obsidian-http-mcp

The server implements path traversal prevention, ReDoS protection (query length limit), PORT validation, type safety, and a request size limit. Soft delete is enabled by default, moving files to a trash directory. Crucially, the documentation explicitly states the server is designed for trusted networks (localhost, LAN, VPN) and does NOT include built-in authentication, rate limiting, or HTTPS. It binds to `0.0.0.0` for cross-platform compatibility, which requires a reverse proxy with authentication, rate limiting, and TLS for production or internet exposure. The strong emphasis on user responsibility for external security measures is a positive, but the lack of built-in measures limits its standalone security score.