@bitbonsai/mcpvault 0.14.0 → 0.15.0

package/README.md

@@ -253,6 +253,27 @@ Add to your Claude Desktop configuration file:
 }
 ```
 
+**Read-only mode:**
+
+Add `--read-only` after the vault path to expose only read tools. Mutating tools are omitted from discovery and rejected if called directly.
+
+```json
+{
+  "mcpServers": {
+    "obsidian-read-only": {
+      "command": "npx",
+      "args": [
+        "@bitbonsai/mcpvault@latest",
+        "/Users/yourname/Documents/ResearchVault",
+        "--read-only"
+      ]
+    }
+  }
+}
+```
+
+The CLI also accepts `--read-only true` and `--read-only=true` for configuration systems that require explicit values. Omit the option, or set it to `false`, to keep normal read/write access.
+
 **Configuration File Locations:**
 
 - **macOS:** `~/Library/Application Support/Claude/claude_desktop_config.json`
@@ -961,7 +982,7 @@ This MCP server implements several security measures to protect your Obsidian va
 ### Best Practices
 
 - **Least Privilege:** Server only accesses the specified vault directory
-- **Read-Only by Default:** Consider running with read-only permissions for sensitive vaults
+- **Read-Only Mode:** Run with `--read-only` for sensitive vaults; mutating tools are hidden and rejected
 - **Backup Recommended:** Always backup your vault before using write operations
 - **Network Isolation:** Server uses stdio transport (no network exposure)
 

package/dist/server.js

@@ -1,6 +1,7 @@
 #!/usr/bin/env node
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
 import { createServer } from "./src/createServer.js";
+import { parseCliArgs } from "./src/cli.js";
 import { readFileSync } from "fs";
 import { fileURLToPath } from "url";
 import { dirname, join, resolve } from "path";
@@ -23,7 +24,7 @@ mcpvault v${VERSION}
 Universal AI bridge for Obsidian vaults - connect any MCP-compatible assistant
 
 Usage:
-  npx @bitbonsai/mcpvault [vault-path]
+  npx @bitbonsai/mcpvault [vault-path] [--read-only[=true|false]]
 
 Arguments:
   [vault-path]    Optional path to your Obsidian vault directory
@@ -32,21 +33,24 @@ Arguments:
 Options:
   --version, -v   Show version number
   --help, -h      Show this help message
+  --read-only     Expose read tools only and reject all vault mutations
+                  May be passed alone, with true/false, or as --read-only=true
 
 Examples:
   npx @bitbonsai/mcpvault
   npx @bitbonsai/mcpvault ~/Documents/MyVault
   npx @bitbonsai/mcpvault ./Vault
+  npx @bitbonsai/mcpvault ./Vault --read-only
   npx @bitbonsai/mcpvault /path/to/obsidian/vault
   npx @bitbonsai/mcpvault "/path/with spaces/Obsidian Vault"
 `);
     process.exit(0);
 }
-// Join trailing args to support vault paths with spaces.
-// When omitted, default to current working directory.
-const vaultPathArg = cliArgs.join(' ').trim();
+// Remove runtime options before joining trailing args, preserving support for
+// unquoted vault paths with spaces. When omitted, use the current directory.
+const { vaultPathArg, readOnly } = parseCliArgs(cliArgs);
 const vaultPath = resolve(vaultPathArg || process.cwd());
-const server = createServer(vaultPath, { version: VERSION });
+const server = createServer(vaultPath, { version: VERSION, readOnly });
 const transport = new StdioServerTransport();
 await server.connect(transport);
 // Exit when the client disconnects (stdin EOF) or the process is asked to

package/dist/src/cli.d.ts

@@ -0,0 +1,11 @@
+export interface ParsedCliArgs {
+    vaultPathArg: string;
+    readOnly: boolean;
+}
+/**
+ * Parse runtime options without importing server.ts, which starts the MCP
+ * server as a side effect. Unknown positional arguments remain part of the
+ * vault path so unquoted paths with spaces continue to work.
+ */
+export declare function parseCliArgs(args: string[]): ParsedCliArgs;
+//# sourceMappingURL=cli.d.ts.map

package/dist/src/cli.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../../src/cli.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,aAAa;IAC5B,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE,OAAO,CAAC;CACnB;AAED;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,aAAa,CAkC1D"}

package/dist/src/cli.js

@@ -0,0 +1,36 @@
+/**
+ * Parse runtime options without importing server.ts, which starts the MCP
+ * server as a side effect. Unknown positional arguments remain part of the
+ * vault path so unquoted paths with spaces continue to work.
+ */
+export function parseCliArgs(args) {
+    const pathArgs = [];
+    let readOnly = false;
+    for (let index = 0; index < args.length; index += 1) {
+        const arg = args[index];
+        if (arg === "--read-only") {
+            const next = args[index + 1]?.toLowerCase();
+            if (next === "true" || next === "false") {
+                readOnly = next === "true";
+                index += 1;
+            }
+            else {
+                readOnly = true;
+            }
+            continue;
+        }
+        if (arg.startsWith("--read-only=")) {
+            const value = arg.slice("--read-only=".length).toLowerCase();
+            if (value !== "true" && value !== "false") {
+                throw new Error("--read-only must be true or false");
+            }
+            readOnly = value === "true";
+            continue;
+        }
+        pathArgs.push(arg);
+    }
+    return {
+        vaultPathArg: pathArgs.join(" ").trim(),
+        readOnly,
+    };
+}

package/dist/src/createServer.d.ts

@@ -6,6 +6,8 @@ export interface CreateServerOptions {
     version?: string;
     pathFilter?: PathFilter;
     frontmatterHandler?: FrontmatterHandler;
+    /** Expose read tools only and reject direct calls to mutating tools. */
+    readOnly?: boolean;
 }
 export declare function createServer(vaultPath: string, options?: CreateServerOptions): Server;
 //# sourceMappingURL=createServer.d.ts.map

package/dist/src/createServer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"createServer.d.ts","sourceRoot":"","sources":["../../src/createServer.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAC;AAMnE,OAAO,EAAE,kBAAkB,EAAoB,MAAM,kBAAkB,CAAC;AACxE,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAK7C,MAAM,WAAW,mBAAmB;IAClC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,UAAU,CAAC;IACxB,kBAAkB,CAAC,EAAE,kBAAkB,CAAC;CACzC;AAED,wBAAgB,YAAY,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,GAAE,mBAAwB,GAAG,MAAM,CAudzF"}
+{"version":3,"file":"createServer.d.ts","sourceRoot":"","sources":["../../src/createServer.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAC;AAMnE,OAAO,EAAE,kBAAkB,EAAoB,MAAM,kBAAkB,CAAC;AACxE,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAK7C,MAAM,WAAW,mBAAmB;IAClC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,UAAU,CAAC;IACxB,kBAAkB,CAAC,EAAE,kBAAkB,CAAC;IACxC,wEAAwE;IACxE,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAYD,wBAAgB,YAAY,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,GAAE,mBAAwB,GAAG,MAAM,CAsezF"}

package/dist/src/createServer.js

@@ -6,8 +6,17 @@ import { PathFilter } from "./pathfilter.js";
 import { SearchService } from "./search.js";
 import { handleWikiLinkTool } from "./wikilink/index.js";
 import { resolve } from "path";
+const MUTATING_TOOLS = new Set([
+    "write_note",
+    "patch_note",
+    "delete_note",
+    "move_note",
+    "move_file",
+    "update_frontmatter",
+    "manage_tags",
+]);
 export function createServer(vaultPath, options = {}) {
-    const { name = "mcpvault", version = "0.0.0", pathFilter = new PathFilter(), frontmatterHandler = new FrontmatterHandler(), } = options;
+    const { name = "mcpvault", version = "0.0.0", pathFilter = new PathFilter(), frontmatterHandler = new FrontmatterHandler(), readOnly = false, } = options;
     const resolvedVaultPath = resolve(vaultPath);
     const fileSystem = new FileSystemService(resolvedVaultPath, pathFilter, frontmatterHandler);
     const searchService = new SearchService(resolvedVaultPath, pathFilter);
@@ -15,254 +24,266 @@ export function createServer(vaultPath, options = {}) {
         capabilities: { tools: {} },
     });
     server.setRequestHandler(ListToolsRequestSchema, async () => {
-        return {
-            tools: [
-                {
-                    name: "read_note",
-                    description: "Read a note from the Obsidian vault",
-                    inputSchema: {
-                        type: "object",
-                        properties: {
-                            path: { type: "string", description: "Path to the note relative to vault root" },
-                            prettyPrint: { type: "boolean", description: "Format JSON response with indentation (default: false)", default: false }
-                        },
-                        required: ["path"]
-                    }
-                },
-                {
-                    name: "write_note",
-                    description: "Write a note to the Obsidian vault",
-                    inputSchema: {
-                        type: "object",
-                        properties: {
-                            path: { type: "string", description: "Path to the note relative to vault root" },
-                            content: { type: "string", description: "Content of the note" },
-                            frontmatter: { type: "object", description: "Frontmatter object (optional)" },
-                            mode: { type: "string", enum: ["overwrite", "append", "prepend"], description: "Write mode: 'overwrite' (default), 'append', or 'prepend'", default: "overwrite" }
-                        },
-                        required: ["path", "content"]
-                    }
-                },
-                {
-                    name: "patch_note",
-                    description: "Efficiently update part of a note by replacing a specific string. This is more efficient than rewriting the entire note for small changes.",
-                    inputSchema: {
-                        type: "object",
-                        properties: {
-                            path: { type: "string", description: "Path to the note relative to vault root" },
-                            oldString: { type: "string", description: "The exact string to replace. Must match exactly including whitespace and line breaks." },
-                            newString: { type: "string", description: "The new string to insert in place of oldString" },
-                            replaceAll: { type: "boolean", description: "If true, replace all occurrences. If false (default), the operation will fail if multiple matches are found to prevent unintended replacements.", default: false }
-                        },
-                        required: ["path", "oldString", "newString"]
-                    }
-                },
-                {
-                    name: "list_directory",
-                    description: "List files and directories in the vault (includes non-note filenames, while read/write tools remain note-only)",
-                    inputSchema: {
-                        type: "object",
-                        properties: {
-                            path: { type: "string", description: "Path relative to vault root (default: '/')", default: "/" },
-                            prettyPrint: { type: "boolean", description: "Format JSON response with indentation (default: false)", default: false }
-                        }
-                    }
-                },
-                {
-                    name: "delete_note",
-                    description: "Delete a note from the Obsidian vault (requires confirmation). Supports permanent delete, vault trash, or system trash.",
-                    inputSchema: {
-                        type: "object",
-                        properties: {
-                            path: { type: "string", description: "Path to the note relative to vault root" },
-                            confirmPath: { type: "string", description: "Confirmation: must exactly match the path parameter to proceed with deletion" },
-                            trashMode: { type: "string", enum: ["none", "local", "system"], description: "Deletion mode: 'none' = permanent delete (default), 'local' = move to .trash inside vault, 'system' = move to OS trash", default: "none" }
-                        },
-                        required: ["path", "confirmPath"]
-                    }
-                },
-                {
-                    name: "search_notes",
-                    description: "Search for notes in the vault by content or frontmatter",
-                    inputSchema: {
-                        type: "object",
-                        properties: {
-                            query: { type: "string", description: "Search query text" },
-                            limit: { type: "number", description: "Maximum number of results (default: 5, max: 20)", default: 5 },
-                            searchContent: { type: "boolean", description: "Search in note content (default: true)", default: true },
-                            searchFrontmatter: { type: "boolean", description: "Search in frontmatter (default: false)", default: false },
-                            caseSensitive: { type: "boolean", description: "Case sensitive search (default: false)", default: false },
-                            pathPrefix: { type: "string", description: "Restrict the search to a vault subtree, e.g. \"Projects/2026\" (directory prefix)" },
-                            excludePaths: { type: "array", items: { type: "string" }, description: "Skip files under these subtrees, e.g. [\"Archive\", \"meta\"] (directory prefixes)" },
-                            prettyPrint: { type: "boolean", description: "Format JSON response with indentation (default: false)", default: false }
-                        },
-                        required: ["query"]
-                    }
-                },
-                {
-                    name: "move_note",
-                    description: "Move or rename a note in the vault",
-                    inputSchema: {
-                        type: "object",
-                        properties: {
-                            oldPath: { type: "string", description: "Current path of the note" },
-                            newPath: { type: "string", description: "New path for the note" },
-                            overwrite: { type: "boolean", description: "Allow overwriting existing file (default: false)", default: false }
-                        },
-                        required: ["oldPath", "newPath"]
-                    }
-                },
-                {
-                    name: "move_file",
-                    description: "Move or rename any file in the vault (binary-safe, file-only, requires confirmation)",
-                    inputSchema: {
-                        type: "object",
-                        properties: {
-                            oldPath: { type: "string", description: "Current path of the file" },
-                            newPath: { type: "string", description: "New path for the file" },
-                            confirmOldPath: { type: "string", description: "Confirmation: must exactly match oldPath" },
-                            confirmNewPath: { type: "string", description: "Confirmation: must exactly match newPath" },
-                            overwrite: { type: "boolean", description: "Allow overwriting existing file (default: false)", default: false }
-                        },
-                        required: ["oldPath", "newPath", "confirmOldPath", "confirmNewPath"]
-                    }
-                },
-                {
-                    name: "read_multiple_notes",
-                    description: "Read multiple notes in a batch (max 10 files)",
-                    inputSchema: {
-                        type: "object",
-                        properties: {
-                            paths: { type: "array", items: { type: "string" }, description: "Array of note paths to read", maxItems: 10 },
-                            includeContent: { type: "boolean", description: "Include note content (default: true)", default: true },
-                            includeFrontmatter: { type: "boolean", description: "Include frontmatter (default: true)", default: true },
-                            prettyPrint: { type: "boolean", description: "Format JSON response with indentation (default: false)", default: false }
-                        },
-                        required: ["paths"]
-                    }
-                },
-                {
-                    name: "update_frontmatter",
-                    description: "Update frontmatter of a note without changing content",
-                    inputSchema: {
-                        type: "object",
-                        properties: {
-                            path: { type: "string", description: "Path to the note" },
-                            frontmatter: { type: "object", description: "Frontmatter object to update" },
-                            merge: { type: "boolean", description: "Merge with existing frontmatter (default: true)", default: true }
-                        },
-                        required: ["path", "frontmatter"]
+        const tools = [
+            {
+                name: "read_note",
+                description: "Read a note from the Obsidian vault",
+                inputSchema: {
+                    type: "object",
+                    properties: {
+                        path: { type: "string", description: "Path to the note relative to vault root" },
+                        prettyPrint: { type: "boolean", description: "Format JSON response with indentation (default: false)", default: false }
+                    },
+                    required: ["path"]
+                }
+            },
+            {
+                name: "write_note",
+                description: "Write a note to the Obsidian vault",
+                inputSchema: {
+                    type: "object",
+                    properties: {
+                        path: { type: "string", description: "Path to the note relative to vault root" },
+                        content: { type: "string", description: "Content of the note" },
+                        frontmatter: { type: "object", description: "Frontmatter object (optional)" },
+                        mode: { type: "string", enum: ["overwrite", "append", "prepend"], description: "Write mode: 'overwrite' (default), 'append', or 'prepend'", default: "overwrite" }
+                    },
+                    required: ["path", "content"]
+                }
+            },
+            {
+                name: "patch_note",
+                description: "Efficiently update part of a note by replacing a specific string. This is more efficient than rewriting the entire note for small changes.",
+                inputSchema: {
+                    type: "object",
+                    properties: {
+                        path: { type: "string", description: "Path to the note relative to vault root" },
+                        oldString: { type: "string", description: "The exact string to replace. Must match exactly including whitespace and line breaks." },
+                        newString: { type: "string", description: "The new string to insert in place of oldString" },
+                        replaceAll: { type: "boolean", description: "If true, replace all occurrences. If false (default), the operation will fail if multiple matches are found to prevent unintended replacements.", default: false }
+                    },
+                    required: ["path", "oldString", "newString"]
+                }
+            },
+            {
+                name: "list_directory",
+                description: "List files and directories in the vault (includes non-note filenames, while read/write tools remain note-only)",
+                inputSchema: {
+                    type: "object",
+                    properties: {
+                        path: { type: "string", description: "Path relative to vault root (default: '/')", default: "/" },
+                        prettyPrint: { type: "boolean", description: "Format JSON response with indentation (default: false)", default: false }
                     }
-                },
-                {
-                    name: "get_notes_info",
-                    description: "Get metadata for notes without reading full content",
-                    inputSchema: {
-                        type: "object",
-                        properties: {
-                            paths: { type: "array", items: { type: "string" }, description: "Array of note paths to get info for" },
-                            prettyPrint: { type: "boolean", description: "Format JSON response with indentation (default: false)", default: false }
-                        },
-                        required: ["paths"]
+                }
+            },
+            {
+                name: "delete_note",
+                description: "Delete a note from the Obsidian vault (requires confirmation). Supports permanent delete, vault trash, or system trash.",
+                inputSchema: {
+                    type: "object",
+                    properties: {
+                        path: { type: "string", description: "Path to the note relative to vault root" },
+                        confirmPath: { type: "string", description: "Confirmation: must exactly match the path parameter to proceed with deletion" },
+                        trashMode: { type: "string", enum: ["none", "local", "system"], description: "Deletion mode: 'none' = permanent delete (default), 'local' = move to .trash inside vault, 'system' = move to OS trash", default: "none" }
+                    },
+                    required: ["path", "confirmPath"]
+                }
+            },
+            {
+                name: "search_notes",
+                description: "Search for notes in the vault by content or frontmatter",
+                inputSchema: {
+                    type: "object",
+                    properties: {
+                        query: { type: "string", description: "Search query text" },
+                        limit: { type: "number", description: "Maximum number of results (default: 5, max: 20)", default: 5 },
+                        searchContent: { type: "boolean", description: "Search in note content (default: true)", default: true },
+                        searchFrontmatter: { type: "boolean", description: "Search in frontmatter (default: false)", default: false },
+                        caseSensitive: { type: "boolean", description: "Case sensitive search (default: false)", default: false },
+                        pathPrefix: { type: "string", description: "Restrict the search to a vault subtree, e.g. \"Projects/2026\" (directory prefix)" },
+                        excludePaths: { type: "array", items: { type: "string" }, description: "Skip files under these subtrees, e.g. [\"Archive\", \"meta\"] (directory prefixes)" },
+                        prettyPrint: { type: "boolean", description: "Format JSON response with indentation (default: false)", default: false }
+                    },
+                    required: ["query"]
+                }
+            },
+            {
+                name: "move_note",
+                description: "Move or rename a note in the vault",
+                inputSchema: {
+                    type: "object",
+                    properties: {
+                        oldPath: { type: "string", description: "Current path of the note" },
+                        newPath: { type: "string", description: "New path for the note" },
+                        overwrite: { type: "boolean", description: "Allow overwriting existing file (default: false)", default: false }
+                    },
+                    required: ["oldPath", "newPath"]
+                }
+            },
+            {
+                name: "move_file",
+                description: "Move or rename any file in the vault (binary-safe, file-only, requires confirmation)",
+                inputSchema: {
+                    type: "object",
+                    properties: {
+                        oldPath: { type: "string", description: "Current path of the file" },
+                        newPath: { type: "string", description: "New path for the file" },
+                        confirmOldPath: { type: "string", description: "Confirmation: must exactly match oldPath" },
+                        confirmNewPath: { type: "string", description: "Confirmation: must exactly match newPath" },
+                        overwrite: { type: "boolean", description: "Allow overwriting existing file (default: false)", default: false }
+                    },
+                    required: ["oldPath", "newPath", "confirmOldPath", "confirmNewPath"]
+                }
+            },
+            {
+                name: "read_multiple_notes",
+                description: "Read multiple notes in a batch (max 10 files)",
+                inputSchema: {
+                    type: "object",
+                    properties: {
+                        paths: { type: "array", items: { type: "string" }, description: "Array of note paths to read", maxItems: 10 },
+                        includeContent: { type: "boolean", description: "Include note content (default: true)", default: true },
+                        includeFrontmatter: { type: "boolean", description: "Include frontmatter (default: true)", default: true },
+                        prettyPrint: { type: "boolean", description: "Format JSON response with indentation (default: false)", default: false }
+                    },
+                    required: ["paths"]
+                }
+            },
+            {
+                name: "update_frontmatter",
+                description: "Update frontmatter of a note without changing content",
+                inputSchema: {
+                    type: "object",
+                    properties: {
+                        path: { type: "string", description: "Path to the note" },
+                        frontmatter: { type: "object", description: "Frontmatter object to update" },
+                        merge: { type: "boolean", description: "Merge with existing frontmatter (default: true)", default: true }
+                    },
+                    required: ["path", "frontmatter"]
+                }
+            },
+            {
+                name: "get_notes_info",
+                description: "Get metadata for notes without reading full content",
+                inputSchema: {
+                    type: "object",
+                    properties: {
+                        paths: { type: "array", items: { type: "string" }, description: "Array of note paths to get info for" },
+                        prettyPrint: { type: "boolean", description: "Format JSON response with indentation (default: false)", default: false }
+                    },
+                    required: ["paths"]
+                }
+            },
+            {
+                name: "get_frontmatter",
+                description: "Extract frontmatter from a note without reading the content",
+                inputSchema: {
+                    type: "object",
+                    properties: {
+                        path: { type: "string", description: "Path to the note relative to vault root" },
+                        prettyPrint: { type: "boolean", description: "Format JSON response with indentation (default: false)", default: false }
+                    },
+                    required: ["path"]
+                }
+            },
+            {
+                name: "manage_tags",
+                description: "Add, remove, or list tags in a note",
+                inputSchema: {
+                    type: "object",
+                    properties: {
+                        path: { type: "string", description: "Path to the note relative to vault root" },
+                        operation: { type: "string", enum: ["add", "remove", "list"], description: "Operation to perform: 'add', 'remove', or 'list'" },
+                        tags: { type: "array", items: { type: "string" }, description: "Array of tags (required for 'add' and 'remove' operations)" }
+                    },
+                    required: ["path", "operation"]
+                }
+            },
+            {
+                name: "get_vault_stats",
+                description: "Get vault statistics including total notes, folders, size, and recently modified files. Useful for understanding vault scope before batch operations.",
+                inputSchema: {
+                    type: "object",
+                    properties: {
+                        recentCount: { type: "number", description: "Number of recently modified files to return (default: 5, max: 20)", default: 5 },
+                        prettyPrint: { type: "boolean", description: "Format JSON response with indentation (default: false)", default: false }
                     }
-                },
-                {
-                    name: "get_frontmatter",
-                    description: "Extract frontmatter from a note without reading the content",
-                    inputSchema: {
-                        type: "object",
-                        properties: {
-                            path: { type: "string", description: "Path to the note relative to vault root" },
-                            prettyPrint: { type: "boolean", description: "Format JSON response with indentation (default: false)", default: false }
-                        },
-                        required: ["path"]
+                }
+            },
+            {
+                name: "list_all_tags",
+                description: "List all tags across the vault with occurrence counts. Returns both frontmatter tags and inline #hashtags, deduplicated and sorted by frequency. Useful for discovering existing tags before creating or organizing notes.",
+                inputSchema: {
+                    type: "object",
+                    properties: {
+                        prettyPrint: { type: "boolean", description: "Format JSON response with indentation (default: false)", default: false }
                     }
-                },
-                {
-                    name: "manage_tags",
-                    description: "Add, remove, or list tags in a note",
-                    inputSchema: {
-                        type: "object",
-                        properties: {
-                            path: { type: "string", description: "Path to the note relative to vault root" },
-                            operation: { type: "string", enum: ["add", "remove", "list"], description: "Operation to perform: 'add', 'remove', or 'list'" },
-                            tags: { type: "array", items: { type: "string" }, description: "Array of tags (required for 'add' and 'remove' operations)" }
+                }
+            },
+            {
+                name: "wiki_link",
+                description: "Read an Obsidian wiki link. Accepts the same syntax as Obsidian: [[Document Name]] or [[Document Name|Display Text]], including table-authored escapes like [[Document Name\\|Display]] and path-qualified links like [[folder/Document Name]]. A #fragment suffix in the input is ignored. Searches the vault for an exact basename match (or exact vault-relative path match when the name contains '/') and returns the file's content. When multiple files share the basename, picks the first (vault root first, then alphabetical by path) and lists the other paths in structuredContent.alternatives. Content is returned bare — ready for direct use in context.",
+                inputSchema: {
+                    type: "object",
+                    properties: {
+                        document: {
+                            type: "string",
+                            description: "The document name — what goes inside [[ ]]. e.g. 'My-Document'. Brackets and display text (|...) are stripped if present. The .md extension is always appended (never include it)."
                         },
-                        required: ["path", "operation"]
-                    }
-                },
-                {
-                    name: "get_vault_stats",
-                    description: "Get vault statistics including total notes, folders, size, and recently modified files. Useful for understanding vault scope before batch operations.",
-                    inputSchema: {
-                        type: "object",
-                        properties: {
-                            recentCount: { type: "number", description: "Number of recently modified files to return (default: 5, max: 20)", default: 5 },
-                            prettyPrint: { type: "boolean", description: "Format JSON response with indentation (default: false)", default: false }
+                        prettyPrint: {
+                            type: "boolean",
+                            description: "Format JSON response with indentation (default: false)",
+                            default: false
                         }
-                    }
-                },
-                {
-                    name: "list_all_tags",
-                    description: "List all tags across the vault with occurrence counts. Returns both frontmatter tags and inline #hashtags, deduplicated and sorted by frequency. Useful for discovering existing tags before creating or organizing notes.",
-                    inputSchema: {
-                        type: "object",
-                        properties: {
-                            prettyPrint: { type: "boolean", description: "Format JSON response with indentation (default: false)", default: false }
-                        }
-                    }
-                },
-                {
-                    name: "wiki_link",
-                    description: "Read an Obsidian wiki link. Accepts the same syntax as Obsidian: [[Document Name]] or [[Document Name|Display Text]], including table-authored escapes like [[Document Name\\|Display]] and path-qualified links like [[folder/Document Name]]. A #fragment suffix in the input is ignored. Searches the vault for an exact basename match (or exact vault-relative path match when the name contains '/') and returns the file's content. When multiple files share the basename, picks the first (vault root first, then alphabetical by path) and lists the other paths in structuredContent.alternatives. Content is returned bare — ready for direct use in context.",
-                    inputSchema: {
-                        type: "object",
-                        properties: {
-                            document: {
-                                type: "string",
-                                description: "The document name — what goes inside [[ ]]. e.g. 'My-Document'. Brackets and display text (|...) are stripped if present. The .md extension is always appended (never include it)."
-                            },
-                            prettyPrint: {
-                                type: "boolean",
-                                description: "Format JSON response with indentation (default: false)",
-                                default: false
-                            }
-                        },
-                        required: ["document"]
-                    }
-                },
-                {
-                    name: "get_note_outline",
-                    description: "Get the heading structure of a note without reading its full content. Returns headings with level, text, and line number. Use this first to navigate large notes efficiently, then call read_note_lines to read only the section you need.",
-                    inputSchema: {
-                        type: "object",
-                        properties: {
-                            path: { type: "string", description: "Path to the note relative to vault root" },
-                            prettyPrint: { type: "boolean", description: "Format JSON response with indentation (default: false)", default: false }
-                        },
-                        required: ["path"]
-                    }
-                },
-                {
-                    name: "read_note_lines",
-                    description: "Read a specific line range from a note. Use after get_note_outline to read only the section you need instead of the full file.",
-                    inputSchema: {
-                        type: "object",
-                        properties: {
-                            path: { type: "string", description: "Path to the note relative to vault root" },
-                            startLine: { type: "number", description: "First line to read (1-indexed, inclusive)" },
-                            endLine: { type: "number", description: "Last line to read (1-indexed, inclusive)" },
-                            prettyPrint: { type: "boolean", description: "Format JSON response with indentation (default: false)", default: false }
-                        },
-                        required: ["path", "startLine", "endLine"]
-                    }
+                    },
+                    required: ["document"]
+                }
+            },
+            {
+                name: "get_note_outline",
+                description: "Get the heading structure of a note without reading its full content. Returns headings with level, text, and line number. Use this first to navigate large notes efficiently, then call read_note_lines to read only the section you need.",
+                inputSchema: {
+                    type: "object",
+                    properties: {
+                        path: { type: "string", description: "Path to the note relative to vault root" },
+                        prettyPrint: { type: "boolean", description: "Format JSON response with indentation (default: false)", default: false }
+                    },
+                    required: ["path"]
                 }
-            ]
+            },
+            {
+                name: "read_note_lines",
+                description: "Read a specific line range from a note. Use after get_note_outline to read only the section you need instead of the full file.",
+                inputSchema: {
+                    type: "object",
+                    properties: {
+                        path: { type: "string", description: "Path to the note relative to vault root" },
+                        startLine: { type: "number", description: "First line to read (1-indexed, inclusive)" },
+                        endLine: { type: "number", description: "Last line to read (1-indexed, inclusive)" },
+                        prettyPrint: { type: "boolean", description: "Format JSON response with indentation (default: false)", default: false }
+                    },
+                    required: ["path", "startLine", "endLine"]
+                }
+            }
+        ];
+        return {
+            tools: readOnly
+                ? tools.filter((tool) => !MUTATING_TOOLS.has(tool.name))
+                : tools,
         };
     });
     server.setRequestHandler(CallToolRequestSchema, async (request) => {
         const { name: toolName, arguments: args } = request.params;
         const trimmedArgs = trimPaths(args);
+        if (readOnly && MUTATING_TOOLS.has(toolName)) {
+            return {
+                content: [{
+                        type: "text",
+                        text: `Error: ${toolName} is disabled because MCPVault is running in read-only mode. Restart without --read-only to enable vault mutations.`,
+                    }],
+                isError: true,
+            };
+        }
         try {
             switch (toolName) {
                 case "read_note": {

package/dist/src/pathfilter.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"pathfilter.d.ts","sourceRoot":"","sources":["../../src/pathfilter.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAEnD,qBAAa,UAAU;IAOrB,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,mBAAmB,CAMxC;IAEH,OAAO,CAAC,eAAe,CAAW;IAClC,OAAO,CAAC,iBAAiB,CAAW;IAEpC,YAAY,MAAM,CAAC,EAAE,OAAO,CAAC,gBAAgB,CAAC,EAuB7C;IAED,OAAO,CAAC,eAAe;IAoBvB;;;;;;OAMG;IACH,OAAO,CAAC,oBAAoB;IAQ5B,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAuB/B;IAED,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAUzC;IAED,OAAO,CAAC,aAAa;IA2BrB,OAAO,CAAC,MAAM;IA0Bd,WAAW,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,MAAM,EAAE,CAErC;CACF"}
+{"version":3,"file":"pathfilter.d.ts","sourceRoot":"","sources":["../../src/pathfilter.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAEnD,qBAAa,UAAU;IAOrB,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,mBAAmB,CAMxC;IAEH,OAAO,CAAC,eAAe,CAAW;IAClC,OAAO,CAAC,iBAAiB,CAAW;IAEpC,YAAY,MAAM,CAAC,EAAE,OAAO,CAAC,gBAAgB,CAAC,EAuB7C;IAED,OAAO,CAAC,eAAe;IAoBvB;;;;;;OAMG;IACH,OAAO,CAAC,oBAAoB;IAQ5B,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAuB/B;IAED,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAUzC;IAED,OAAO,CAAC,aAAa;IA+BrB,OAAO,CAAC,MAAM;IA0Bd,WAAW,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,MAAM,EAAE,CAErC;CACF"}

package/dist/src/pathfilter.js

@@ -99,10 +99,12 @@ export class PathFilter {
         // (".Git/config", ".git./config", ".git /config") cannot bypass the deny-list
         // on case-insensitive / Windows filesystems.
         const canonicalPath = this.canonicalizeForMatch(normalizedPath);
-        // Deny restricted directories/files at any depth: if any path segment is a
-        // restricted name, the path is ignored regardless of nesting (#128).
+        // Deny hidden paths and restricted directories/files at any depth. Dotfiles
+        // are outside the public vault-note surface even when their suffix looks
+        // like an allowed note extension (for example, `.secrets.md`).
         for (const segment of canonicalPath.split('/')) {
-            if (PathFilter.RESTRICTED_SEGMENTS.has(segment.toLowerCase())) {
+            if (segment.startsWith('.') ||
+                PathFilter.RESTRICTED_SEGMENTS.has(segment.toLowerCase())) {
                 return true;
             }
         }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bitbonsai/mcpvault",
-  "version": "0.14.0",
+  "version": "0.15.0",
   "description": "Universal AI bridge for Obsidian vaults - connect any MCP-compatible assistant",
   "homepage": "https://mcpvault.org",
   "author": "bitbonsai",