obsidian-mcp-server 3.7.2 → 3.8.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "obsidian-mcp-server",
-  "version": "3.7.2",
+  "version": "3.8.0",
   "mcpName": "io.github.cyanheads/obsidian-mcp-server",
   "description": "Read, write, search, and surgically edit Obsidian vault notes, tags, and frontmatter via MCP. STDIO or Streamable HTTP.",
   "type": "module",
@@ -102,9 +102,9 @@
     "zod": "^4.6.7"
   },
   "devDependencies": {
-    "@biomejs/biome": "^2.6.3",
+    "@biomejs/biome": "^2.6.4",
     "@socketsecurity/bun-security-scanner": "^1.1.3",
-    "@types/node": "^26.6.5",
+    "@types/node": "^26.6.6",
     "@vitest/coverage-istanbul": "^5.0.5",
     "depcheck": "^1.4.7",
     "ignore": "^7.0.14",

package/server.json

@@ -6,14 +6,14 @@
     "url": "https://github.com/cyanheads/obsidian-mcp-server",
     "source": "github"
   },
-  "version": "3.7.2",
+  "version": "3.8.0",
   "packages": [
     {
       "registryType": "npm",
       "registryBaseUrl": "https://registry.npmjs.org",
       "identifier": "obsidian-mcp-server",
       "runtimeHint": "npx",
-      "version": "3.7.2",
+      "version": "3.8.0",
       "environmentVariables": [
         {
           "name": "OBSIDIAN_API_KEY",
@@ -51,13 +51,19 @@
         },
         {
           "name": "OBSIDIAN_READ_PATHS",
-          "description": "Optional comma-separated vault-relative folder allowlist for reads. Prefix-based with implicit recursion; case-insensitive; trailing slashes normalized. Unset = full vault. Write paths are implicitly readable. Example: 'public/,projects/'.",
+          "description": "Optional comma-separated vault-relative folder allowlist for reads. Prefix-based with implicit recursion; case-insensitive; backslashes read as slashes, repeated and trailing slashes and '.' segments dropped, and names normalized to Unicode NFC; an entry naming the vault root ('.') is rejected at startup. Unset = full vault. Write paths are implicitly readable. Example: 'public/,projects/'.",
           "format": "string",
           "isRequired": false
         },
         {
           "name": "OBSIDIAN_WRITE_PATHS",
-          "description": "Optional comma-separated vault-relative folder allowlist for writes. Same syntax as OBSIDIAN_READ_PATHS. Unset = full vault, or the read scope when reads are restricted. Example: 'projects/,scratch/'.",
+          "description": "Optional comma-separated vault-relative folder allowlist for writes. Same syntax as OBSIDIAN_READ_PATHS. Unset = full vault, or the read scope when reads are restricted; paths in OBSIDIAN_DENY_PATHS stay denied. Example: 'projects/,scratch/'.",
+          "format": "string",
+          "isRequired": false
+        },
+        {
+          "name": "OBSIDIAN_DENY_PATHS",
+          "description": "Optional comma-separated vault-relative paths withheld from reads and writes. Same syntax as OBSIDIAN_READ_PATHS. Wins over both allowlists; denied paths are left out of listings, search results, and tag counts. Unset = nothing denied. Example: 'private/,journal/therapy/'.",
           "format": "string",
           "isRequired": false
         },
@@ -98,7 +104,7 @@
       "registryBaseUrl": "https://registry.npmjs.org",
       "identifier": "obsidian-mcp-server",
       "runtimeHint": "npx",
-      "version": "3.7.2",
+      "version": "3.8.0",
       "environmentVariables": [
         {
           "name": "MCP_TRANSPORT_TYPE",
@@ -142,13 +148,19 @@
         },
         {
           "name": "OBSIDIAN_READ_PATHS",
-          "description": "Optional comma-separated vault-relative folder allowlist for reads. Prefix-based with implicit recursion; case-insensitive; trailing slashes normalized. Unset = full vault. Write paths are implicitly readable. Example: 'public/,projects/'.",
+          "description": "Optional comma-separated vault-relative folder allowlist for reads. Prefix-based with implicit recursion; case-insensitive; backslashes read as slashes, repeated and trailing slashes and '.' segments dropped, and names normalized to Unicode NFC; an entry naming the vault root ('.') is rejected at startup. Unset = full vault. Write paths are implicitly readable. Example: 'public/,projects/'.",
           "format": "string",
           "isRequired": false
         },
         {
           "name": "OBSIDIAN_WRITE_PATHS",
-          "description": "Optional comma-separated vault-relative folder allowlist for writes. Same syntax as OBSIDIAN_READ_PATHS. Unset = full vault, or the read scope when reads are restricted. Example: 'projects/,scratch/'.",
+          "description": "Optional comma-separated vault-relative folder allowlist for writes. Same syntax as OBSIDIAN_READ_PATHS. Unset = full vault, or the read scope when reads are restricted; paths in OBSIDIAN_DENY_PATHS stay denied. Example: 'projects/,scratch/'.",
+          "format": "string",
+          "isRequired": false
+        },
+        {
+          "name": "OBSIDIAN_DENY_PATHS",
+          "description": "Optional comma-separated vault-relative paths withheld from reads and writes. Same syntax as OBSIDIAN_READ_PATHS. Wins over both allowlists; denied paths are left out of listings, search results, and tag counts. Unset = nothing denied. Example: 'private/,journal/therapy/'.",
           "format": "string",
           "isRequired": false
         },