rps321321/obsidian-mcp-pro

What's New in v1.1.0

Security Fixes (Critical)

• Fixed path traversal vulnerability in MCP resource handler
• Fixed path traversal prefix bypass in resolveVaultPath
• Added null byte rejection in path validation
• Validated trash path against traversal attacks
• Fixed noteExists bypassing path validation

Bug Fixes

• Fixed content duplication in get_note and get_daily_note (frontmatter shown twice)
• Replaced broken YAML frontmatter serializer with gray-matter stringify
• Fixed tilde fence (~~~) detection in code block tracker
• Converted sync I/O to async in tags resource handler
• Fixed ensureNewline creating double newlines in append_to_note

Protocol Compliance

• Added isError: true to all error responses across all 23 tools
• Changed resource template URI to support slashes in paths
• Added .min(1) validation to all path parameters

Correctness

• Strip #heading and ^block-ref before wikilink resolution
• Case-insensitive wikilink resolution
• Unicode tag support (CJK, Cyrillic, Latin Extended)
• Tag regex no longer matches ATX headings
• Support singular tag and alias frontmatter keys
• Added maxResults to search_by_tag, find_orphans, find_broken_links

Platform

• Respect XDG_CONFIG_HOME on Linux
• Case-insensitive directory exclusion
• Add .git to excluded directories

Packaging

• Removed unused glob dependency
• Bumped engines to >=18.17.0
• Added homepage and bugs fields

Install

{
  "mcpServers": {
    "obsidian": {
      "command": "npx",
      "args": ["-y", "obsidian-mcp-pro"]
    }
  }
}