vault` parameter to specify which vault to operate on:

• Default Behavior: Without `vault` parameter, tools use the first configured vault
• Specific Vault: Add `vault: "vault-id"` to target a specific vault
• Example: `obsidian_read_file(filePath="note.md", vault="work")`

_Note: All tools support comprehensive error handling, multi-vault routing, and return structured JSON responses._

License

This project is licensed under the Apache License 2.0 - see the LICENSE file for details.

Attribution

This enhanced version is based on the excellent work by cyanheads in the original obsidian-mcp-server project. All core functionality and architecture credit goes to the original author.

Enhancements in this fork:

• Multi-Vault Support: Simultaneous access to multiple Obsidian vaults with vault-specific routing
• Claude.ai Remote MCP integration and compatibility fixes
• Tailscale Funnel integration for secure remote access
• Enhanced HTTP transport layer with authentication separation (MCP_AUTH_KEY)
• Advanced task querying with Tasks plugin integration
• 5 New Advanced Tools: Periodic notes, block references, graph analysis, template system, and smart linking
• Production-ready configuration for enterprise use