obsidian-notebook-mcp

The system processes local files and interacts with local services (Qdrant, Ollama). File system operations (`read`, `write`, `append`, `create`) are confined to the `NOTEBOOK_PATH` and use `path.join` to prevent directory traversal. In Docker, the `ai-note-searcher` container's volume mount is `read-only`, enhancing security for indexing. However, when the `mcp-server.js` script is run locally (e.g., for Claude Desktop integration), it has write access to the configured `NOTEBOOK_PATH`. In such a setup, a malicious LLM prompt, if allowed to use file modification tools, could potentially alter or create files within the configured `NOTEBOOK_PATH`. This is a configuration-dependent risk rather than a code vulnerability, emphasizing the need for users to configure `NOTEBOOK_PATH` to a confined Obsidian vault.