server.json

{
  "$schema": "https://static.modelcontextprotocol.io/schemas/2025-12-11/server.schema.json",
  "name": "io.github.aliasunder/vault-cortex",
  "title": "Vault Cortex",
  "description": "Standalone MCP server for Obsidian vaults — hybrid search, notes & files, memory, tasks, OAuth 2.1",
  "version": "0.48.3",
  "websiteUrl": "https://github.com/aliasunder/vault-cortex",
  "repository": {
    "url": "https://github.com/aliasunder/vault-cortex",
    "source": "github",
    "id": "1226067541"
  },
  "packages": [
    {
      "registryType": "oci",
      "identifier": "ghcr.io/aliasunder/vault-cortex:0.48.3",
      "runtimeHint": "docker",
      "runtimeArguments": [
        {
          "type": "named",
          "name": "-p",
          "description": "Publish the container's port 8000 on the host.",
          "value": "8000:8000"
        },
        {
          "type": "named",
          "name": "-v",
          "description": "Bind-mount your Obsidian vault into the container at /vault.",
          "value": "{VAULT_PATH}:/vault:rw",
          "isRequired": true,
          "variables": {
            "VAULT_PATH": {
              "description": "Absolute path to your Obsidian vault on the host machine.",
              "isRequired": true,
              "format": "filepath"
            }
          }
        },
        {
          "type": "named",
          "name": "-v",
          "description": "Named volume for persistent state under /data — search index, OAuth token DB, and any log files. Keeps OAuth sessions alive across container restarts.",
          "value": "vault-cortex-data:/data"
        }
      ],
      "transport": {
        "type": "streamable-http",
        "url": "http://localhost:8000/mcp",
        "headers": [
          {
            "name": "Authorization",
            "description": "Bearer token used by the MCP client. Must match the MCP_AUTH_TOKEN env var passed to the container.",
            "value": "Bearer {MCP_AUTH_TOKEN}",
            "isRequired": true,
            "isSecret": true,
            "variables": {
              "MCP_AUTH_TOKEN": {
                "description": "Bearer token for MCP client authentication. Generate with: openssl rand -hex 32",
                "isRequired": true,
                "isSecret": true
              }
            }
          }
        ]
      },
      "environmentVariables": [
        {
          "name": "MCP_AUTH_TOKEN",
          "description": "Bearer token for MCP client authentication. Must match the Authorization header sent by clients. Generate with: openssl rand -hex 32",
          "isRequired": true,
          "isSecret": true
        },
        {
          "name": "PUBLIC_URL",
          "description": "Public URL clients use to reach this server. Used as the OAuth issuer URL in discovery metadata. Override when exposing the server outside localhost or on a non-default port.",
          "default": "http://localhost:8000"
        },
        {
          "name": "EMBEDDING_ENABLED",
          "description": "Enable or disable the embedding pipeline. When false, no ONNX model is downloaded, no vector tables are created, and search uses FTS5 only.",
          "default": "true"
        },
        {
          "name": "RERANK_MODE",
          "description": "Cross-encoder reranking mode: blended (position-aware score blending after RRF fusion) or none (skip reranking). Only takes effect when EMBEDDING_ENABLED is true.",
          "default": "blended",
          "choices": ["blended", "none"]
        },
        {
          "name": "WINDOWS_MODE",
          "description": "Windows bind-mount mode: enables filesystem polling for the file watcher and rename-based moves across the Docker Desktop/WSL2 bridge. Set to true when the vault lives on a Windows drive.",
          "default": "false"
        },
        {
          "name": "MEMORY_ENABLED",
          "description": "Enable or disable the structured memory layer. When false, memory tools are hidden, bootstrap is skipped, and server metadata omits memory references.",
          "default": "true"
        },
        {
          "name": "FILE_TOOLS_ENABLED",
          "description": "Enable or disable file tools (vault_read_file, vault_list_files). When false, file tools are hidden and server metadata omits file tool references.",
          "default": "true"
        },
        {
          "name": "READONLY_MODE",
          "description": "Run the server read-only: every vault-writing tool is hidden, the memory folder is not auto-created, and server metadata omits write references.",
          "default": "false"
        },
        {
          "name": "DISABLED_TOOLS",
          "description": "Hide individual tools by name, comma-separated. Subtractive only — it cannot re-enable a tool another setting hides; an unknown tool name stops the server at startup.",
          "default": ""
        },
        {
          "name": "MEMORY_DIR",
          "description": "Vault folder for structured memory files (About Me-style notes). Memory tools are hidden when MEMORY_ENABLED is false, but this value still feeds the defaults for PROTECTED_PATHS and ORPHAN_EXCLUDE_FOLDERS.",
          "default": "About Me"
        },
        {
          "name": "DAILY_NOTES_FOLDER",
          "description": "Vault folder for daily notes. Overrides the folder configured in Obsidian's daily-notes plugin.",
          "default": "Daily Notes"
        },
        {
          "name": "DAILY_NOTES_FORMAT",
          "description": "Filename date format for daily notes (Moment.js tokens). Overrides the format configured in Obsidian's daily-notes plugin.",
          "default": "YYYY-MM-DD"
        },
        {
          "name": "TRUST_PROXY_HOPS",
          "description": "Number of trusted reverse-proxy hops used to derive the client IP from X-Forwarded-For for OAuth rate limiting and request logs. With 0, injected forwarding headers are ignored.",
          "default": "0"
        },
        {
          "name": "TRUST_FORWARDED_HOPS",
          "description": "How many entries from the end of the RFC 7239 Forwarded header's for= list to count to reach the client IP for OAuth rate limiting and request logs. 0 ignores the header; 1 when the proxy in front writes it (e.g. AWS API Gateway); 2 when a CDN fronts that proxy and is the only way to reach it.",
          "default": "0"
        },
        {
          "name": "TZ",
          "description": "IANA timezone for timestamps and daily note resolution.",
          "default": "UTC"
        },
        {
          "name": "LOG_LEVEL",
          "description": "Logging verbosity.",
          "default": "info",
          "choices": ["debug", "info", "warn", "error"]
        },
        {
          "name": "LOG_DIR",
          "description": "Directory for log files that survive container re-creation. The container's own log is always written but discarded when the container is recreated; date-stamped files under LOG_DIR persist on the data volume. Default: /data/logs (remote image), none (local image). none keeps only the container log.",
          "format": "filepath"
        },
        {
          "name": "LOG_RETENTION_DAYS",
          "description": "Days to keep log files before automatic cleanup on startup; only applies when LOG_DIR is a path.",
          "default": "90",
          "format": "number"
        },
        {
          "name": "PROTECTED_PATHS",
          "description": "Comma-separated vault folder names blocked from vault_delete_note and vault_move_note. Default: MEMORY_DIR plus the daily notes folder, read from DAILY_NOTES_FOLDER or .obsidian/daily-notes.json (default Daily Notes). When set, overrides the default entirely."
        },
        {
          "name": "ORPHAN_EXCLUDE_FOLDERS",
          "description": "Comma-separated vault folder names excluded from vault_find_orphans. Default: \"Daily Notes\", \"Templates\", MEMORY_DIR."
        },
        {
          "name": "SERVICE_DOCUMENTATION_URL",
          "description": "Override the OAuth service documentation URL exposed via discovery metadata.",
          "default": "https://github.com/aliasunder/vault-cortex"
        },
        {
          "name": "MAX_FILE_BYTES",
          "description": "Largest file vault_read_file will read, in bytes. Reading a larger file returns an error instead of content.",
          "default": "52428800",
          "format": "number"
        },
        {
          "name": "MAX_IMAGE_OUTPUT_BYTES",
          "description": "Byte budget for images returned by vault_read_file, in binary bytes before base64 encoding. Images exceeding the budget are downscaled/recompressed server-side to fit; raise for clients that accept larger tool responses.",
          "default": "49152",
          "format": "number"
        },
        {
          "name": "MAX_PDF_RENDER_PAGES",
          "description": "Maximum PDF pages to render as images when raw: true is set on vault_read_file. The per-page byte budget is MAX_IMAGE_OUTPUT_BYTES divided evenly across the rendered pages.",
          "default": "5",
          "format": "number"
        }
      ]
    }
  ]
}