Vault Cortex

by aliasunder·io.github.aliasunder/vault-cortex·v0.52.1

No reviews yet

Standalone MCP server for Obsidian vaults — hybrid search, notes & files, memory, tasks, OAuth 2.1

B80/100grade B

Write a review Install

What users say

No reviews yet

Be the first

Safety scan

B80/100

full report

Adoption

Not measured yet

Usage numbers are collected on the next scan

Reviews

Write one

Nobody has reviewed Vault Cortex yet.

If you have run it, two minutes of your experience saves the next person an afternoon.

Tools

Tool lists for local packages are only visible after install.

Public scan report

scanner v0.1.2 · 2026-09-18 · same rubric, same numbers if you re-run it

no findings

–Code scanpackage could not be scannedn/a
–Live reliabilityno gateway calls yet and no remote to proben/a
Tool poisoningonly the listing description was available15/15
Auth qualitystatic API keys via environment variables6/15
Maintenancelast push 0 days ago15/15
Maintainer identityregistry namespace matches repository owner; GitHub account older than a year8/10

Overall 80/100. Components that don't apply are left out of the denominator. Any critical finding is an F.Rubric Appeal a finding JSON

Install directly

claude mcp add vault-cortex -- docker run -i --rm ghcr.io/aliasunder/vault-cortex:0.52.1

Add to Cursor

Alternatives to Vault Cortex

Same job, ranked by rating then adoption.

See all →

Slack
Read and write Slack with session tokens — no OAuth, no bot, no admin approval.
not reviewed
—
A
Mindwtr
Task and project automation for local and self-hosted Mindwtr Cloud data; read-only by default.
not reviewed
—
A
OrchestKit Docs MCP
Read-only MCP server for the OrchestKit docs: full-text search + Markdown fetch. No auth.
not reviewed
—
A
google-calendar-mcp
Google Calendar over MCP: calendars, events, recurrence and availability.
not reviewed
—
A
kanban
A local task board per project: columns, due dates, estimates, priorities, overdue, weekly review.
not reviewed
—
A

Vault Cortex vs Slack Vault Cortex vs Mindwtr Vault Cortex vs OrchestKit Docs MCP

Run it through the gateway

Local package. It runs on your machine, not through the gateway.

Rating: —
Safety grade: B · 80/100
Stars: –
Downloads/wk: –
Price: Free
Licence: —
Transport: Local · oci
Version: 0.52.1
Category: Productivity
Last release: —

Credentials it needs

MCP_AUTH_TOKENsecretBearer token for MCP client authentication. Must match the Authorization header sent by clients. Generate with: openssl rand -hex 32
PUBLIC_URLPublic URL clients use to reach this server. Used as the OAuth issuer URL in discovery metadata. Override when exposing the server outside localhost or on a non-default port.
EMBEDDING_ENABLEDEnable or disable the embedding pipeline. When false, no ONNX model is downloaded, no vector tables are created, and search uses FTS5 only.
RERANK_MODECross-encoder reranking mode: blended (position-aware score blending after RRF fusion) or none (skip reranking). Only takes effect when EMBEDDING_ENABLED is true.
WINDOWS_MODEWindows bind-mount mode: enables filesystem polling for the file watcher and rename-based moves across the Docker Desktop/WSL2 bridge. Set to true when the vault lives on a Windows drive.
MEMORY_ENABLEDEnable or disable the structured memory layer. When false, memory tools are hidden, bootstrap is skipped, and server metadata omits memory references.
FILE_TOOLS_ENABLEDEnable or disable file tools (vault_read_file, vault_list_files). When false, file tools are hidden and server metadata omits file tool references.
READONLY_MODERun the server read-only: every vault-writing tool is hidden, the memory folder is not auto-created, and server metadata omits write references.
DISABLED_TOOLSHide individual tools by name, comma-separated. Subtractive only — it cannot re-enable a tool another setting hides; an unknown tool name stops the server at startup.
MEMORY_DIRVault folder for structured memory files (About Me-style notes). Memory tools are hidden when MEMORY_ENABLED is false, but this value still feeds the defaults for PROTECTED_PATHS and ORPHAN_EXCLUDE_FOLDERS.
DAILY_NOTES_FOLDERVault folder for daily notes. Overrides the folder configured in Obsidian's daily-notes plugin. When unset, read from the vault's .obsidian/daily-notes.json, falling back to "Daily Notes".
DAILY_NOTES_FORMATFilename date format for daily notes (Moment.js tokens). Overrides the format configured in Obsidian's daily-notes plugin. When unset, read from the vault's .obsidian/daily-notes.json, falling back to "YYYY-MM-DD".
TRUST_PROXY_HOPSNumber of trusted reverse-proxy hops used to derive the client IP from X-Forwarded-For for OAuth rate limiting and request logs. With 0, injected forwarding headers are ignored.
TRUST_FORWARDED_HOPSHow many entries from the end of the RFC 7239 Forwarded header's for= list to count to reach the client IP for OAuth rate limiting and request logs. 0 ignores the header; 1 when the proxy in front writes it (e.g. AWS API Gateway); 2 when a CDN fronts that proxy and is the only way to reach it.
TZIANA timezone for timestamps and daily note resolution.
LOG_LEVELLogging verbosity.
LOG_DIRDirectory for log files that survive container re-creation. The container's own log is always written but discarded when the container is recreated; date-stamped files under LOG_DIR persist on the data volume. Default: /data/logs (remote image), $STORAGE_ROOT/data/logs (single-volume mode), none (local image). none keeps only the container log.
LOG_RETENTION_DAYSDays to keep log files before automatic cleanup on startup; only applies when LOG_DIR is a path.
PROTECTED_PATHSComma-separated vault folder names blocked from vault_delete_note and vault_move_note. Default: MEMORY_DIR plus the daily notes folder, read from DAILY_NOTES_FOLDER or .obsidian/daily-notes.json (default Daily Notes). When set, overrides the default entirely.
ORPHAN_EXCLUDE_FOLDERSComma-separated vault folder names excluded from vault_find_orphans. Default: DAILY_NOTES_FOLDER (else "Daily Notes"), "Templates", MEMORY_DIR.
SERVICE_DOCUMENTATION_URLOverride the OAuth service documentation URL exposed via discovery metadata.
MAX_FILE_BYTESLargest file vault_read_file will read, in bytes. Reading a larger file returns an error instead of content.
MAX_IMAGE_OUTPUT_BYTESByte budget for images returned by vault_read_file, in binary bytes before base64 encoding. Images exceeding the budget are downscaled/recompressed server-side to fit; raise for clients that accept larger tool responses.
MAX_PDF_RENDER_PAGESMaximum PDF pages to render as images when raw: true is set on vault_read_file. The per-page byte budget is MAX_IMAGE_OUTPUT_BYTES divided evenly across the rendered pages.

Own this server?

Claim it to keep the listing current and reply to reviews. Claiming never changes the grade or hides a review.

Claim listing