obsidian-mcp-server

The server loads sensitive API keys from environment variables (OBSIDIAN_API_KEY), which is good practice. It connects to the local Obsidian Local REST API. While default SSL verification (`verifySsl: false`) is disabled by default for the Obsidian REST API client and explicitly for the Smart Connections service (`rejectUnauthorized: false`), this typically pertains to self-signed certificates in a local development environment and doesn't expose a critical external network risk as the communication is generally localhost-bound. The server itself uses standard I/O (stdio) for communication, minimizing external network attack surface. There is no evidence of `eval` usage, obfuscation, or malicious patterns. The `patch_content` tool is commendably disabled due to known upstream bugs, preventing potential data corruption. Local file system access is required for graph tools via OBSIDIAN_VAULT_PATH, which is an inherent part of its functionality.