Loading…
Standalone MCP server for Obsidian vaults — hybrid search, notes & files, memory, tasks, OAuth 2.1
Vault Cortex is an MCP server entry in ChatHome Skills, sourced from Official MCP Registry and scored 78/100. As a Model Context Protocol server, it exposes tools that MCP-compatible LLM clients such as Claude, Cursor, and Copilot can call directly, extending an agent's reach beyond its built-in capabilities. ChatHome Skills discovered this entry through its daily ingest of official registries and GitHub discovery queries, and re-verifies repository facts, freshness signals, and install metadata on every run. The quality score weighs official-registry presence, a working install command, license clarity, GitHub star trajectory, and repository freshness — the full formula is on the Sources page. The install command above is ready to copy. Review the last-pushed date and repository status before adding Vault Cortex to a production agent workflow; the snapshot facts below are point-in-time values from the most recent ingest.
docker run -i --rm ghcr.io/aliasunder/vault-cortex:0.55.3Review the upstream source before running this command.
{
"_meta": {
"io.modelcontextprotocol.registry/official": {
"status": "active",
"isLatest": true,
"updatedAt": "2026-10-24T23:19:44.419169Z",
"publishedAt": "2026-10-24T23:19:44.419169Z",
"statusChangedAt": "2026-10-24T23:19:44.419169Z"
}
},
"server": {
"name": "io.github.aliasunder/vault-cortex",
"title": "Vault Cortex",
"$schema": "https://static.modelcontextprotocol.io/schemas/2025-12-11/server.schema.json",
"version": "0.55.3",
"packages": [
{
"transport": {
"url": "http://localhost:8000/mcp",
"type": "streamable-http",
"headers": [
{
"name": "Authorization",
"value": "Bearer {MCP_AUTH_TOKEN}",
"isSecret": true,
"variables": {
"MCP_AUTH_TOKEN": {
"isSecret": true,
"isRequired": true,
"description": "Bearer token for MCP client authentication. Generate with: openssl rand -hex 32"
}
},
"isRequired": true,
"description": "Bearer token used by the MCP client. Must match the MCP_AUTH_TOKEN env var passed to the container."
}
]
},
"identifier": "ghcr.io/aliasunder/vault-cortex:0.55.3",
"runtimeHint": "docker",
"registryType": "oci",
"runtimeArguments": [
{
"name": "-p",
"type": "named",
"value": "8000:8000",
"description": "Publish the container's port 8000 on the host."
},
{
"name": "-v",
"type": "named",
"value": "{VAULT_PATH}:/vault:rw",
"variables": {
"VAULT_PATH": {
"format": "filepath",
"isRequired": true,
"description": "Absolute path to your Obsidian vault on the host machine."
}
},
"isRequired": true,
"description": "Bind-mount your Obsidian vault into the container at /vault."
},
{
"name": "-v",
"type": "named",
"value": "vault-cortex-data:/data",
"description": "Named volume for persistent state under /data — search index, OAuth token DB, and any log files. Keeps OAuth sessions alive across container restarts."
}
],
"environmentVariables": [
{
"name": "MCP_AUTH_TOKEN",
"isSecret": true,
"isRequired": true,
"description": "Bearer token for MCP client authentication. Must match the Authorization header sent by clients. Generate with: openssl rand -hex 32"
},
{
"name": "PUBLIC_URL",
"default": "http://localhost:8000",
"description": "Public URL clients use to reach this server. Used as the OAuth issuer URL in discovery metadata. Override when exposing the server outside localhost or on a non-default port."
},
{
"name": "EMBEDDING_ENABLED",
"default": "true",
"description": "Enable or disable the embedding pipeline. When false, no ONNX model is downloaded, no vector tables are created, and search uses FTS5 only."
},
{
"name": "RERANK_MODE",
"choices": [
"blended",
"none"
],
"default": "blended",
"description": "Cross-encoder reranking mode: blended (position-aware score blending after RRF fusion) or none (skip reranking). Only takes effect when EMBEDDING_ENABLED is true."
},
{
"name": "WINDOWS_MODE",
"default": "false",
"description": "Windows bind-mount mode: enables filesystem polling for the file watcher and rename-based moves across the Docker Desktop/WSL2 bridge. Set to true when the vault lives on a Windows drive."
},
{
"name": "MEMORY_ENABLED",
"default": "true",
"description": "Enable or disable the structured memory layer. When false, memory tools are hidden, bootstrap is skipped, and server metadata omits memory references."
},
{
"name": "FILE_TOOLS_ENABLED",
"default": "true",
"description": "Enable or disable file tools (vault_read_file, vault_list_files). When false, file tools are hidden and server metadata omits file tool references."
},
{
"name": "READONLY_MODE",
"default": "false",
"description": "Run the server read-only: every vault-writing tool is hidden, the memory folder is not auto-created, and server metadata omits write references."
},
{
"name": "DISABLED_TOOLS",
"description": "Hide individual tools by name, comma-separated. Subtractive only — it cannot re-enable a tool another setting hides; an unknown tool name stops the server at startup."
},
{
"name": "MEMORY_DIR",
"default": "About Me",
"description": "Vault folder for structured memory files (About Me-style notes). Memory tools are hidden when MEMORY_ENABLED is false, but this value still feeds the defaults for PROTECTED_PATHS and ORPHAN_EXCLUDE_FOLDERS."
},
{
"name": "DAILY_NOTES_FOLDER",
"default": "Daily Notes",
"description": "Vault folder for daily notes. Overrides the folder configured in Obsidian's daily-notes plugin. When unset, read from the vault's .obsidian/daily-notes.json (an empty folder there follows Obsidian's new-note location), falling back to \"Daily Notes\" when that file is missing or unreadable. Set to / for the vault root."
},
{
"name": "DAILY_NOTES_FORMAT",
"default": "YYYY-MM-DD",
"description": "Filename date format for daily notes (Moment.js tokens). Overrides the format configured in Obsidian's daily-notes plugin. When unset, read from the vault's .obsidian/daily-notes.json, falling back to \"YYYY-MM-DD\"."
},
{
"name": "TRUST_PROXY_HOPS",
"default": "0",
"description": "Number of trusted reverse-proxy hops used to derive the client IP from X-Forwarded-For for OAuth rate limiting and request logs. With 0, injected forwarding headers are ignored."
},
{
"name": "TRUST_FORWARDED_HOPS",
"default": "0",
"description": "How many entries from the end of the RFC 7239 Forwarded header's for= list to count to reach the client IP for OAuth rate limiting and request logs. 0 ignores the header; 1 when the proxy in front writes it (e.g. AWS API Gateway); 2 when a CDN fronts that proxy and is the only way to reach it."
},
{
"name": "TZ",
"default": "UTC",
"description": "IANA timezone for timestamps and daily note resolution."
},
{
"name": "LOG_LEVEL",
"choices": [
"debug",
"info",
"warn",
"error"
],
"default": "info",
"description": "Logging verbosity."
},
{
"name": "LOG_DIR",
"format": "filepath",
"description": "Directory for log files that survive container re-creation. The container's own log is always written but discarded when the container is recreated; date-stamped files under LOG_DIR persist on the data volume. Default: /data/logs (remote image), $STORAGE_ROOT/data/logs (single-volume mode), none (local image). none keeps only the container log."
},
{
"name": "LOG_RETENTION_DAYS",
"format": "number",
"default": "90",
"description": "Days to keep log files before automatic cleanup on startup; only applies when LOG_DIR is a path."
},
{
"name": "PROTECTED_PATHS",
"description": "Comma-separated vault folder names blocked from vault_delete_note and vault_move_note. Default: MEMORY_DIR plus the daily notes folder, read from DAILY_NOTES_FOLDER or .obsidian/daily-notes.json (default Daily Notes; none when that setting is the vault root or empty). When set, overrides the default entirely."
},
{
"name": "ORPHAN_EXCLUDE_FOLDERS",
"description": "Comma-separated vault folder names excluded from vault_find_orphans. Default: the daily notes folder, \"Templates\", and MEMORY_DIR. DAILY_NOTES_FOLDER wins; otherwise .obsidian/daily-notes.json is read per query (fallback \"Daily Notes\"; no daily folder when that setting is the vault root or empty). When set, replaces the defaults entirely. Set to a comma (,) to exclude nothing; an empty value uses the defaults."
},
{
"name": "SERVICE_DOCUMENTATION_URL",
"default": "https://github.com/aliasunder/vault-cortex",
"description": "Override the OAuth service documentation URL exposed via discovery metadata."
},
{
"name": "MAX_FILE_BYTES",
"format": "number",
"default": "52428800",
"description": "Largest file vault_read_file will read, in bytes. Reading a larger file returns an error instead of content."
},
{
"name": "MAX_IMAGE_OUTPUT_BYTES",
"format": "number",
"default": "49152",
"description": "Byte budget for images returned by vault_read_file, in binary bytes before base64 encoding. Images exceeding the budget are downscaled/recompressed server-side to fit; raise for clients that accept larger tool responses."
},
{
"name": "MAX_PDF_RENDER_PAGES",
"format": "number",
"default": "5",
"description": "Maximum PDF pages to render as images when raw: true is set on vault_read_file. The per-page byte budget is MAX_IMAGE_OUTPUT_BYTES divided evenly across the rendered pages."
}
]
}
],
"repository": {
"id": "1226067541",
"url": "https://github.com/aliasunder/vault-cortex",
"source": "github"
},
"websiteUrl": "https://github.com/aliasunder/vault-cortex",
"description": "Standalone MCP server for Obsidian vaults — hybrid search, notes & files, memory, tasks, OAuth 2.1"
}
}