obsidian-mcp-server 3.1.4 → 3.1.5

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (5) hide show
  1. package/Dockerfile +4 -0
  2. package/README.md +3 -1
  3. package/changelog/3.1.x/3.1.5.md +17 -0
  4. package/package.json +2 -2
  5. package/server.json +3 -3
package/Dockerfile CHANGED
@@ -85,6 +85,10 @@ ARG PORT
85
85
  # Set runtime environment variables
86
86
  # Note: PORT is an automatic variable in many cloud environments (e.g., Cloud Run)
87
87
  ENV MCP_HTTP_PORT=${PORT:-3010}
88
+ # Bind to all interfaces inside the container so the host's `-p` mapping can reach it;
89
+ # loopback would be unreachable from outside the container. For deployments beyond the
90
+ # operator's own machine, set MCP_AUTH_MODE=jwt or oauth — the default `none` plus this
91
+ # bind exposes the upstream OBSIDIAN_API_KEY to any caller that can reach the port.
88
92
  ENV MCP_HTTP_HOST="0.0.0.0"
89
93
  ENV MCP_TRANSPORT_TYPE="http"
90
94
  ENV MCP_SESSION_MODE="stateless"
package/README.md CHANGED
@@ -7,7 +7,7 @@
7
7
 
8
8
  <div align="center">
9
9
 
10
- [![npm](https://img.shields.io/npm/v/obsidian-mcp-server?style=flat-square&logo=npm&logoColor=white)](https://www.npmjs.com/package/obsidian-mcp-server) [![Version](https://img.shields.io/badge/Version-3.1.4-blue.svg?style=flat-square)](./CHANGELOG.md) [![Framework](https://img.shields.io/badge/Built%20on-@cyanheads/mcp--ts--core-259?style=flat-square)](https://www.npmjs.com/package/@cyanheads/mcp-ts-core) [![MCP SDK](https://img.shields.io/badge/MCP%20SDK-^1.29.0-green.svg?style=flat-square)](https://modelcontextprotocol.io/)
10
+ [![npm](https://img.shields.io/npm/v/obsidian-mcp-server?style=flat-square&logo=npm&logoColor=white)](https://www.npmjs.com/package/obsidian-mcp-server) [![Version](https://img.shields.io/badge/Version-3.1.5-blue.svg?style=flat-square)](./CHANGELOG.md) [![Framework](https://img.shields.io/badge/Built%20on-@cyanheads/mcp--ts--core-259?style=flat-square)](https://www.npmjs.com/package/@cyanheads/mcp-ts-core) [![MCP SDK](https://img.shields.io/badge/MCP%20SDK-^1.29.0-green.svg?style=flat-square)](https://modelcontextprotocol.io/)
11
11
 
12
12
  [![License](https://img.shields.io/badge/License-Apache%202.0-orange.svg?style=flat-square)](./LICENSE) [![TypeScript](https://img.shields.io/badge/TypeScript-^6.0.3-3178C6.svg?style=flat-square)](https://www.typescriptlang.org/) [![Bun](https://img.shields.io/badge/Bun-v1.3.11-blueviolet.svg?style=flat-square)](https://bun.sh/)
13
13
 
@@ -320,6 +320,8 @@ docker run --rm -e OBSIDIAN_API_KEY=your-key -p 3010:3010 obsidian-mcp-server
320
320
 
321
321
  The Dockerfile defaults to HTTP transport, stateless session mode, and logs to `/var/log/obsidian-mcp-server`. OpenTelemetry peer dependencies are installed by default — build with `--build-arg OTEL_ENABLED=false` to omit them.
322
322
 
323
+ The image binds to `0.0.0.0` inside the container (required for Docker port mapping). For any deployment reachable beyond your own machine, set `MCP_AUTH_MODE=jwt` (with `MCP_AUTH_SECRET_KEY`) or `oauth` — otherwise the listener forwards your `OBSIDIAN_API_KEY` to the vault on behalf of every caller.
324
+
323
325
  ## Project structure
324
326
 
325
327
  | Directory | Purpose |
package/changelog/3.1.x/3.1.5.md ADDED
@@ -0,0 +1,17 @@
1
+ ---
2
+ summary: Bump @cyanheads/mcp-ts-core ^0.8.15 → ^0.8.18 and document the auth requirement for HTTP deployments beyond loopback.
3
+ breaking: false
4
+ ---
5
+
6
+ # 3.1.5 — 2026-05-06
7
+
8
+ Maintenance release: framework dep refresh, paired skill sync, and a documentation clarification around HTTP transport posture. No source-code changes in this server.
9
+
10
+ ## Changed
11
+
12
+ - **`@cyanheads/mcp-ts-core` `^0.8.15 → ^0.8.18`.** Three upstream patch releases roll up:
13
+ - `0.8.16` — fixes an HTTP SSE per-request retention leak. `closePerRequestInstances` now binds to the request `AbortSignal` so ungraceful client disconnects close the per-request `McpServer` / transport pair. Affects this server when run under HTTP transport; pure framework fix, no consumer code change needed.
14
+ - `0.8.17` — surfaces `ctx.sessionId` on `Context` for HTTP handlers (defined in `stateful` / `auto` mode; opt-in via `createApp({ context: { exposeStatelessSessionId: true } })` under stateless). This server doesn't currently key on it.
15
+ - `0.8.18` — fixes `ctx.auth.token` being silently stripped in `toAuthContext`, and types `token?: string` on the public `AuthContext`. Doesn't apply here — this server forwards its own `OBSIDIAN_API_KEY` upstream, not the caller's bearer.
16
+ - **`skills/api-context` `1.2 → 1.3`.** Picks up the upstream skill update covering `ctx.sessionId` — defined-when matrix across transport / session / auth modes, the stateless opt-in, capability-token coherence note, and strict / lax state-keying recipes.
17
+ - **README + Dockerfile clarify auth requirement for non-loopback HTTP deployments.** The Docker image binds `MCP_HTTP_HOST=0.0.0.0` (required so the host's `-p` port mapping can reach the listener inside the container), and `MCP_AUTH_MODE` defaults to `none`. The README's Docker section and a new comment in the Dockerfile both now call this out and recommend `MCP_AUTH_MODE=jwt` or `oauth` for any deployment reachable beyond the operator's machine. Thanks to Ryan for surfacing the gap.
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "obsidian-mcp-server",
3
- "version": "3.1.4",
3
+ "version": "3.1.5",
4
4
  "mcpName": "io.github.cyanheads/obsidian-mcp-server",
5
5
  "description": "MCP server for Obsidian vaults — read, write, search, and surgically edit notes, tags, and frontmatter via the Local REST API plugin. STDIO or Streamable HTTP.",
6
6
  "type": "module",
@@ -76,7 +76,7 @@
76
76
  "access": "public"
77
77
  },
78
78
  "dependencies": {
79
- "@cyanheads/mcp-ts-core": "^0.8.15",
79
+ "@cyanheads/mcp-ts-core": "^0.8.18",
80
80
  "@types/js-yaml": "^4.0.9",
81
81
  "js-yaml": "^4.1.1",
82
82
  "pino-pretty": "^13.1.3",
package/server.json CHANGED
@@ -6,14 +6,14 @@
6
6
  "url": "https://github.com/cyanheads/obsidian-mcp-server",
7
7
  "source": "github"
8
8
  },
9
- "version": "3.1.4",
9
+ "version": "3.1.5",
10
10
  "packages": [
11
11
  {
12
12
  "registryType": "npm",
13
13
  "registryBaseUrl": "https://registry.npmjs.org",
14
14
  "identifier": "obsidian-mcp-server",
15
15
  "runtimeHint": "node",
16
- "version": "3.1.4",
16
+ "version": "3.1.5",
17
17
  "packageArguments": [
18
18
  {
19
19
  "type": "positional",
@@ -95,7 +95,7 @@
95
95
  "registryBaseUrl": "https://registry.npmjs.org",
96
96
  "identifier": "obsidian-mcp-server",
97
97
  "runtimeHint": "node",
98
- "version": "3.1.4",
98
+ "version": "3.1.5",
99
99
  "packageArguments": [
100
100
  {
101
101
  "type": "positional",