Obsidian MCP Secure runs on your own machine — the client starts it, so there is no endpoint to ping. 58 installs a week from npm. Last commit 3 May 2026.
Secure MCP server for Obsidian with OWASP Top 10 controls and full audit logging.
Nothing serious here today
Today is the operative word: we check Obsidian MCP Secure every 15 minutes and re-read its code on every release. Watch it and you find out the day that stops being true.
Connect this server
This server runs on your own machine — install it with the package manager and the client starts it for you. Package name taken from the official registry entry.
claude mcp add obsidian-mcp-secure -e 'OBSIDIAN_API_KEY=<OBSIDIAN_API_KEY>' -- npx -y obsidian-mcp-secure{
"mcpServers": {
"obsidian-mcp-secure": {
"command": "npx",
"args": [
"-y",
"obsidian-mcp-secure"
],
"env": {
"OBSIDIAN_API_KEY": "<OBSIDIAN_API_KEY>"
}
}
}
}[mcp_servers.obsidian-mcp-secure]
command = "npx"
args = ["-y", "obsidian-mcp-secure"]
env = { OBSIDIAN_API_KEY = "<OBSIDIAN_API_KEY>" }{
"mcpServers": {
"obsidian-mcp-secure": {
"command": "npx",
"args": [
"-y",
"obsidian-mcp-secure"
],
"env": {
"OBSIDIAN_API_KEY": "<OBSIDIAN_API_KEY>"
}
}
}
}{
"servers": {
"obsidian-mcp-secure": {
"type": "stdio",
"command": "npx",
"args": [
"-y",
"obsidian-mcp-secure"
],
"env": {
"OBSIDIAN_API_KEY": "<OBSIDIAN_API_KEY>"
}
}
}
}Put your own value in place of
<OBSIDIAN_API_KEY> (API Key generated by Obsidian's Local REST API plugin (Settings -> Local REST API -> API Key)).
The author’s registry entry marks it as required.
Optional settings from the registry entry, left out of the block above:
OBSIDIAN_HOST (Host of the Local REST API (default: http://127.0.0.1)), OBSIDIAN_PORT (Port of the Local REST API (default: 27123)), LOG_DIR (Directory for audit logs (default: ./logs)).
Alternatives to Obsidian MCP Secure
same job, measured the same wayMCP gateway for controlled SSH access with per-client auth, command policies, and audit logging.
MCP server for Firebase — Firestore, Storage, Auth, and Cloud Logging, with schema validation.
Kubernetes MCP server: 75 tools for GKE, AKS, EKS, RBAC, audit logging, GitOps, multi-cluster.
lu.ma events MCP server with draft+confirm safety, audit logging, and prompt-injection scrubbing.…
Transparent audit proxy for MCP servers: logs every tool call, flags poisoning and rug pulls.
Permission tiers, approval gates, and audit logging for MCP servers - the server is the gatekeeper
MCP server for querying logs from observability platforms with unified search and tracing
Cordon for MCP. Security gateway with policy enforcement, audit log, and HITL approvals.
Obsidian MCP Secure — questions
Answers built from our own checks of this server.