Obsidian MCP servers compared: count the tools that can change your notes
By Matthew Firth, founder of ModelBrain · Oct 14, 2026 · 6 min readAn Obsidian MCP server lets an AI assistant search, read and often edit your notes through a standard set of tools. Here is our own proposal, not an industry standard: compare servers by their write surface, the number of tools that can create, change or delete a note, plus whether a read-only switch removes them. The install steps differ. The write surface is the size of the mistake an assistant can make in your vault.
What an Obsidian MCP server is
MCP, the Model Context Protocol, is the standard way an AI assistant calls outside tools. An Obsidian vault is a folder of Markdown files, so a server can reach it two ways. It can run inside Obsidian as a plugin, which means Obsidian has to be open. Or it can read the folder directly, which means Obsidian can be closed. Our Does Obsidian have AI? article covers the wider picture, including plugins that are not MCP servers. This page is about the servers themselves.
The write surface, defined
For each server we count the tools whose own documentation says they create, append to, patch, move, rename or delete notes. We note separately any tool that runs arbitrary Obsidian commands, because a command can do anything the command palette can. And we note whether the documentation describes a read-only switch that removes those tools, as opposed to relying on the assistant to behave.
A bigger number is not automatically worse, and some servers put guards on their write tools, which we note below. But the count tells you how much you are trusting the assistant before you have read a single answer.
Six options, checked October 14, 2026
| Server | Tools listed | Tools that change notes | Read-only switch | Obsidian must be open | Source |
|---|---|---|---|---|---|
| mcp-obsidian (MarkusPfundstein) | 7 | 3: patch_content, append_content, delete_file | None described | Yes. Needs the Local REST API plugin running | GitHub README |
| Local REST API plugin, built-in MCP (v5.4.0) | 20 | 6: vault_write, vault_append, vault_patch, vault_delete, vault_move, vault_copy. Also command_execute, which runs any Obsidian command | None described | Yes. It runs inside Obsidian (desktop only) | Plugin page |
| MCP Connector (istefox, v3.0.2) | 64 | Not labeled on the page. It includes delete tools such as delete_vault_file and delete_vault_directory | No global read-only mode. A per-token tool limit is off by default. Command execution is off by default and gated | Yes. The server runs inside Obsidian | Plugin page |
| MCPVault (v0.16.0) | The page names 9, not a full inventory | Includes patch_note, delete_note and move_file | Yes: --read-only, since v0.15.0 | No. It reads vault files directly | mcpvault.org |
| obsidian-mcp-server (marcelmarais) | 4 | 1: updateFileContent, which creates or overwrites a file. No delete tool is listed | None described | No. It reads the filesystem directly | mcpservers.org listing |
| ModelBrain folder connector | Memory tools only | 0. No tool writes a note file. Its save, recall and forget tools change ModelBrain's own memory, not your Markdown | Not needed, because no tool writes a note file | No. It reads the folder | Obsidian guide |
What the table shows
Read-only is rare. Of the five Obsidian servers in the table, only MCPVault documents a switch that removes its write tools. For the others, safety rests on the assistant's behavior, your client's confirmation prompts, and whatever guards the server adds. Other Obsidian servers exist and some may have read-only modes.
Three of the six need Obsidian open. If you want an assistant to answer from your notes while Obsidian is closed, that column rules them out. We wrote a short page on how to test that yourself.
Guards lower the damage, not the count. The MCP Connector page says some of its tools take preconditions such as expectedContent, some tools default to a dry run, and command execution stays off until you allow a command. MCPVault's page says delete_note can send a note to Obsidian's .trash or the system trash. The Local REST API page says vault_delete moves files to the trash by default. Those make a mistake recoverable. They do not make the surface smaller.
How to choose
You want answers from your notes, nothing more. Pick a server with no write tools or a documented read-only switch, and try it on a copy of the vault first.
You want the assistant to write and edit notes. Pick one with guards, turn on any per-tool limits it offers, keep a backup, and start on a copy.
Read-only protects your notes, not your privacy. Whatever the assistant retrieves still goes to its AI provider. That is a separate question, covered in what leaves your computer when you use an AI memory tool.
Where ModelBrain sits
ModelBrain is a local memory, not an Obsidian server. You add the vault folder and it reads the Markdown files where they sit. Its write surface on your notes is zero: no tool writes a note file, and writing back to the vault is out of scope. Its own save, recall and forget tools change ModelBrain's index and memories, which live apart from your Markdown.
If you want an assistant to create or edit notes, ModelBrain is the wrong tool and one of the servers above is the right one. If you want the same notes answerable from Claude, ChatGPT and Cursor with Obsidian closed, the Obsidian guide lists 36 tested behaviors and its limits: sync is not instant, images and scanned PDFs are skipped, and ModelBrain keeps no earlier versions of a note. ModelBrain is independent and is not affiliated with or endorsed by Obsidian.
Sources
- mcp-obsidian, MarkusPfundstein, GitHub
- Local REST API with MCP, Obsidian community plugins
- MCP Connector, istefox, Obsidian community plugins
- MCPVault
- Obsidian MCP Server, marcelmarais, mcpservers.org
- Use ModelBrain with an Obsidian vault, modelbrain.net
Common questions
What is an Obsidian MCP server? A program that lets an AI assistant search, read and often edit the notes in an Obsidian vault through the Model Context Protocol. Some run as plugins inside Obsidian and need it open. Others read the vault folder directly.
Can an Obsidian MCP server delete my notes? Yes, if it exposes a delete tool. mcp-obsidian lists delete_file and the Local REST API plugin lists vault_delete. MCPVault documents a --read-only option that exposes only read tools.
Does Obsidian have to be open for an MCP server to work? It depends on the design. Servers that run as plugins, or that call the Local REST API plugin, need Obsidian open. MCPVault and the marcelmarais server read the folder directly and do not.
Last checked October 14, 2026. Tool lists and settings change often, so confirm a detail on the project's own page before relying on it.