// SCAN REPORT

Obsidian

36 tools. 15 can modify or destroy data without limits.

1 destructive tool with no built-in limits. Policy required.

Last updated: 30 Jun 2026

15 can modify or destroy data

21 read-only

36 tools total

Community server · catalogue entry verified 30/06/2026

How to control Obsidian ↓

TOOL MAP

What Obsidian exposes to your agents

Read (21) Write / Execute (14) Destructive / Financial (1)

Running more than one server? Check your whole stack →

MOST DANGEROUS TOOLS

Critical Risk

The most dangerous Obsidian tools

Destructive · High obsidian_delete_note This tool irreversibly removes data (a note) from the user's vault. Execute · Medium obsidian_disable_plugin Disabling a plugin triggers an external operation on the running Obsidian instance that changes its runtime behavior. Execute · High obsidian_enable_plugin Enabling a plugin causes external code to run within the Obsidian instance. Execute · Critical obsidian_eval This tool executes arbitrary JavaScript code within a live Obsidian instance, giving an AI agent full programmatic access to the application, the filesystem, and potentially the OS.

15 of Obsidian's 36 tools can modify, destroy, or commit something on every call — and an agent calls them with no built-in limits.

POLICY

How to control Obsidian

PolicyLayer is an MCP gateway — it sits between your AI agents and Obsidian, and nothing reaches the server without passing your rules. These are the rules we recommend:

Deny destructive operations

{
  "obsidian_delete_note": {
    "deny_if": [
      {
        "conditions": [],
        "on_deny": "Blocked by default. Requires approval."
      }
    ]
  }
}

Destructive tools should never be available to autonomous agents without human approval.

Rate limit write operations

{
  "obsidian_append_note": {
    "limits": [
      {
        "counter": "obsidian_append_note_per_hour",
        "window": "hour",
        "max": 30,
        "scope": "grant"
      }
    ]
  }
}

Prevents bulk unintended modifications from agents caught in loops.

Cap read operations

{
  "obsidian_dev_console": {
    "limits": [
      {
        "counter": "obsidian_dev_console_per_minute",
        "window": "minute",
        "max": 60,
        "scope": "grant"
      }
    ]
  }
}

Controls API costs and prevents retry loops from exhausting upstream rate limits.

Create a free account and register Obsidian — nothing to install.
Add these rules — paste them, or build them visually. Tune the limits to your setup.
Point your MCP client (Claude, Cursor, anything) at your gateway URL.

ENFORCE POLICY ON OBSIDIAN →

Instant setup, no code required.

FULL CATALOGUE

All 36 Obsidian tools

DESTRUCTIVE 1 tools

Destructive obsidian_delete_note Moves a note to the system trash. Set

EXECUTE 4 tools

Execute obsidian_disable_plugin Disables a community plugin by id. Execute obsidian_enable_plugin Enables a community plugin by id. Execute obsidian_eval Runs arbitrary JavaScript inside the running Obsidian instance with access to the Execute obsidian_reload_plugin Reloads a plugin

WRITE 10 tools

Write obsidian_append_note Appends markdown content to the end of an existing note. Write obsidian_create_note Creates a new note. Use Write obsidian_move_note Moves or renames a note. Wikilinks across the vault are updated automatically. Write obsidian_organize_apply Validates a routing plan and (if Write obsidian_prepend_note Inserts content near the top of a note (after frontmatter, if present). Write obsidian_register_topic Programmatically registers (or overwrites) a topic → folder mapping in the Write obsidian_remove_property Removes a frontmatter property from a note. Write obsidian_remove_topic Forgets a topic → folder mapping. Existing notes in the folder are not touched. Write obsidian_rename_tag Renames a tag across every note in the vault. Write obsidian_set_property Sets a frontmatter property on a note. Creates the frontmatter block if missing.

READ 21 tools

Read obsidian_dev_console Returns recent console messages from Obsidian DevTools. Read obsidian_dev_errors Returns recent JS errors from the Obsidian DevTools console. Read obsidian_dev_screenshot Returns a base64-encoded PNG screenshot of the running Obsidian window. Read obsidian_files_with_tag Lists every note tagged with the given tag. Read obsidian_get_backlinks Returns notes that link to the target note. Read obsidian_get_links Returns the outgoing wikilinks from a note. Read obsidian_get_metadata Returns metadata for a note (frontmatter, tags, links, file stats) as JSON. Read obsidian_get_properties Returns the YAML frontmatter properties of a note as JSON. Read obsidian_help Shows the underlying Read obsidian_list_files Lists every note in the vault. Returns JSON by default. Useful as a first step to discover what exists. Read obsidian_list_folders Displays the vault folder structure as a tree. Read obsidian_list_orphans Finds notes that have no incoming wikilinks. Read obsidian_list_plugins Lists installed community + core plugins with enabled state. Read obsidian_list_tags Lists every tag used in the vault, with usage counts. Read obsidian_list_unresolved Finds wikilinks that point to non-existent notes. Read obsidian_read_note Returns the full markdown content of a note. Read obsidian_scan_root Lists every .md file at the vault root with frontmatter and a body preview. Read obsidian_search Full-text search across the vault. Returns matching files. Read obsidian_search_context Full-text search that returns surrounding lines of context for each hit. Read obsidian_topic_stats Returns the persistent topic store for the given vault — every topic the MCP Read obsidian_version Returns the version of the Obsidian CLI binary in use.

EXPLORE

Related servers

Other MCP servers with similar tools — same risk classification, starter policies for each.

FAQ

Questions about Obsidian

Can an AI agent delete data through the Obsidian MCP server? +

Yes. The Obsidian server exposes 1 destructive tools including obsidian_delete_note. These permanently remove resources with no undo. PolicyLayer blocks destructive tools by default so they never reach the upstream server.

How do I prevent bulk modifications through Obsidian? +

The Obsidian server has 10 write tools including obsidian_append_note, obsidian_create_note, obsidian_move_note. Set a rate limit in your policy -- for example, 10 calls per hour prevents an agent from making more than 10 modifications per hour. PolicyLayer enforces this at the gateway, before calls reach Obsidian.

How many tools does the Obsidian MCP server expose? +

36 tools across 3 categories: Destructive, Read, Write. 21 are read-only. 15 can modify, create, or delete data.

How do I enforce a policy on Obsidian? +

Register the Obsidian MCP server in PolicyLayer, apply the suggested rules above (adjust the limits to your use case), and point your AI client at the PolicyLayer proxy URL instead of the server directly. Your agents keep the same tools; PolicyLayer evaluates every call against policy before it executes. Nothing to install, live in minutes.

Enforce policy on every Obsidian tool call.

Deterministic rules across all 36 Obsidian tools. Per-identity grants. Full audit log. Live in minutes. Nothing to install.

ENFORCE POLICY ON OBSIDIAN →

Instant setup, no code required.

36 Obsidian tools catalogued and risk-classified — across an index of 43,000+ MCP servers.