# Security Notes

The plugin is the only component that can read or write the Obsidian vault through the Obsidian API. The MCP server can only call the local bridge with the bearer token generated by the plugin.

The token is stored in Obsidian SecretStorage when available. Older or incompatible Obsidian builds fall back to plugin data so local development still works; the settings UI labels this fallback explicitly.

## Trust Boundaries

- Obsidian plugin: trusted local vault access.
- Loopback bridge: token-protected, bound to `127.0.0.1`.
- MCP adapter: local stdio process launched by a host.
- MCP host/model: untrusted for privacy purposes; it may send tool results to a cloud model.

## Data Exposure Rules

- Regular Markdown notes are included by default.
- Users can exclude folders, exact files, or tags before connecting an MCP host.
- Hidden folders, Obsidian config folders, trash folders, git folders, and traversal paths are always denied.
- The bridge and MCP tools cap output and paginate broad results.
- Full note reads require an exact path.
- Write tools are disabled by default. When enabled, they can only create or edit non-excluded Markdown notes and Obsidian `.base` files; file deletion and command execution are not exposed.

## Embeddings

Embeddings are disabled unless `OBSIDIAN_MCP_EMBEDDINGS=on`.

When enabled, chunks are sent to the configured OpenAI-compatible embedding endpoint. Local LM Studio or Ollama-compatible proxies are the safest choices. Cloud embedding providers may receive note chunks.