Vault Cortex MCP Setup & Guide

{
  "id": "io.github.aliasunder/vault-cortex",
  "type": "mcp-server",
  "version": "0.54.8",
  "displayName": "Vault Cortex",
  "description": "Standalone MCP server for Obsidian vaults — hybrid search, notes & files, memory, tasks, OAuth 2.1",
  "repository": {
    "url": "https://github.com/aliasunder/vault-cortex",
    "source": "github"
  },
  "homepage": "https://github.com/aliasunder/vault-cortex",
  "distribution": {
    "packages": [
      {
        "registryType": "oci",
        "identifier": "ghcr.io/aliasunder/vault-cortex:0.54.8",
        "runtimeHint": "docker",
        "transport": "streamable-http",
        "environmentVariables": [
          {
            "name": "MCP_AUTH_TOKEN",
            "description": "Bearer token for MCP client authentication. Must match the Authorization header sent by clients. Generate with: openssl rand -hex 32",
            "isRequired": true,
            "isSecret": true
          },
          {
            "name": "PUBLIC_URL",
            "description": "Public URL clients use to reach this server. Used as the OAuth issuer URL in discovery metadata. Override when exposing the server outside localhost or on a non-default port."
          },
          {
            "name": "EMBEDDING_ENABLED",
            "description": "Enable or disable the embedding pipeline. When false, no ONNX model is downloaded, no vector tables are created, and search uses FTS5 only."
          },
          {
            "name": "RERANK_MODE",
            "description": "Cross-encoder reranking mode: blended (position-aware score blending after RRF fusion) or none (skip reranking). Only takes effect when EMBEDDING_ENABLED is true."
          },
          {
            "name": "WINDOWS_MODE",
            "description": "Windows bind-mount mode: enables filesystem polling for the file watcher and rename-based moves across the Docker Desktop/WSL2 bridge. Set to true when the vault lives on a Windows drive."
          },
          {
            "name": "MEMORY_ENABLED",
            "description": "Enable or disable the structured memory layer. When false, memory tools are hidden, bootstrap is skipped, and server metadata omits memory references."
          },
          {
            "name": "FILE_TOOLS_ENABLED",
            "description": "Enable or disable file tools (vault_read_file, vault_list_files). When false, file tools are hidden and server metadata omits file tool references."
          },
          {
            "name": "READONLY_MODE",
            "description": "Run the server read-only: every vault-writing tool is hidden, the memory folder is not auto-created, and server metadata omits write references."
          },
          {
            "name": "DISABLED_TOOLS",
            "description": "Hide individual tools by name, comma-separated. Subtractive only — it cannot re-enable a tool another setting hides; an unknown tool name stops the server at startup."
          },
          {
            "name": "MEMORY_DIR",
            "description": "Vault folder for structured memory files (About Me-style notes). Memory tools are hidden when MEMORY_ENABLED is false, but this value still feeds the defaults for PROTECTED_PATHS and ORPHAN_EXCLUDE_FOLDERS."
          },
          {
            "name": "DAILY_NOTES_FOLDER",
            "description": "Vault folder for daily notes. Overrides the folder configured in Obsidian's daily-notes plugin. When unset, read from the vault's .obsidian/daily-notes.json, falling back to \"Daily Notes\"."
          },
          {
            "name": "DAILY_NOTES_FORMAT",
            "description": "Filename date format for daily notes (Moment.js tokens). Overrides the format configured in Obsidian's daily-notes plugin. When unset, read from the vault's .obsidian/daily-notes.json, falling back to \"YYYY-MM-DD\"."
          },
          {
            "name": "TRUST_PROXY_HOPS",
            "description": "Number of trusted reverse-proxy hops used to derive the client IP from X-Forwarded-For for OAuth rate limiting and request logs. With 0, injected forwarding headers are ignored."
          },
          {
            "name": "TRUST_FORWARDED_HOPS",
            "description": "How many entries from the end of the RFC 7239 Forwarded header's for= list to count to reach the client IP for OAuth rate limiting and request logs. 0 ignores the header; 1 when the proxy in front writes it (e.g. AWS API Gateway); 2 when a CDN fronts that proxy and is the only way to reach it."
          },
          {
            "name": "TZ",
            "description": "IANA timezone for timestamps and daily note resolution."
          },
          {
            "name": "LOG_LEVEL",
            "description": "Logging verbosity."
          },
          {
            "name": "LOG_DIR",
            "description": "Directory for log files that survive container re-creation. The container's own log is always written but discarded when the container is recreated; date-stamped files under LOG_DIR persist on the data volume. Default: /data/logs (remote image), $STORAGE_ROOT/data/logs (single-volume mode), none (local image). none keeps only the container log."
          },
          {
            "name": "LOG_RETENTION_DAYS",
            "description": "Days to keep log files before automatic cleanup on startup; only applies when LOG_DIR is a path."
          },
          {
            "name": "PROTECTED_PATHS",
            "description": "Comma-separated vault folder names blocked from vault_delete_note and vault_move_note. Default: MEMORY_DIR plus the daily notes folder, read from DAILY_NOTES_FOLDER or .obsidian/daily-notes.json (default Daily Notes). When set, overrides the default entirely."
          },
          {
            "name": "ORPHAN_EXCLUDE_FOLDERS",
            "description": "Comma-separated vault folder names excluded from vault_find_orphans. Default: DAILY_NOTES_FOLDER (else \"Daily Notes\"), \"Templates\", MEMORY_DIR."
          },
          {
            "name": "SERVICE_DOCUMENTATION_URL",
            "description": "Override the OAuth service documentation URL exposed via discovery metadata."
          },
          {
            "name": "MAX_FILE_BYTES",
            "description": "Largest file vault_read_file will read, in bytes. Reading a larger file returns an error instead of content."
          },
          {
            "name": "MAX_IMAGE_OUTPUT_BYTES",
            "description": "Byte budget for images returned by vault_read_file, in binary bytes before base64 encoding. Images exceeding the budget are downscaled/recompressed server-side to fit; raise for clients that accept larger tool responses."
          },
          {
            "name": "MAX_PDF_RENDER_PAGES",
            "description": "Maximum PDF pages to render as images when raw: true is set on vault_read_file. The per-page byte budget is MAX_IMAGE_OUTPUT_BYTES divided evenly across the rendered pages."
          }
        ]
      }
    ],
    "remotes": []
  },
  "dependencies": [],
  "installTargets": [
    "claude-code",
    "claude-desktop",
    "cursor",
    "vscode",
    "trae",
    "cherry-studio",
    "lingma",
    "windsurf",
    "cline",
    "workbuddy"
  ],
  "keywords": [],
  "provenance": {
    "origin": "official-mcp-registry",
    "originalId": "io.github.aliasunder/vault-cortex",
    "originalUrl": "https://registry.modelcontextprotocol.io/v0.1/servers/io.github.aliasunder%2Fvault-cortex/versions/latest",
    "isOfficial": true,
    "status": "active"
  }
}