arcology

The project uses environment variables for all sensitive information (Obsidian API key, Arcology MCP key, ngrok authtoken), mitigating hardcoded secrets. It implements bearer token authentication for the MCP Bridge, which is critical for securing the exposed API. ngrok is used to tunnel local services, inherently exposing them to the internet, but this is explicitly part of the design for AI agent access. The exposed Obsidian tools (read, write, delete, search, list files, patch content, periodic notes) provide significant control over the user's Obsidian vault; compromise of the ARCOLOGY_MCP_KEY would grant powerful access. Input validation appears reasonable through Pydantic models and JSON Schema definitions for tools, reducing direct injection risks.