MCPVault
Memory server
First committed by bitbonsai
Published in bitbonsai/mcpvault. Publisher page
1,722 GitHub stars
What it is
Universal AI bridge for Obsidian vaults - connect any MCP-compatible assistant
AutoGineer overview, from the brain’s own files
MCPVault is a universal AI bridge designed to connect any MCP-compatible assistant to a local Obsidian vault. By operating as a local stdio process, it allows AI agents to interact with markdown files without requiring an Obsidian plugin or the application to be running. It provides a comprehensive suite of 18 tools for file management, search, and metadata handling, while enforcing strict security boundaries to prevent unauthorized file access or traversal outside the vault root.
How it works
Memory model: Markdown vault
AutoGineer overview, from the brain’s own files
The system runs as a local server that accepts a vault path. It uses a filesystem service to perform operations like reading, writing, patching, and moving notes. A path filter ensures all operations remain within the vault, blocking access to sensitive directories like .obsidian or .git. It uses a frontmatter handler to manage YAML metadata while preserving document formatting, and a search service to provide token-optimized, ranked results.
| Folder | Role | Files |
|---|---|---|
| .claude | agent-config | 3 |
| .github | agent-config | 5 |
| scripts | scripts | 7 |
| skills | agent-instructions | 8 |
| src | source-code | 25 |
| .plans | folder | 2 |
| benchmarks | folder | 3 |
| deploy | folder | 1 |
| website-shibumi | folder | 124 |
The agent reads
- package.json evidence: AGENTS.md
- get_note_outline evidence: README.md
- read_note_lines evidence: README.md
- list_directory evidence: README.md
- read_multiple_notes evidence: README.md
- search_notes evidence: README.md
The agent writes
- write_note evidence: README.md
Requirements
Runtimes: Node.js >=22.12.0, Bun
Works with: Claude Code, Claude apps, OpenAI Codex, GitHub Copilot, Cursor, Gemini CLI, Google Antigravity, Kiro, OpenCode, Amp, Roo Code, Cline, JetBrains Junie, Devin (ex-Windsurf)
Set it up
This brain runs code automatically: 1 hook (claude-code), 1 script. Review .claude/settings.json, scripts/triage/bootstrap.sh before opening the folder in Claude Code. No step below turns a hook on for you.
.claude/settings.json:if [ -f .plans/next.md ]; then cat .plans/next.md && mv .plans/next.md .plans/next.prev.md; fiscripts/triage/bootstrap.sh:sh scripts/triage/bootstrap.sh
- Not scanned by AutoGineerIts dependencies are installed by npm when you run it and were not scanned by AutoGineer (4 declared). https://www.npmjs.com/package/@bitbonsai/mcpvault
First committed by bitbonsai. Published in bitbonsai/mcpvault. Licence: MIT License.
Usage
AutoGineer overview, from the brain’s own files
- Connects AI agents to local Obsidian vaults via the Model Context Protocol.
- Supports read, write, and patch operations on markdown notes.
- Provides metadata management including frontmatter and tag operations.
- Enables full-text search with BM25 reranking across vault content.
- Offers batch processing and directory listing capabilities.
- Includes a read-only mode for secure, non-destructive agent access.
- “Read my note called 'project-ideas.md'”
- The agent retrieves the content and parsed frontmatter of the specified note.
- “Create a new note with today's date”
- The agent generates a new markdown file within the vault root with the provided content and metadata.
- “List all notes with 'AI' in the title”
- The agent performs a search across the vault and returns a list of matching notes.
- “Append today's journal entry to my daily note”
- The agent updates the existing daily note by appending the new text to the end of the file.
Documentation by bitbonsai
<div align="center"> <img width="256" height="256" alt="image" src="https://github.com/user-attachments/assets/1e21d898-811b-42c2-a810-bf921dde0f58" /> </div>
MCPVault
A local MCP server that lets compatible clients read, search, and edit notes in an Obsidian vault. MCPVault works directly with vault files, restricts file operations to the configured vault root, and preserves formatting for unchanged frontmatter fields.
<div align="center">
</div>
<div align="center">
Image: GitHub Stars Image: npm version Image: npm downloads Image: GitHub Sponsors Image: Ko-Fi Image: Liberapay
</div>
Supported clients
Configuration examples are available for Claude Desktop, Claude Code, ChatGPT Desktop (Enterprise+), OpenCode, Gemini CLI, OpenAI Codex, IntelliJ IDEA 2025.1+, Cursor, Windsurf, and Ontheia. Other clients can use MCPVault if they support local stdio MCP servers.
https://github.com/user-attachments/assets/657ac4c6-1cd2-4cc3-829f-fd095a32f71c
Quick start
Install Node.js runtime:
# Download from https://nodejs.org (v22.12.0 or later) # or use a package manager like nvm, brew, apt, etc.Test the server:
If using the published package:
npx @modelcontextprotocol/inspector npx @bitbonsai/mcpvault@latest /path/to/your/vaultConfigure your AI client:
Claude Desktop - Copy this to
claude_desktop_config.json:{ "mcpServers": { "obsidian": { "command": "npx", "args": ["@bitbonsai/mcpvault@latest", "/path/to/your/vault"] } } }Claude Code - Copy this to
~/.claude.json:{ "mcpServers": { "obsidian": { "command": "npx", "args": ["@bitbonsai/mcpvault@latest", "/path/to/your/vault"], "env": {} } } }OpenCode - Copy this to
~/.config/opencode/opencode.json{ "mcp": { "obsidian": { "type": "local", "command": [ "npx", "@bitbonsai/mcpvault@latest", "/path/to/your/vault/" ], "enabled": true } } }Replace
/path/to/your/vaultwith your actual Obsidian vault path.For other platforms, see detailed configuration guides below.
Test with your AI:
"List files in my Obsidian vault"
"Read my note called 'project-ideas.md'"
"Create a new note with today's date"
To verify the connection, ask your client to list MCPVault tools or read a known note.
How it connects
An MCP client starts MCPVault as a local stdio process and passes the vault path. MCPVault exposes the same tools to each supported client, so the server is not tied to one AI provider. Obsidian does not need to be running, and no Obsidian plugin is required.
Features
AST-aware frontmatter updates preserve formatting for unchanged YAML fields.
Path checks block traversal, symlink escapes, dotfiles,
.obsidian,.git, andnode_modules.Eighteen MCP tools cover note and file operations:
File operations:
read_note,write_note,patch_note,delete_note,move_note,move_filePartial reads:
get_note_outline,read_note_linesDirectory and batch reads:
list_directory,read_multiple_notesSearch:
search_noteswith multi-word matching and BM25 rerankingMetadata and tags:
get_frontmatter,update_frontmatter,get_notes_info,get_vault_stats,manage_tags,list_all_tagsWiki links:
wiki_linkresolves names and returns alternative paths when a name is ambiguous
write_notesupports overwrite, append, and prepend modes.delete_noteandmove_filerequire matching confirmation paths.Path arguments are trimmed before validation.
Search and batch tools return compact fields by default; set
prettyPrint: truefor expanded output.The package exports TypeScript declarations and public types.
MCPVault requires no Obsidian plugin.
Prerequisites
Node.js runtime (v22.12.0 or later)
An Obsidian vault (local directory with
.md,.markdown,.txt,.base, or.canvasfiles)MCP-compatible AI client (Claude Desktop, ChatGPT Desktop, Claude Code, etc.)
Installation
For end users
npx downloads and runs the package:
npx @bitbonsai/mcpvault@latest /path/to/your/obsidian/vaultIf you omit the vault path, the server uses your current working directory as the vault root.
For developers
Clone this repository
Use the correct Node.js version:
nvm use # Uses Node 24 from .nvmrcInstall dependencies with npm:
npm install # Corepack automatically uses npm 10.9.0Test locally with MCP inspector:
npx @modelcontextprotocol/inspector npm start /path/to/your/vaultUse MCP Inspector to test the server before adding it to a client:
# Install globally for easier access
npm install -g @modelcontextprotocol/inspector
# Test with any vault
mcp-inspector npx @bitbonsai/mcpvault@latest /path/to/your/vaultUsage
Running the Server
End users:
npx @bitbonsai/mcpvault@latest
npx @bitbonsai/mcpvault@latest /path/to/your/obsidian/vault
npx @bitbonsai/mcpvault@latest ./VaultDevelopers:
npm start
npm start /path/to/your/obsidian/vault
npm start ./VaultAI Client Configuration
Claude Desktop
Add to your Claude Desktop configuration file:
Single Vault:
{
"mcpServers": {
"obsidian": {
"command": "npx",
"args": [
"@bitbonsai/mcpvault@latest",
"/Users/yourname/Documents/MyVault"
]
}
}
}Multiple Vaults:
{
"mcpServers": {
"obsidian-personal": {
"command": "npx",
"args": [
"@bitbonsai/mcpvault@latest",
"/Users/yourname/Documents/PersonalVault"
]
},
"obsidian-work": {
"command": "npx",
"args": [
"@bitbonsai/mcpvault@latest",
"/Users/yourname/Documents/WorkVault"
]
}
}
}Read-only mode:
Add --read-only after the vault path to expose only read tools. Mutating tools are omitted from discovery and rejected if called directly.
{
"mcpServers": {
"obsidian-read-only": {
"command": "npx",
"args": [
"@bitbonsai/mcpvault@latest",
"/Users/yourname/Documents/ResearchVault",
"--read-only"
]
}
}
}The CLI also accepts --read-only true and --read-only=true for configuration systems that require explicit values. Omit the option, or set it to false, to keep normal read/write access.
Default search and listing exclusions:
Repeat --exclude <subtree> to hide vault-relative folders from search_notes and list_directory in every session. Per-call excludePaths add to these defaults. Direct read and write tools remain available for excluded paths.
"args": [
"@bitbonsai/mcpvault@latest",
"/Users/yourname/Documents/ResearchVault",
"--exclude", "Archive",
"--exclude", "Snapshots/Old"
]MCPVault does not read Obsidian's .obsidian/app.json; exclusions stay explicit in the MCP server configuration.
Configuration File Locations:
macOS:
~/Library/Application Support/Claude/claude_desktop_config.jsonWindows:
C:\Users\{username}\AppData\Roaming\Claude\claude_desktop_config.jsonLinux:
~/.config/Claude/claude_desktop_config.json
You can also access this through Claude Desktop → Settings → Developer → Edit Config
ChatGPT Desktop
Requirements: ChatGPT Enterprise, Education, or Team subscription (not available for individual Plus users)
ChatGPT uses MCP through Deep Research and developer mode. Configuration is done through the ChatGPT interface:
Access ChatGPT developer mode (beta feature)
Configure MCP servers through the built-in MCP client
Create custom connectors for your organization
Note: ChatGPT Desktop's MCP integration is currently limited to enterprise subscriptions and uses a different setup process than file-based configuration.
Claude Code
Claude Code uses .claude.json configuration file:
User-scoped (recommended): Edit ~/.claude.json:
{
"mcpServers": {
"obsidian": {
"command": "npx",
"args": ["@bitbonsai/mcpvault@latest", "/path/to/your/vault"],
"env": {}
}
}
}Project-scoped: Edit .claude.json in your project or add to the projects section:
{
"projects": {
"/path/to/your/project": {
"mcpServers": {
"obsidian": {
"command": "npx",
"args": ["@bitbonsai/mcpvault@latest", "/path/to/your/vault"]
}
}
}
}
}Using Claude Code CLI:
claude mcp add obsidian --scope user npx @bitbonsai/mcpvault /path/to/your/vaultGoose Desktop
On Goose Desktop settings, click Add custom extension, and on the command field add:
npx @bitbonsai/mcpvault@latest /path/to/your/vaultOther MCP-Compatible Clients (2025)
Confirmed MCP Support:
IntelliJ IDEA 2025.1+ - Native MCP client support
Cursor IDE - Built-in MCP compatibility
Windsurf IDE - Full MCP integration
Ontheia - Self-hosted, open-source AI agent platform
Zed, Replit, Codeium, Sourcegraph - In development
Microsoft Copilot Studio - Native MCP support with one-click server connections
Most modern MCP clients use similar JSON configuration patterns. Refer to your specific client's documentation for exact setup instructions.
Examples
Ask your AI assistant about your notes:
"What files are in my Obsidian vault?"
"Read my note called 'project-ideas.md'"
"Show me all notes with 'AI' in the title"
Have your AI assistant help with note management:
"Create a new note called 'meeting-notes.md' with today's date in the frontmatter"
"Append today's journal entry to my daily note"
"Prepend an urgent task to my todo list"
"Add the tags 'project' and 'urgent' to my task note"
"List all tags in my research note"
"Remove the 'draft' tag from my completed article"
"List all markdown files in my 'Projects' folder"
"Delete the old draft note 'draft-ideas.md' (with confirmation)"
Example workflows
"Summarize my research notes tagged with 'machine-learning' from the last month"
"Update the status in my project notes to 'completed' and add today's date"
"Find notes that mention 'API design' and draft a guide from them"
"Review my untagged notes and suggest tags based on their content"
Troubleshooting
Common Issues
"command not found: npx"
Solution: Install Node.js runtime from nodejs.org
Alternative: Use global install:
npm install -g @bitbonsai/mcpvault
"File not found" when paths look correct
Cause: The server is using the wrong vault root
Solution: Either run the command from your vault directory or pass the vault path explicitly
"Permission denied" errors
Cause: Insufficient file system permissions
Solution: Ensure the vault directory is readable/writable by your user
"Path traversal not allowed"
Cause: Trying to access files outside the vault
Solution: All file paths must be relative to the vault root
AI client not recognizing the server
Check the configuration file path is correct for your OS
Ensure JSON syntax is valid (use a JSON validator)
Restart your AI client after configuration changes
Check your AI client's logs for error messages
Verify your AI client supports MCP (Model Context Protocol)
".obsidian files still showing up"
Expected: The path filter automatically excludes
.obsidian/**patternsIf still seeing them: The filter is working as designed for security
Debug Mode
Run with error logging:
npx @bitbonsai/mcpvault /path/to/vault 2>debug.logGetting Help
Open an issue on GitHub
Include your OS, Node.js version, and error messages
Provide the vault directory structure (without sensitive content)
Testing
Run the test suite:
npm testAPI Methods
read_note
Read a note from the vault with parsed frontmatter.
Request:
{
"name": "read_note",
"arguments": {
"path": "project-ideas.md",
"prettyPrint": false
}
}Compact response:
{
"fm": {
"title": "Project Ideas",
"tags": ["projects", "brainstorming"],
"created": "2023-01-15T10:30:00.000Z"
},
"content": "# Project Ideas\n\n## AI Tools\n- MCP server for Obsidian\n- Voice note transcription\n\n## Web Apps\n- Task management system"
}Response (with prettyPrint: true):
{
"fm": {
"title": "Project Ideas",
"tags": ["projects", "brainstorming"],
"created": "2023-01-15T10:30:00.000Z"
},
"content": "# Project Ideas\n\n## AI Tools\n- MCP server for Obsidian\n- Voice note transcription\n\n## Web Apps\n- Task management system"
}write_note
Write a note to the vault with optional frontmatter and write mode.
Write Modes:
overwrite(default): Replace entire file contentappend: Add content to the end of existing fileprepend: Add content to the beginning of existing file
Request (Overwrite):
{
"name": "write_note",
"arguments": {
"path": "meeting-notes.md",
"content": "# Team Meeting\n\n## Agenda\n- Project updates\n- Next milestones",
"frontmatter": {
"title": "Team Meeting Notes",
"date": "2023-12-01",
"tags": ["meetings", "team"]
},
"mode": "overwrite"
}
}Request (Append):
{
"name": "write_note",
"arguments": {
"path": "daily-log.md",
"content": "\n\n## 3:00 PM Update\n- Completed project review\n- Started new feature",
"mode": "append"
}
}Response:
{
"message": "Successfully wrote note: meeting-notes.md (mode: overwrite)"
}patch_note
Replace an exact string inside an existing note without rewriting the full file.
Request:
{
"name": "patch_note",
"arguments": {
"path": "meeting-notes.md",
"oldString": "- Next milestones",
"newString": "- Next milestones (owner: Alex)",
"replaceAll": false
}
}Response (success):
{
"success": true,
"path": "meeting-notes.md",
"message": "Successfully replaced 1 occurrence",
"matchCount": 1
}Response (multiple matches with replaceAll=false):
{
"success": false,
"path": "meeting-notes.md",
"message": "Found 3 occurrences of the string. Use replaceAll=true to replace all occurrences, or provide a more specific string to match exactly one occurrence.",
"matchCount": 3
}list_directory
List files and directories in the vault.
Note: this includes non-note filenames (for example pdf, png, jpg) so AI assistants can see vault structure, but note tools like read_note and write_note still operate on note files only (.md, .markdown, .txt, .base, .canvas).
Request:
{
"name": "list_directory",
"arguments": {
"path": "Projects",
"prettyPrint": false
}
}Compact response:
{
"dirs": ["AI-Tools", "Web-Development"],
"files": ["project-template.md", "roadmap.md"]
}delete_note
Delete a note from the vault (requires confirmation for safety).
Request:
{
"name": "delete_note",
"arguments": {
"path": "old-draft.md",
"confirmPath": "old-draft.md",
"trashMode": "local"
}
}Response (Success):
{
"success": true,
"path": "old-draft.md",
"message": "Successfully moved note to vault trash: old-draft.md"
}Trash modes:
none(default): permanent deletelocal: move to.trashinside the vault, preserving folder structuresystem: move to the OS trash/recycle bin
Response (Confirmation Failed):
{
"success": false,
"path": "old-draft.md",
"message": "Deletion cancelled: confirmation path does not match. For safety, both 'path' and 'confirmPath' must be identical."
}Confirmation: confirmPath must exactly match path before deletion proceeds.
get_frontmatter
Extract only the frontmatter from a note without reading the full content.
Request:
{
"name": "get_frontmatter",
"arguments": {
"path": "project-ideas.md",
"prettyPrint": false
}
}Compact response, returning frontmatter directly:
{
"title": "Project Ideas",
"tags": ["projects", "brainstorming"],
"created": "2023-01-15T10:30:00.000Z"
}manage_tags
Add, remove, or list tags in a note. Tags are managed in the frontmatter and inline tags are detected.
Request (List Tags):
{
"name": "manage_tags",
"arguments": {
"path": "research-notes.md",
"operation": "list"
}
}Request (Add Tags):
{
"name": "manage_tags",
"arguments": {
"path": "research-notes.md",
"operation": "add",
"tags": ["machine-learning", "ai", "important"]
}
}Request (Remove Tags):
{
"name": "manage_tags",
"arguments": {
"path": "research-notes.md",
"operation": "remove",
"tags": ["draft", "temporary"]
}
}Response:
{
"path": "research-notes.md",
"operation": "add",
"tags": ["research", "ai", "machine-learning", "important"],
"success": true,
"message": "Successfully added tags"
}search_notes
Search for notes in the vault by content or frontmatter with multi-word matching and BM25 relevance reranking.
Request:
{
"name": "search_notes",
"arguments": {
"query": "machine learning",
"limit": 5,
"searchContent": true,
"searchFrontmatter": false,
"caseSensitive": false,
"prettyPrint": false
}
}Compact response:
[
{
"p": "ai-research.md",
"t": "AI Research Notes",
"ex": "...machine learning...",
"mc": 2,
"ln": 15,
"uri": "obsidian://open?vault=MyVault&file=ai-research.md"
}
]Field names:
p= patht= titleex= excerpt (21 chars context)mc= match countln= line numberuri= Obsidian deep link for quick opening
move_note
Move or rename a note in the vault (.md, .markdown, .txt, .base, .canvas).
Request:
{
"name": "move_note",
"arguments": {
"oldPath": "drafts/article.md",
"newPath": "published/article.md",
"overwrite": false
}
}Response:
{
"success": true,
"oldPath": "drafts/article.md",
"newPath": "published/article.md",
"message": "Successfully moved note from drafts/article.md to published/article.md"
}move_file
Move or rename any file in the vault with binary-safe file operations (file-only; not recursive directory moves). For safety, this tool requires confirmation of both source and destination paths.
Request:
{
"name": "move_file",
"arguments": {
"oldPath": "Miro/attachments/Pasted image 20250812140124.png",
"newPath": "assets/images/Pasted image 20250812140124.png",
"confirmOldPath": "Miro/attachments/Pasted image 20250812140124.png",
"confirmNewPath": "assets/images/Pasted image 20250812140124.png",
"overwrite": false
}
}Response:
{
"success": true,
"oldPath": "Miro/attachments/Pasted image 20250812140124.png",
"newPath": "assets/images/Pasted image 20250812140124.png",
"message": "Successfully moved file from Miro/attachments/Pasted image 20250812140124.png to assets/images/Pasted image 20250812140124.png"
}Confirmation: confirmOldPath must match oldPath, and confirmNewPath must match newPath.
read_multiple_notes
Read multiple notes in a batch (maximum 10 files).
Request:
{
"name": "read_multiple_notes",
"arguments": {
"paths": ["note1.md", "note2.md", "note3.md"],
"includeContent": true,
"includeFrontmatter": true,
"prettyPrint": false
}
}Compact response:
{
"ok": [
{
"path": "note1.md",
"frontmatter": { "title": "Note 1" },
"content": "# Note 1\n\nContent here..."
}
],
"err": [{ "path": "note2.md", "error": "File not found" }]
}Field names:
ok= successful readserr= failed reads
update_frontmatter
Update frontmatter of a note without changing content.
Request:
{
"name": "update_frontmatter",
"arguments": {
"path": "research-note.md",
"frontmatter": {
"status": "completed",
"updated": "2025-09-23"
},
"merge": true
}
}Response:
{
"message": "Successfully updated frontmatter for: research-note.md"
}get_notes_info
Get metadata for notes without reading full content.
Request:
{
"name": "get_notes_info",
"arguments": {
"paths": ["note1.md", "note2.md"],
"prettyPrint": false
}
}Compact response, returning an array directly:
[
{
"path": "note1.md",
"size": 1024,
"modified": 1695456000000,
"hasFrontmatter": true
}
]get_vault_stats
Get high-level vault statistics without reading note contents.
Request:
{
"name": "get_vault_stats",
"arguments": {
"recentCount": 5,
"prettyPrint": false
}
}Compact response:
{
"notes": 1248,
"folders": 76,
"size": 18349210,
"recent": [
{
"path": "Daily/2026-02-27.md",
"modified": 1772188800000,
"size": 2814
}
]
}Security boundaries
MCPVault applies these checks before file operations:
Path Security
Path Traversal Protection: All file paths are validated to prevent access outside the vault
Relative Path Enforcement: Paths are normalized and restricted to the vault directory
Symbolic Link Safety: Resolved paths are checked against vault boundaries
File Filtering
Automatic Exclusions:
.obsidian,.git,node_modules, and system files are filteredExtension Whitelist: Only
.md,.markdown,.txt,.base, and.canvasfiles are accessible by defaultHidden File Protection: Dot files and system directories are automatically excluded
Content Validation
YAML Frontmatter Validation: Frontmatter is parsed and validated before writing
Function/Symbol Prevention: Dangerous JavaScript objects are blocked from frontmatter
Data Type Checking: Only safe data types (strings, numbers, arrays, objects) allowed
Best Practices
Least Privilege: Server only accesses the specified vault directory
Read-Only Mode: Run with
--read-onlyfor sensitive vaults; mutating tools are hidden and rejectedBackup Recommended: Always backup your vault before using write operations
Network Isolation: Server uses stdio transport (no network exposure)
What's NOT Protected
File Content: The server can read/write any allowed file content
Vault Structure: Directory structure is visible to AI assistants
File Metadata: Creation times, file sizes, etc. are accessible
Only grant write access to clients and conversations you trust. Use --read-only when the client does not need to modify notes.
Architecture
server.ts- MCP server entry pointsrc/cli.ts- CLI option parsing for vault path, read-only mode, and default exclusionssrc/createServer.ts- MCP tool registration, request routing, and discovery defaultssrc/frontmatter.ts- YAML frontmatter handling with gray-matter, preserving formatting and CRLF line endings; executable JavaScript frontmatter stays inert as note contentsrc/filesystem.ts- File operations with path validationsrc/pathfilter.ts- Directory and file filteringsrc/search.ts- Note search functionality with content and frontmatter supportsrc/uri.ts- Obsidian URI generation for deep linkssrc/types.ts- TypeScript type definitionsscripts/release.mjs- Repository release command with readiness checks and explicit publishing authorization
Contributing
Fork the repository
Create a feature branch:
git checkout -b feature-nameMake your changes and add tests
Ensure all tests pass:
npm testSubmit a pull request
Maintainers: run npm run release from prepared main to create the GitHub Release that triggers npm publishing. Add -- --yes for approved automation, or -- --check for a read-only preview. See RELEASING.md.
License
MIT
RELEASING.md
Releasing MCPVault
Production releases are created through GitHub Releases. Publishing a release triggers .github/workflows/publish.yml, which tests, builds, and publishes the matching package version to npm with provenance.
Never create a GitHub Release for a version already on npm, including versions published manually. That would trigger a duplicate npm publish.
1. Prepare the release in a PR
The release PR must contain every artifact users will receive:
the semver bump in
package.jsonandpackage-lock.jsonsource and tests
rebuilt
dist/from the same sourceCHANGELOG.mdwebsite release history in both
website-shibumi/src/components/UpdateCallout.tsxandwebsite-shibumi/public/index.mdany feature documentation in both browser and Markdown formats
Run the root tests, build, audit, dry-run package, and website build before merging.
2. Check release readiness
After the release PR merges, switch to clean, up-to-date main. Run:
npm run release -- --checkThe repository-only command in scripts/release.mjs reads the version from package.json and release notes from the matching CHANGELOG.md entry. It checks that local main matches GitHub, CI and CodeQL passed for that exact commit, and the npm version, GitHub Release, and tag do not already exist. Registry or GitHub errors stop the release.
This check prints the release preview without publishing anything. It does not bump versions or prepare the release PR.
3. Publish a GitHub Release
For an interactive release, run:
npm run releaseReview the version, commit, and changelog notes, then type the displayed tag to confirm. The command first creates the tag at the checked commit, then publishes its GitHub Release with notes directly from the changelog. Publishing that release triggers npm publication through GitHub Actions. Keep npm 2FA enabled; the workflow uses the package's trusted publisher configuration.
For an already approved release without a prompt, including assistant execution:
npm run release -- --yes--yes keeps every readiness check and the final checkout check. The user authorizes assistants to create GitHub Releases and monitor npm publication through trusted CI as part of approved release work. Interactive confirmation remains the default.
--check is read-only and cannot be combined with --yes. An existing release is never recreated or automatically retried.
4. Verify publication
Watch the Publish workflow and verify npm after it succeeds:
VERSION=$(node -p "require('./package.json').version")
gh run list --repo bitbonsai/mcpvault --workflow Publish --limit 1
npm view @bitbonsai/mcpvault version
(cd "$(mktemp -d)" && npx --yes "@bitbonsai/mcpvault@$VERSION" --version)Confirm the GitHub Release tag, npm version, installed CLI version, and website release copy all agree before considering the release complete.
Failure handling
npm versions are immutable. Never bump or republish the same version after a partial failure.
If the command creates the tag but GitHub Release creation fails, inspect that tag and recover the release manually. The command stops on existing tags rather than guessing whether a retry is safe.
If the workflow fails before npm publication, fix the workflow and rerun it.
If npm already shows the version, do not rerun the publish step; verify the package and repair only the missing release metadata.
npm run publish:latestis an emergency fallback, not the normal production path. It does not provide the GitHub Release-driven provenance flow.Beta publishing remains explicit through
npm run publish:beta; do not create a production GitHub Release for an unapproved beta.
239 files · 229 not served here
- .claude/settings.json
- .claude/skills/triage (not served here)
- .claude/workflows/shibumi-migration.js (not served here)
- .dockerignore (not served here)
- .github/dependabot.yml (not served here)
- .github/workflows/ci.yml (not served here)
- .github/workflows/codeql.yml (not served here)
- .github/workflows/publish.yml (not served here)
- .github/workflows/scorecard.yml (not served here)
- .gitignore (not served here)
- .npmignore (not served here)
- .nvmrc (not served here)
- .plans/INDEX.md (not served here)
- .plans/shibumi-website-migration.md (not served here)
- AGENTS.md
- ATTRIBUTION.md
- AUTOGINEER-RUNS.md
- CHANGELOG.md
- LICENSE
- MCP_SDK_V2.md
- README.md
- RELEASING.md
- SECURITY.md
- benchmarks/README.md (not served here)
- benchmarks/bench-v1-client.mjs (not served here)
- benchmarks/bench-v2-client.mjs (not served here)
- bun.lock (not served here)
- debug-server.js (not served here)
- deploy/README.md (not served here)
- dist/server.d.ts (not served here)
- dist/server.d.ts.map (not served here)
- dist/server.js (not served here)
- dist/src/cli.d.ts (not served here)
- dist/src/cli.d.ts.map (not served here)
- dist/src/cli.js (not served here)
- dist/src/createServer.d.ts (not served here)
- dist/src/createServer.d.ts.map (not served here)
- dist/src/createServer.js (not served here)
- dist/src/filesystem.d.ts (not served here)
- dist/src/filesystem.d.ts.map (not served here)
- dist/src/filesystem.js (not served here)
- dist/src/frontmatter.d.ts (not served here)
- dist/src/frontmatter.d.ts.map (not served here)
- dist/src/frontmatter.js (not served here)
- dist/src/index.d.ts (not served here)
- dist/src/index.d.ts.map (not served here)
- dist/src/index.js (not served here)
- dist/src/pathfilter.d.ts (not served here)
- dist/src/pathfilter.d.ts.map (not served here)
- dist/src/pathfilter.js (not served here)
- dist/src/search.d.ts (not served here)
- dist/src/search.d.ts.map (not served here)
- dist/src/search.js (not served here)
- dist/src/types.d.ts (not served here)
- dist/src/types.d.ts.map (not served here)
- dist/src/types.js (not served here)
- dist/src/uri.d.ts (not served here)
- dist/src/uri.d.ts.map (not served here)
- dist/src/uri.js (not served here)
- dist/src/wikilink/index.d.ts (not served here)
- dist/src/wikilink/index.d.ts.map (not served here)
- dist/src/wikilink/index.js (not served here)
- dist/src/wikilink/resolveWikiLink.d.ts (not served here)
- dist/src/wikilink/resolveWikiLink.d.ts.map (not served here)
- dist/src/wikilink/resolveWikiLink.js (not served here)
- dist/src/wikilink/wikiLinkTool.d.ts (not served here)
- dist/src/wikilink/wikiLinkTool.d.ts.map (not served here)
- dist/src/wikilink/wikiLinkTool.js (not served here)
- package-lock.json (not served here)
- package.json (not served here)
- scripts/release.mjs (not served here)
- scripts/release.test.ts (not served here)
- scripts/ship.ts (not served here)
- scripts/triage/README.md (not served here)
- scripts/triage/bootstrap.sh (not served here)
- scripts/triage/prompt.md (not served here)
- scripts/triage/run.sh (not served here)
- server.ts (not served here)
- shibumi-server.json (not served here)
- skills/obsidian/SKILL.md (not served here)
- skills/obsidian/resources/git-sync.md (not served here)
- skills/obsidian/resources/obsidian-conventions.md (not served here)
- skills/obsidian/resources/tool-patterns.md (not served here)
- skills/triage/SKILL.md (not served here)
- skills/triage/resources/comment-policy.md (not served here)
- skills/triage/resources/finding-rules.md (not served here)
- skills/triage/resources/state-schema.md (not served here)
- src/atomic-write.test.ts (not served here)
- src/cli.test.ts (not served here)
- src/cli.ts (not served here)
- src/createServer.test.ts (not served here)
- src/createServer.ts (not served here)
- src/filesystem.test.ts (not served here)
- src/filesystem.ts (not served here)
- src/frontmatter.test.ts (not served here)
- src/frontmatter.ts (not served here)
- src/index.ts (not served here)
- src/integration.test.ts (not served here)
- src/pathfilter.test.ts (not served here)
- src/pathfilter.ts (not served here)
- src/protocol-version.test.ts (not served here)
- src/search.test.ts (not served here)
- src/search.ts (not served here)
- src/shutdown.test.ts (not served here)
- src/system-trash.test.ts (not served here)
- src/types.ts (not served here)
- src/uri.test.ts (not served here)
- src/uri.ts (not served here)
- src/wikilink/index.ts (not served here)
- src/wikilink/resolveWikiLink.test.ts (not served here)
- src/wikilink/resolveWikiLink.ts (not served here)
- src/wikilink/wikiLinkTool.ts (not served here)
- tsconfig.build.json (not served here)
- tsconfig.json (not served here)
- vitest.config.ts (not served here)
- website-shibumi/.gitignore (not served here)
- website-shibumi/Containerfile (not served here)
- website-shibumi/bun.lock (not served here)
- website-shibumi/compose.yaml (not served here)
- website-shibumi/package.json (not served here)
- website-shibumi/public/apple-touch-icon.png (not served here)
- website-shibumi/public/benchmarks.md (not served here)
- website-shibumi/public/demo.md (not served here)
- website-shibumi/public/favicon-16x16.png (not served here)
- website-shibumi/public/favicon-32x32.png (not served here)
- website-shibumi/public/favicon.svg (not served here)
- website-shibumi/public/features.md (not served here)
- website-shibumi/public/how-it-works.md (not served here)
- website-shibumi/public/index.md (not served here)
- website-shibumi/public/install.md (not served here)
- website-shibumi/public/llm.txt (not served here)
- website-shibumi/public/mcp-obsidian-1-min.mp4 (not served here)
- website-shibumi/public/obsidian-logo.svg (not served here)
- website-shibumi/public/og-image.jpg (not served here)
- website-shibumi/public/site.webmanifest (not served here)
- website-shibumi/public/skill.md (not served here)
- website-shibumi/public/version.json (not served here)
- website-shibumi/public/video-poster-small.webp (not served here)
- website-shibumi/public/video-poster.jpg (not served here)
- website-shibumi/public/video-poster.webp (not served here)
- website-shibumi/scripts/dev-mock.ts (not served here)
- website-shibumi/server.ts (not served here)
- website-shibumi/src/app.tsx (not served here)
- website-shibumi/src/client/alpine.ts (not served here)
- website-shibumi/src/client/alpinejs-csp.d.ts (not served here)
- website-shibumi/src/client/bench-reveal.ts (not served here)
- website-shibumi/src/client/confetti.ts (not served here)
- website-shibumi/src/client/fade-in-observer.ts (not served here)
- website-shibumi/src/client/height-transition.ts (not served here)
- website-shibumi/src/client/interactive-demo.ts (not served here)
- website-shibumi/src/client/nav.ts (not served here)
- website-shibumi/src/client/newsletter.ts (not served here)
- website-shibumi/src/client/terminal.ts (not served here)
- website-shibumi/src/client/theme.ts (not served here)
- website-shibumi/src/client/updates-callout.ts (not served here)
- website-shibumi/src/components/BackgroundWatermark.tsx (not served here)
- website-shibumi/src/components/BenchmarkCharts.tsx (not served here)
- website-shibumi/src/components/BrandMark.tsx (not served here)
- website-shibumi/src/components/ComparisonTable.tsx (not served here)
- website-shibumi/src/components/FAQ.tsx (not served here)
- website-shibumi/src/components/FeatureCard.tsx (not served here)
- website-shibumi/src/components/FeatureGrid.tsx (not served here)
- website-shibumi/src/components/Footer.tsx (not served here)
- website-shibumi/src/components/Hero.tsx (not served here)
- website-shibumi/src/components/HowItWorks.tsx (not served here)
- website-shibumi/src/components/InteractiveDemo.tsx (not served here)
- website-shibumi/src/components/Nav.tsx (not served here)
- website-shibumi/src/components/NewsletterSignup.tsx (not served here)
- website-shibumi/src/components/ResponseRenderer.tsx (not served here)
- website-shibumi/src/components/SkillsContent.tsx (not served here)
- website-shibumi/src/components/SpecPreviewCallout.tsx (not served here)
- website-shibumi/src/components/Terminal.tsx (not served here)
- website-shibumi/src/components/ThemeToggle.tsx (not served here)
- website-shibumi/src/components/UpdateCallout.tsx (not served here)
- website-shibumi/src/components/icons.tsx (not served here)
- website-shibumi/src/emails/welcome.html (not served here)
- website-shibumi/src/layouts/Layout.tsx (not served here)
- website-shibumi/src/lib/client-bundle.ts (not served here)
- website-shibumi/src/lib/content-negotiation.ts (not served here)
- website-shibumi/src/lib/csp.ts (not served here)
- website-shibumi/src/lib/highlight.ts (not served here)
- website-shibumi/src/lib/shutdown.ts (not served here)
- website-shibumi/src/lib/version.ts (not served here)
- website-shibumi/src/pages/Benchmarks.tsx (not served here)
- website-shibumi/src/pages/Demo.tsx (not served here)
- website-shibumi/src/pages/Features.tsx (not served here)
- website-shibumi/src/pages/Home.tsx (not served here)
- website-shibumi/src/pages/HowItWorks.tsx (not served here)
- website-shibumi/src/pages/Install.tsx (not served here)
- website-shibumi/src/pages/Skill.tsx (not served here)
- website-shibumi/src/routes/benchmarks.tsx (not served here)
- website-shibumi/src/routes/client.ts (not served here)
- website-shibumi/src/routes/demo.tsx (not served here)
- website-shibumi/src/routes/downloads.ts (not served here)
- website-shibumi/src/routes/features.tsx (not served here)
- website-shibumi/src/routes/home.tsx (not served here)
- website-shibumi/src/routes/how-it-works.tsx (not served here)
- website-shibumi/src/routes/install.tsx (not served here)
- website-shibumi/src/routes/seo.ts (not served here)
- website-shibumi/src/routes/skill.tsx (not served here)
- website-shibumi/src/routes/subscribe.ts (not served here)
- website-shibumi/src/routes/unsubscribe.ts (not served here)
- website-shibumi/src/routes/video.ts (not served here)
- website-shibumi/src/styles/benchmarks.css (not served here)
- website-shibumi/src/styles/demo.css (not served here)
- website-shibumi/src/styles/features.css (not served here)
- website-shibumi/src/styles/home.css (not served here)
- website-shibumi/src/styles/how-it-works.css (not served here)
- website-shibumi/src/styles/install.css (not served here)
- website-shibumi/src/styles/shared.css (not served here)
- website-shibumi/src/styles/skill.css (not served here)
- website-shibumi/test/client/fade-in-observer.test.ts (not served here)
- website-shibumi/test/client/height-transition.test.ts (not served here)
- website-shibumi/test/client/interactive-demo.test.ts (not served here)
- website-shibumi/test/client/nav.test.ts (not served here)
- website-shibumi/test/client/newsletter.test.ts (not served here)
- website-shibumi/test/client/terminal.test.ts (not served here)
- website-shibumi/test/client/theme.test.ts (not served here)
- website-shibumi/test/client/updates-callout.test.ts (not served here)
- website-shibumi/test/integration/shutdown.test.ts (not served here)
- website-shibumi/test/lib/highlight.test.ts (not served here)
- website-shibumi/test/lib/shutdown.test.ts (not served here)
- website-shibumi/test/routes/app.test.ts (not served here)
- website-shibumi/test/routes/client.test.ts (not served here)
- website-shibumi/test/routes/csp.test.ts (not served here)
- website-shibumi/test/routes/demo.test.tsx (not served here)
- website-shibumi/test/routes/downloads.test.ts (not served here)
- website-shibumi/test/routes/features.test.tsx (not served here)
- website-shibumi/test/routes/home.test.tsx (not served here)
- website-shibumi/test/routes/how-it-works.test.tsx (not served here)
- website-shibumi/test/routes/install.test.tsx (not served here)
- website-shibumi/test/routes/seo.test.ts (not served here)
- website-shibumi/test/routes/shell.test.tsx (not served here)
- website-shibumi/test/routes/skill.test.tsx (not served here)
- website-shibumi/test/routes/styles.test.ts (not served here)
- website-shibumi/test/routes/subscribe.test.ts (not served here)
- website-shibumi/test/routes/unsubscribe.test.ts (not served here)
- website-shibumi/test/routes/video.test.ts (not served here)
- website-shibumi/tsconfig.json (not served here)
Advantages
- Preserves existing YAML frontmatter formatting during updates. evidence: README.md
- Enforces strict path security to prevent traversal outside the vault root. evidence: README.md
- Works without requiring the Obsidian application to be running. evidence: README.md
Limitations
- Requires Node.js runtime (v22.12.0 or later) to operate. evidence: README.md
- Destructive operations like delete or move require explicit path confirmation. evidence: README.md
- Does not read Obsidian's internal app.json configuration for exclusions. evidence: README.md
Security
Risk level: Medium risk
This brain runs
Hooks (1)
.claude/settings.json(SessionStart):if [ -f .plans/next.md ]; then cat .plans/next.md && mv .plans/next.md .plans/next.prev.md; fi
Agent instructions that run or fetch something (36)
AGENTS.md:npm run build # Compile TypeScript to dist/AGENTS.md:npm test # Run test suite (Vitest)AGENTS.md:npm run test:watch # Tests in watch modeAGENTS.md:npm start /path/vault # Run server locally with tsxAGENTS.md:npm test -- path/to/test.test.tsAGENTS.md:npm test -- -t "test name pattern"AGENTS.md:npm run publish:dry # Dry runAGENTS.md:npm run publish:beta # Explicit beta publishAGENTS.md:npm run website # Start Astro dev server with Bun (http://localhost:4321)AGENTS.md:npx @modelcontextprotocol/inspector npm start /path/to/vaultAGENTS.md:Every src change needs `npm run build` + commit dist in the SAME change;skills/obsidian/SKILL.md:Run a **preflight** before changing anything:skills/obsidian/SKILL.md:`git config user.name` and `git config user.email` are setskills/obsidian/SKILL.md:Try `git pull --rebase` now?· uses the networkskills/obsidian/SKILL.md:`git add -A`skills/obsidian/SKILL.md:`git commit -m "vault sync: YYYY-MM-DD HH:mm"` (skip commit if no changes)skills/obsidian/SKILL.md:`git pull --rebase`· uses the networkskills/obsidian/SKILL.md:`git push`· uses the networkskills/obsidian/SKILL.md:Explain what failed and what user should run next.skills/obsidian/SKILL.md:Run a **preflight** before first CLI use:skills/obsidian/SKILL.md:Otherwise run `obsidian vaults`, match the MCP vault path to a registered vault, and use its registered name.skills/obsidian/SKILL.md:Run `obsidian help` for the full command reference.skills/triage/SKILL.md:One run = gather → load state → triage → fan-out fix → persist → spill.skills/triage/SKILL.md:If missing, run `scripts/triage/bootstrap.sh` first, it scaffolds `state.json`, `inbox.md`, `runs/`, and bootstraps `voice.md` from past comments.skills/triage/SKILL.md:# CI failures since last runskills/triage/SKILL.md:gh run list --status failure --created ">=$SINCE" --json databaseId,name,headSha,conclusion,urlskills/triage/SKILL.md:gh run view <id> --log-failedskills/triage/SKILL.md:git log --since="$SINCE" --pretty='%h %s %an'skills/triage/SKILL.md:Only findings with no candidate PR proceed to a new fix, up to the per-run cap in `finding-rules.md`.skills/triage/SKILL.md:git worktree add ../mcpvault-triage-<id> -b triage/<id>skills/triage/SKILL.md:Check the draft against the project skills and existing tests, then run in the worktree:skills/triage/SKILL.md:npm ci && npm test && npm run buildskills/triage/SKILL.md:Clean up green worktrees after the PR is open: `git worktree remove ../mcpvault-triage-<id>`.skills/triage/SKILL.md:Update `.triage/state.json`: set `last_run` to now, append an `attempts` entry per touched finding (run date, result, note, pr), update `status`, `last_seen`, and `pr`.skills/triage/SKILL.md:Write the per-run log to `.triage/runs/<date>.md`.skills/triage/SKILL.md:Respect the per-run finding cap;
MCP servers (7)
README.md(obsidian):npx @bitbonsai/mcpvault@latest /path/to/your/vaultREADME.md(obsidian):npx @bitbonsai/mcpvault@latest /path/to/your/vaultREADME.md(obsidian):npx @bitbonsai/mcpvault@latest /Users/yourname/Documents/MyVaultREADME.md(obsidian-personal):npx @bitbonsai/mcpvault@latest /Users/yourname/Documents/PersonalVaultREADME.md(obsidian-work):npx @bitbonsai/mcpvault@latest /Users/yourname/Documents/WorkVaultREADME.md(obsidian-read-only):npx @bitbonsai/mcpvault@latest /Users/yourname/Documents/ResearchVault --read-onlyREADME.md(obsidian):npx @bitbonsai/mcpvault@latest /path/to/your/vault
Install scripts (1)
scripts/triage/bootstrap.sh:sh scripts/triage/bootstrap.sh
- Medium risk: runs-mcp-server-unpinned-runner (README.md:50)
- Medium risk: runs-mcp-server-unpinned-runner (README.md:63)
- Medium risk: runs-mcp-server-unpinned-runner (README.md:203)
- Medium risk: runs-mcp-server-unpinned-runner (README.md:219)
- Medium risk: runs-mcp-server-unpinned-runner (README.md:219)
- Medium risk: runs-mcp-server-unpinned-runner (README.md:244)
- Medium risk: runs-mcp-server-unpinned-runner (README.md:302)
- Medium risk: runs-instruction-instruction-network (skills/obsidian/SKILL.md:94)
- Medium risk: runs-instruction-instruction-network (skills/obsidian/SKILL.md:99)
- Medium risk: runs-instruction-instruction-network (skills/obsidian/SKILL.md:100)
- Low risk: scripts-present (scripts/triage/bootstrap.sh)
Attribution and licence
- First committed by
bitbonsai
- Declared authors
- bitbonsai (declared in package.json)
- Publisher
- Mauricio Wolff (Community)
- Source
- bitbonsai/mcpvault · commit 2e9deb9
- Licence
- MIT License (files served here)
- ATTRIBUTION.md (written by AutoGineer)
- Synced
- Contributors
- bitbonsai, mvanhorn
AutoGineer is not affiliated with or endorsed by bitbonsai.
Install from source
229 of its files are not served here, so there is no ZIP. bitbonsai/mcpvault at 2e9deb9