mcp-obsidian-universal

CRITICAL SECURITY CONCERNS: The `search_notes` function directly constructs a regular expression from user-provided input (`query`), leading to a severe Regular Expression Denial of Service (ReDoS) vulnerability. A malicious or malformed regex query could freeze the server indefinitely. Furthermore, there is no authentication layer, meaning any local process can access and fully control your Obsidian vault (read, write, delete notes and folders) via the server. While it defaults to `localhost`, this still exposes the entire vault to local applications without any security checks. The `keytar` dependency is present but unused in the provided code, offering no current security benefit.