Everything I keep, I keep in a vault. Projects, decision logs, daily notes, half-formed ideas. So the obvious thing to want was for my agents to work in it directly, instead of me copying text out and pasting results back in.
The existing Obsidian MCP servers all wanted something first. Install a plugin. Run the Local REST API. Hold an API token. Keep Obsidian open. Every one of those is a moving part, and every moving part is a candidate for being the reason something does not work at 2am.
But a vault is just markdown files on disk. That is the entire appeal of Obsidian. So the server should be too.
Talk to the files
kika-obsidian-mcp does one thing: it points at a vault directory and works on the files. Local stdio MCP, direct filesystem access, no network calls anywhere in the tool.
- Read and search notes across the vault
- Create and update notes, and run the workflows I actually repeat — summaries, status reports, release notes
- Create and edit Obsidian Bases (
.base), validated against the official schema - Works with any MCP client: Claude Code, Claude Desktop, Cursor, Cline, Codex, Grok
No plugin. No API key. Obsidian does not need to be running.
The Bases part
This came later and turned out to be the thing nothing else does. Almost no other Obsidian MCP server can create or edit a Base, and writing one blind is a good way to produce a file Obsidian quietly ignores — no error, no warning, it just does not appear.
So it validates against the official schema. The agent either writes a valid Base or tells you why it cannot. I would rather be refused than debug a silent no-op.
Careful on purpose
Giving an agent write access to the place you keep everything deserves some thought. What is there:
- Read-only mode, which refuses writes outright
- Backup-on-write before updates and deletes
- Vault path isolation and path-traversal protection, so no tool call can reach outside the directory you configured
- No external network calls at all
Useful without being reckless. Those are not the same feature, and the second one is the one you notice only when it saves you.
It is also deliberately tolerant of real-world frontmatter. My vault has years of inconsistency in it. A tool that only works on tidy notes would be useless on a real vault.
Where it is now
Public and MIT, v0.3.0, with CI. In daily use against my own vault.
Not affiliated with Obsidian, or with any MCP client — it is an independent thing that reads files.
Small on purpose. It does not organise your notes for you. It just stops the vault being the one place your agents cannot reach.
See it
A local-first MCP server that lets any MCP client work directly with your Obsidian markdown — no plugin, no token, no Obsidian running. Free, MIT, Python.