{ "slug": "io-github-aliasunder-vault-cortex", "name": "io.github.aliasunder/vault-cortex", "title": "Vault Cortex", "description": "Standalone MCP server for Obsidian vaults — hybrid search, notes & files, memory, tasks, OAuth 2.1", "version": "0.55.3", "publishedAt": "2026-10-24T23:19:44.419169Z", "updatedAt": "2026-10-24T23:19:44.419169Z", "repoUrl": "https://github.com/aliasunder/vault-cortex", "websiteUrl": "https://github.com/aliasunder/vault-cortex", "namespace": { "type": "github", "owner": "aliasunder" }, "kind": "local", "packages": [ { "registryType": "oci", "identifier": "ghcr.io/aliasunder/vault-cortex:0.55.3", "version": null, "transport": "streamable-http", "runtimeHint": "docker" } ], "remotes": [], "envVars": [ { "name": "MCP_AUTH_TOKEN", "isSecret": true, "isRequired": true, "description": "Bearer token for MCP client authentication. Must match the Authorization header sent by clients. Generate with: openssl rand -hex 32" }, { "name": "PUBLIC_URL", "isSecret": false, "isRequired": false, "description": "Public URL clients use to reach this server. Used as the OAuth issuer URL in discovery metadata. Override when exposing the server outside localhost or on a non-default port." }, { "name": "EMBEDDING_ENABLED", "isSecret": false, "isRequired": false, "description": "Enable or disable the embedding pipeline. When false, no ONNX model is downloaded, no vector tables are created, and search uses FTS5 only." }, { "name": "RERANK_MODE", "isSecret": false, "isRequired": false, "description": "Cross-encoder reranking mode: blended (position-aware score blending after RRF fusion) or none (skip reranking). Only takes effect when EMBEDDING_ENABLED is true." }, { "name": "WINDOWS_MODE", "isSecret": false, "isRequired": false, "description": "Windows bind-mount mode: enables filesystem polling for the file watcher and rename-based moves across the Docker Desktop/WSL2 bridge. Set to true when the vault lives on a Windows drive." }, { "name": "MEMORY_ENABLED", "isSecret": false, "isRequired": false, "description": "Enable or disable the structured memory layer. When false, memory tools are hidden, bootstrap is skipped, and server metadata omits memory references." }, { "name": "FILE_TOOLS_ENABLED", "isSecret": false, "isRequired": false, "description": "Enable or disable file tools (vault_read_file, vault_list_files). When false, file tools are hidden and server metadata omits file tool references." }, { "name": "READONLY_MODE", "isSecret": false, "isRequired": false, "description": "Run the server read-only: every vault-writing tool is hidden, the memory folder is not auto-created, and server metadata omits write references." }, { "name": "DISABLED_TOOLS", "isSecret": false, "isRequired": false, "description": "Hide individual tools by name, comma-separated. Subtractive only — it cannot re-enable a tool another setting hides; an unknown tool name stops the server at startup." }, { "name": "MEMORY_DIR", "isSecret": false, "isRequired": false, "description": "Vault folder for structured memory files (About Me-style notes). Memory tools are hidden when MEMORY_ENABLED is false, but this value still feeds the defaults for PROTECTED_PATHS and ORPHAN_EXCLUDE_FOLDERS." }, { "name": "DAILY_NOTES_FOLDER", "isSecret": false, "isRequired": false, "description": "Vault folder for daily notes. Overrides the folder configured in Obsidian's daily-notes plugin. When unset, read from the vault's .obsidian/daily-notes.json (an empty folder there follows Obsidian's new-note location), falling back to \"Daily Notes\" when that file is missing or unreadable. Set to / for the vault root." }, { "name": "DAILY_NOTES_FORMAT", "isSecret": false, "isRequired": false, "description": "Filename date format for daily notes (Moment.js tokens). Overrides the format configured in Obsidian's daily-notes plugin. When unset, read from the vault's .obsidian/daily-notes.json, falling back to \"YYYY-MM-DD\"." }, { "name": "TRUST_PROXY_HOPS", "isSecret": false, "isRequired": false, "description": "Number of trusted reverse-proxy hops used to derive the client IP from X-Forwarded-For for OAuth rate limiting and request logs. With 0, injected forwarding headers are ignored." }, { "name": "TRUST_FORWARDED_HOPS", "isSecret": false, "isRequired": false, "description": "How many entries from the end of the RFC 7239 Forwarded header's for= list to count to reach the client IP for OAuth rate limiting and request logs. 0 ignores the header; 1 when the proxy in front writes it (e.g. AWS API Gateway); 2 when a CDN fronts that proxy and is the only way to reach it." }, { "name": "TZ", "isSecret": false, "isRequired": false, "description": "IANA timezone for timestamps and daily note resolution." }, { "name": "LOG_LEVEL", "isSecret": false, "isRequired": false, "description": "Logging verbosity." }, { "name": "LOG_DIR", "isSecret": false, "isRequired": false, "description": "Directory for log files that survive container re-creation. The container's own log is always written but discarded when the container is recreated; date-stamped files under LOG_DIR persist on the data volume. Default: /data/logs (remote image), $STORAGE_ROOT/data/logs (single-volume mode), none (local image). none keeps only the container log." }, { "name": "LOG_RETENTION_DAYS", "isSecret": false, "isRequired": false, "description": "Days to keep log files before automatic cleanup on startup; only applies when LOG_DIR is a path." }, { "name": "PROTECTED_PATHS", "isSecret": false, "isRequired": false, "description": "Comma-separated vault folder names blocked from vault_delete_note and vault_move_note. Default: MEMORY_DIR plus the daily notes folder, read from DAILY_NOTES_FOLDER or .obsidian/daily-notes.json (default Daily Notes; none when that setting is the vault root or empty). When set, overrides the default entirely." }, { "name": "ORPHAN_EXCLUDE_FOLDERS", "isSecret": false, "isRequired": false, "description": "Comma-separated vault folder names excluded from vault_find_orphans. Default: the daily notes folder, \"Templates\", and MEMORY_DIR. DAILY_NOTES_FOLDER wins; otherwise .obsidian/daily-notes.json is read per query (fallback \"Daily Notes\"; no daily folder when that setting is the vault root or empty). When set, replaces the defaults entirely. Set to a comma (,) to exclude nothing; an empty value uses the defaults." }, { "name": "SERVICE_DOCUMENTATION_URL", "isSecret": false, "isRequired": false, "description": "Override the OAuth service documentation URL exposed via discovery metadata." }, { "name": "MAX_FILE_BYTES", "isSecret": false, "isRequired": false, "description": "Largest file vault_read_file will read, in bytes. Reading a larger file returns an error instead of content." }, { "name": "MAX_IMAGE_OUTPUT_BYTES", "isSecret": false, "isRequired": false, "description": "Byte budget for images returned by vault_read_file, in binary bytes before base64 encoding. Images exceeding the budget are downscaled/recompressed server-side to fit; raise for clients that accept larger tool responses." }, { "name": "MAX_PDF_RENDER_PAGES", "isSecret": false, "isRequired": false, "description": "Maximum PDF pages to render as images when raw: true is set on vault_read_file. The per-page byte budget is MAX_IMAGE_OUTPUT_BYTES divided evenly across the rendered pages." } ], "category": "files-docs", "subcategory": "local", "company": "", "categoryAuto": true, "checks": [ { "id": "source-linked", "label": "Source repository linked", "result": "pass", "detail": "https://github.com/aliasunder/vault-cortex" }, { "id": "version-pinned", "label": "Version pinned", "result": "pass", "detail": "Every package has an explicit version" }, { "id": "secrets-requested", "label": "Secrets requested", "result": "info", "detail": "Asks for 1 secret: MCP_AUTH_TOKEN" }, { "id": "known-registry", "label": "Known package registry", "result": "pass", "detail": "All packages come from npm, PyPI, OCI, NuGet or MCPB" }, { "id": "namespace", "label": "Namespace ownership", "result": "info", "detail": "Name verified via GitHub account aliasunder" }, { "id": "meta-text", "label": "Registry text aimed at the AI", "result": "pass", "detail": "Description and settings contain no hidden characters or instructions to the AI" }, { "id": "code-flags", "label": "Code red flags", "result": "info", "detail": "oci packages are not read yet" } ], "scannedAt": "2026-10-29", "level": "Scanned", "install": [ { "label": "Claude Desktop (oci)", "kind": "claude_desktop_json", "text": "{\n \"mcpServers\": {\n \"vault-cortex\": {\n \"command\": \"docker\",\n \"args\": [\n \"run\",\n \"-i\",\n \"--rm\",\n \"-e\",\n \"MCP_AUTH_TOKEN\",\n \"ghcr.io/aliasunder/vault-cortex:0.55.3\"\n ],\n \"env\": {\n \"MCP_AUTH_TOKEN\": \"\"\n }\n }\n }\n}" } ], "curated": true, "stars": 32, "archived": false, "pushedAt": "2026-10-26T21:58:04Z", "health": { "score": 62, "parts": { "popularity": 0.2266926199680068, "activity": 1, "issues": null, "security": 1 }, "fail": 0, "warn": 0, "raw": { "stars": 32, "forks": 4, "downloads": null, "hn": { "n": 1, "pts": 1, "t": [ [ "48833407", "Show HN: Vault-cortex – Access your Obsidian vault from any device via MCP", 1, 0, "2026-07-08" ] ] }, "issuesOpen": 1, "issuesClosed": 7, "prsMerged": 680, "commits90": 459, "release": "2026-10-31T02:52:11Z", "pushed": "2026-10-26T21:58:04Z", "growth": null, "growthDays": null, "archived": false }, "at": "2026-10-31T07:42:38.200Z" } }