obsidian-mcp-server

The plugin exposes powerful file system operations (read, write, edit, delete files/folders) via a local SSE-based MCP server. While path traversal is explicitly prevented for `list_files` and operations are generally confined to the Obsidian vault via `normalizePath` and `app.vault` API, a compromised external client or accidental network exposure of the local server could lead to unauthorized data modification or loss. The presence of `@ts-nocheck` in core files indicates potential for unchecked type-related vulnerabilities, exacerbated by the developer's self-admitted limited TypeScript proficiency in the `README`. Users must ensure only trusted clients interact with the server and be aware of the implications of enabling powerful tools.