arcology

The project uses ngrok to expose local services to the public internet via an HTTPS tunnel, which inherently introduces a significant network attack surface. This risk is mitigated by requiring an `ARCOLOGY_MCP_KEY` for authentication to the MCP bridge. The `patches/mcp_obsidian/tools.py` implements a `ComplexSearchToolHandler` that passes a `JsonLogic` query directly to the `obsidian-local-rest-api`. While this server does not execute `JsonLogic` itself, it acts as a proxy, making its security dependent on the robustness of the underlying Obsidian REST API's handling of such complex queries, especially if the AI agent is compromised or malicious. No hardcoded secrets or direct `eval`/`exec` of untrusted user input within this server's Python code were found. The `DeleteFileToolHandler` requires explicit confirmation, which is a good safety measure.