Mcpvault MCP Server

by bitbonsai• 1.7k•• Scanned•Claim this listing•Request removal
Other

A lightweight Model Context Protocol (MCP) server for safe Obsidian vault access

Mcpvault is an open-source mcp server by bitbonsai, written mainly in TypeScript, with 1,708 GitHub stars and the MIT license. Its code was last updated Nov 1, 2026. The latest npm release is @bitbonsai/mcpvault 0.18.4, published Nov 14, 2026, with 10,545 downloads last week.

Scan summary: scanned Nov 5, 2026 at commit 1c68c8a. Seen able to read or write files. 2 published advisories for its package. Scan policy

aboutREADMEsecurityreviews

How to install Mcpvault

Built from the start command in the project's README: npx @bitbonsai/mcpvault@latest /path/to/your/vault. Check the README for required keys or settings.

Claude Code · Terminal
claude mcp add mcpvault -- npx @bitbonsai/mcpvault@latest /path/to/your/vault
Claude Desktop · claude_desktop_config.json
{
  "mcpServers": {
    "mcpvault": {
      "command": "npx",
      "args": [
        "@bitbonsai/mcpvault@latest",
        "/path/to/your/vault"
      ]
    }
  }
}
Cursor · .cursor/mcp.json
{
  "mcpServers": {
    "mcpvault": {
      "command": "npx",
      "args": [
        "@bitbonsai/mcpvault@latest",
        "/path/to/your/vault"
      ]
    }
  }
}
VS Code · Terminal
code --add-mcp '{"name":"mcpvault","command":"npx","args":["@bitbonsai/mcpvault@latest","/path/to/your/vault"]}'

What Mcpvault can touch

  • Run shell commandsNot seen in this scan
  • Run dynamic codeNot seen in this scan
  • Read or write filesListed as a tool: list_directory
  • Read environment and secretsNot seen in this scan
  • Control a web browserNot seen in this scan
  • Connect to databasesNot seen in this scan
  • Read or send messagesNot seen in this scan
  • Touch money or tradingNot seen in this scan
  • Connect to the internetNo connections seen while running

"Not seen" means our checks did not find it, and the tool may still do it. Covers commit 1c68c8a, Nov 5, 2026. See the scan policy.

Before you install Mcpvault

AgenticMart scanned Mcpvault on Nov 5, 2026 with automated checks for hidden code, known-malicious packages, leaked secrets and vulnerable dependencies. The result covers one commit under our scan policy, so review what access you give it and check any advisories shown here.

What it can access

  • An MCP server is a program your AI app starts and talks to. A local one runs with your user's permissions: it can see the files, environment variables and network your account can.

Before you install

  1. Pin the version you reviewed instead of always installing the latest release.
  2. Read the tool list or scripts before the first run, and keep approval prompts on for actions that write, send or delete.
  • Maintained by bitbonsai on GitHub, 1,708 stars and 133 forks. Popularity is not proof of safety.
  • Last code change: Nov 1, 2026.
  • Open-source license: MIT.
Read the scan reportWhat our scan checks

Published advisories for @bitbonsai/mcpvault

From the OSV database, for this npm package. Check that your installed version is past any fix.

  • CVE-2026-57442MCPVault: PathFilter restricted directories (.git/.obsidian/node_modules) only denied at vault root, not nestedFixed in 0.11.5.
  • CVE-2026-57441MCPVault: PathFilter restricted-directory deny-list bypass via case and trailing dot/space equivalenceFixed in 0.11.4.

Tools Mcpvault exposes (18)

Listed by the server itself during our scan of commit 1c68c8a.

  • read_note

    Read a note from the Obsidian vault

  • write_note

    Write a note to the Obsidian vault

  • patch_note

    Efficiently update part of a note by replacing a specific string. This is more efficient than rewriting the entire note for small changes.

  • list_directory

    List files and directories in the vault (includes non-note filenames, while read/write tools remain note-only)

  • delete_note

    Delete a note from the Obsidian vault (requires confirmation). Supports permanent delete, vault trash, or system trash.

  • search_notes

    Search for notes in the vault by content or frontmatter

  • move_note

    Move or rename a note in the vault

  • move_file

    Move or rename any file in the vault (binary-safe, file-only, requires confirmation)

  • read_multiple_notes

    Read multiple notes in a batch (max 10 files)

  • update_frontmatter

    Update frontmatter of a note without changing content

  • get_notes_info

    Get metadata for notes without reading full content

  • get_frontmatter

    Extract frontmatter from a note without reading the content

  • manage_tags

    Add, remove, or list tags in a note

  • get_vault_stats

    Get vault statistics including total notes, folders, size, and recently modified files. Useful for understanding vault scope before batch operations.

  • list_all_tags

    List all tags across the vault with occurrence counts. Returns both frontmatter tags and inline #hashtags, deduplicated and sorted by frequency. Useful for discovering existing tags before creating or organizing notes.

  • wiki_link

    Read an Obsidian wiki link. Accepts the same syntax as Obsidian: [[Document Name]] or [[Document Name|Display Text]], including table-authored escapes like [[Document Name\|Display]] and path-qualified links like [[folder/Document Name]]. A #fragment suffix in the input is ignored. Searches the vaul

  • get_note_outline

    Get the heading structure of a note without reading its full content. Returns headings with level, text, and line number. Use this first to navigate large notes efficiently, then call read_note_lines to read only the section you need.

  • read_note_lines

    Read a specific line range from a note. Use after get_note_outline to read only the section you need instead of the full file.

Mcpvault is an open-source mcp server by bitbonsai, written mainly in TypeScript. A lightweight Model Context Protocol (MCP) server for safe Obsidian vault access

At a glance

Stars
1.7k
Forks
133
Language
TypeScript
License
MIT
Created
Sep 2025
Last update
Nov 1, 2026
Type
MCP Server
Price
Free

Questions about Mcpvault

What is Mcpvault?

A lightweight Model Context Protocol (MCP) server for safe Obsidian vault access

Who maintains Mcpvault?

Mcpvault is maintained by bitbonsai on GitHub (bitbonsai/mcpvault). AgenticMart lists it from public repository data.

Is Mcpvault safe to use?

AgenticMart scanned Mcpvault on Nov 5, 2026 with automated checks for hidden code, known-malicious packages, leaked secrets and vulnerable dependencies. The result covers one commit under our scan policy, so review what access you give it and check any advisories shown here.

What license does Mcpvault use?

It is published under the MIT license.

Mcpvault alternatives

View more →

Similar mcp servers in Other, ranked by GitHub stars. Compare licence, recent activity and scan status before you choose.

NameStarsLicenceLast updatedScan
Mcpvault (this page)
bitbonsai
1.7kMITNov 1, 2026Scanned, no flagged issues
Github MCP Server
github
34kMITOct 30, 2026Scanned, no flagged issues
Fastapi MCP
tadata-org
12kMITNov 24, 2025Scanned, no flagged issues
GhidraMCP
LaurieWired
12kApache-2.0Oct 10, 2026Scanned, no flagged issues
MCP Go
mark3labs
9.2kMITOct 30, 2026Scanned, no flagged issues
Git MCP
idosal
8.5kApache-2.0May 8, 2026Scanned, no flagged issues