Vault Cortex

io.github.aliasunder/vault-cortex · v0.57.5

Standalone MCP server for Obsidian vaults — hybrid search, notes & files, memory, tasks, OAuth 2.1

Website Source code Set it up

Connect Runs on your machine

Terminal

claude mcp add vault-cortex -e MCP_AUTH_TOKEN=<MCP_AUTH_TOKEN> -e PUBLIC_URL=<PUBLIC_URL> -e EMBEDDING_ENABLED=<EMBEDDING_ENABLED> -e RERANK_MODE=<RERANK_MODE> -e WINDOWS_MODE=<WINDOWS_MODE> -e MEMORY_ENABLED=<MEMORY_ENABLED> -e FILE_TOOLS_ENABLED=<FILE_TOOLS_ENABLED> -e READONLY_MODE=<READONLY_MODE> -e DISABLED_TOOLS=<DISABLED_TOOLS> -e MEMORY_DIR=<MEMORY_DIR> -e DAILY_NOTES_FOLDER=<DAILY_NOTES_FOLDER> -e DAILY_NOTES_FORMAT=<DAILY_NOTES_FORMAT> -e TRUST_PROXY_HOPS=<TRUST_PROXY_HOPS> -e TRUST_FORWARDED_HOPS=<TRUST_FORWARDED_HOPS> -e TZ=<TZ> -e LOG_LEVEL=<LOG_LEVEL> -e LOG_DIR=<LOG_DIR> -e LOG_RETENTION_DAYS=<LOG_RETENTION_DAYS> -e LOG_MAX_DAILY_MB=<LOG_MAX_DAILY_MB> -e PROTECTED_PATHS=<PROTECTED_PATHS> -e ORPHAN_EXCLUDE_FOLDERS=<ORPHAN_EXCLUDE_FOLDERS> -e SERVICE_DOCUMENTATION_URL=<SERVICE_DOCUMENTATION_URL> -e MAX_FILE_BYTES=<MAX_FILE_BYTES> -e MAX_IMAGE_OUTPUT_BYTES=<MAX_IMAGE_OUTPUT_BYTES> -e MAX_PDF_RENDER_PAGES=<MAX_PDF_RENDER_PAGES> -- docker run -i --rm ghcr.io/aliasunder/vault-cortex:0.57.5

claude_desktop_config.json

{
  "mcpServers": {
    "vault-cortex": {
      "command": "docker",
      "args": [
        "run",
        "-i",
        "--rm",
        "ghcr.io/aliasunder/vault-cortex:0.57.5"
      ],
      "env": {
        "MCP_AUTH_TOKEN": "<MCP_AUTH_TOKEN>",
        "PUBLIC_URL": "<PUBLIC_URL>",
        "EMBEDDING_ENABLED": "<EMBEDDING_ENABLED>",
        "RERANK_MODE": "<RERANK_MODE>",
        "WINDOWS_MODE": "<WINDOWS_MODE>",
        "MEMORY_ENABLED": "<MEMORY_ENABLED>",
        "FILE_TOOLS_ENABLED": "<FILE_TOOLS_ENABLED>",
        "READONLY_MODE": "<READONLY_MODE>",
        "DISABLED_TOOLS": "<DISABLED_TOOLS>",
        "MEMORY_DIR": "<MEMORY_DIR>",
        "DAILY_NOTES_FOLDER": "<DAILY_NOTES_FOLDER>",
        "DAILY_NOTES_FORMAT": "<DAILY_NOTES_FORMAT>",
        "TRUST_PROXY_HOPS": "<TRUST_PROXY_HOPS>",
        "TRUST_FORWARDED_HOPS": "<TRUST_FORWARDED_HOPS>",
        "TZ": "<TZ>",
        "LOG_LEVEL": "<LOG_LEVEL>",
        "LOG_DIR": "<LOG_DIR>",
        "LOG_RETENTION_DAYS": "<LOG_RETENTION_DAYS>",
        "LOG_MAX_DAILY_MB": "<LOG_MAX_DAILY_MB>",
        "PROTECTED_PATHS": "<PROTECTED_PATHS>",
        "ORPHAN_EXCLUDE_FOLDERS": "<ORPHAN_EXCLUDE_FOLDERS>",
        "SERVICE_DOCUMENTATION_URL": "<SERVICE_DOCUMENTATION_URL>",
        "MAX_FILE_BYTES": "<MAX_FILE_BYTES>",
        "MAX_IMAGE_OUTPUT_BYTES": "<MAX_IMAGE_OUTPUT_BYTES>",
        "MAX_PDF_RENDER_PAGES": "<MAX_PDF_RENDER_PAGES>"
      }
    }
  }
}

~/.cursor/mcp.json

{
  "mcpServers": {
    "vault-cortex": {
      "command": "docker",
      "args": [
        "run",
        "-i",
        "--rm",
        "ghcr.io/aliasunder/vault-cortex:0.57.5"
      ],
      "env": {
        "MCP_AUTH_TOKEN": "<MCP_AUTH_TOKEN>",
        "PUBLIC_URL": "<PUBLIC_URL>",
        "EMBEDDING_ENABLED": "<EMBEDDING_ENABLED>",
        "RERANK_MODE": "<RERANK_MODE>",
        "WINDOWS_MODE": "<WINDOWS_MODE>",
        "MEMORY_ENABLED": "<MEMORY_ENABLED>",
        "FILE_TOOLS_ENABLED": "<FILE_TOOLS_ENABLED>",
        "READONLY_MODE": "<READONLY_MODE>",
        "DISABLED_TOOLS": "<DISABLED_TOOLS>",
        "MEMORY_DIR": "<MEMORY_DIR>",
        "DAILY_NOTES_FOLDER": "<DAILY_NOTES_FOLDER>",
        "DAILY_NOTES_FORMAT": "<DAILY_NOTES_FORMAT>",
        "TRUST_PROXY_HOPS": "<TRUST_PROXY_HOPS>",
        "TRUST_FORWARDED_HOPS": "<TRUST_FORWARDED_HOPS>",
        "TZ": "<TZ>",
        "LOG_LEVEL": "<LOG_LEVEL>",
        "LOG_DIR": "<LOG_DIR>",
        "LOG_RETENTION_DAYS": "<LOG_RETENTION_DAYS>",
        "LOG_MAX_DAILY_MB": "<LOG_MAX_DAILY_MB>",
        "PROTECTED_PATHS": "<PROTECTED_PATHS>",
        "ORPHAN_EXCLUDE_FOLDERS": "<ORPHAN_EXCLUDE_FOLDERS>",
        "SERVICE_DOCUMENTATION_URL": "<SERVICE_DOCUMENTATION_URL>",
        "MAX_FILE_BYTES": "<MAX_FILE_BYTES>",
        "MAX_IMAGE_OUTPUT_BYTES": "<MAX_IMAGE_OUTPUT_BYTES>",
        "MAX_PDF_RENDER_PAGES": "<MAX_PDF_RENDER_PAGES>"
      }
    }
  }
}

.vscode/mcp.json

{
  "servers": {
    "vault-cortex": {
      "type": "stdio",
      "command": "docker",
      "args": [
        "run",
        "-i",
        "--rm",
        "ghcr.io/aliasunder/vault-cortex:0.57.5"
      ],
      "env": {
        "MCP_AUTH_TOKEN": "<MCP_AUTH_TOKEN>",
        "PUBLIC_URL": "<PUBLIC_URL>",
        "EMBEDDING_ENABLED": "<EMBEDDING_ENABLED>",
        "RERANK_MODE": "<RERANK_MODE>",
        "WINDOWS_MODE": "<WINDOWS_MODE>",
        "MEMORY_ENABLED": "<MEMORY_ENABLED>",
        "FILE_TOOLS_ENABLED": "<FILE_TOOLS_ENABLED>",
        "READONLY_MODE": "<READONLY_MODE>",
        "DISABLED_TOOLS": "<DISABLED_TOOLS>",
        "MEMORY_DIR": "<MEMORY_DIR>",
        "DAILY_NOTES_FOLDER": "<DAILY_NOTES_FOLDER>",
        "DAILY_NOTES_FORMAT": "<DAILY_NOTES_FORMAT>",
        "TRUST_PROXY_HOPS": "<TRUST_PROXY_HOPS>",
        "TRUST_FORWARDED_HOPS": "<TRUST_FORWARDED_HOPS>",
        "TZ": "<TZ>",
        "LOG_LEVEL": "<LOG_LEVEL>",
        "LOG_DIR": "<LOG_DIR>",
        "LOG_RETENTION_DAYS": "<LOG_RETENTION_DAYS>",
        "LOG_MAX_DAILY_MB": "<LOG_MAX_DAILY_MB>",
        "PROTECTED_PATHS": "<PROTECTED_PATHS>",
        "ORPHAN_EXCLUDE_FOLDERS": "<ORPHAN_EXCLUDE_FOLDERS>",
        "SERVICE_DOCUMENTATION_URL": "<SERVICE_DOCUMENTATION_URL>",
        "MAX_FILE_BYTES": "<MAX_FILE_BYTES>",
        "MAX_IMAGE_OUTPUT_BYTES": "<MAX_IMAGE_OUTPUT_BYTES>",
        "MAX_PDF_RENDER_PAGES": "<MAX_PDF_RENDER_PAGES>"
      }
    }
  }
}

Replace the values in angle brackets with your own. Keys stay on your machine; we never see them.

Tools

This server runs locally, so its tools are listed by your MCP client once it starts.

Environment variables

Name	Description
`MCP_AUTH_TOKEN` Required, secret	Bearer token for MCP client authentication. Must match the Authorization header sent by clients. Generate with: openssl rand -hex 32
`PUBLIC_URL` Optional	Public URL clients use to reach this server. Used as the OAuth issuer URL in discovery metadata. Override when exposing the server outside localhost or on a non-default port.
`EMBEDDING_ENABLED` Optional	Enable or disable the embedding pipeline. When false, no ONNX model is downloaded, no vector tables are created, and search uses FTS5 only.
`RERANK_MODE` Optional	Cross-encoder reranking mode: blended (position-aware score blending after RRF fusion) or none (skip reranking). Only takes effect when EMBEDDING_ENABLED is true.
`WINDOWS_MODE` Optional	Windows bind-mount mode: enables filesystem polling for the file watcher and rename-based moves across the Docker Desktop/WSL2 bridge. Set to true when the vault lives on a Windows drive.
`MEMORY_ENABLED` Optional	Enable or disable the structured memory layer. When false, memory tools are hidden, bootstrap is skipped, and server metadata omits memory references.
`FILE_TOOLS_ENABLED` Optional	Enable or disable file tools (vault_read_file, vault_list_files). When false, file tools are hidden and server metadata omits file tool references.
`READONLY_MODE` Optional	Run the server read-only: every vault-writing tool is hidden, the memory folder is not auto-created, and server metadata omits write references.
`DISABLED_TOOLS` Optional	Hide individual tools by name, comma-separated. Subtractive only — it cannot re-enable a tool another setting hides; an unknown tool name stops the server at startup.
`MEMORY_DIR` Optional	Vault folder for structured memory files (About Me-style notes). Memory tools are hidden when MEMORY_ENABLED is false, but this value still feeds the defaults for PROTECTED_PATHS and ORPHAN_EXCLUDE_FOLDERS.
`DAILY_NOTES_FOLDER` Optional	Vault folder for daily notes. Overrides the folder configured in Obsidian's daily-notes plugin. When unset, read from the vault's .obsidian/daily-notes.json (an empty folder there follows Obsidian's new-note location), falling back to "Daily Notes" when that file is missing or unreadable. Set to /…
`DAILY_NOTES_FORMAT` Optional	Filename date format for daily notes (Moment.js tokens). Overrides the format configured in Obsidian's daily-notes plugin. When unset, read from the vault's .obsidian/daily-notes.json, falling back to "YYYY-MM-DD".
`TRUST_PROXY_HOPS` Optional	Number of trusted reverse-proxy hops used to derive the client IP from X-Forwarded-For for OAuth rate limiting and request logs. With 0, injected forwarding headers are ignored.
`TRUST_FORWARDED_HOPS` Optional	How many entries from the end of the RFC 7239 Forwarded header's for= list to count to reach the client IP for OAuth rate limiting and request logs. 0 ignores the header; 1 when the proxy in front writes it (e.g. AWS API Gateway) and is the only way to reach the server; 2 when a CDN fronts that pro…
`TZ` Optional	IANA timezone for timestamps and daily note resolution.
`LOG_LEVEL` Optional	Logging verbosity.
`LOG_DIR` Optional	Directory for log files that survive container re-creation. The container's own log is always written but discarded when the container is recreated; date-stamped files under LOG_DIR persist on the data volume. Default: /data/logs (remote image), $STORAGE_ROOT/data/logs (single-volume mode), none (l…
`LOG_RETENTION_DAYS` Optional	Days to keep log files; cleanup runs at startup and each day. Only applies when LOG_DIR is a path.
`LOG_MAX_DAILY_MB` Optional	Maximum MB per daily log file (1 MB = 1,000,000 bytes). Whole numbers of at least 1, or none to disable the cap. File logging pauses at the cap until midnight in TZ (UTC by default); console logging continues.
`PROTECTED_PATHS` Optional	Comma-separated vault folder names blocked from vault_delete_note and vault_move_note. Default: MEMORY_DIR plus the daily notes folder, read from DAILY_NOTES_FOLDER or .obsidian/daily-notes.json (default Daily Notes; none when that setting is the vault root or empty). When set, overrides the defaul…
`ORPHAN_EXCLUDE_FOLDERS` Optional	Comma-separated vault folder names excluded from vault_find_orphans. Default: the daily notes folder, "Templates", and MEMORY_DIR. DAILY_NOTES_FOLDER wins; otherwise .obsidian/daily-notes.json is read per query (fallback "Daily Notes"; no daily folder when that setting is the vault root or empty).…
`SERVICE_DOCUMENTATION_URL` Optional	Override the OAuth service documentation URL exposed via discovery metadata.
`MAX_FILE_BYTES` Optional	Largest file vault_read_file will read, in bytes. Reading a larger file returns an error instead of content.
`MAX_IMAGE_OUTPUT_BYTES` Optional	Byte budget for images returned by vault_read_file, in binary bytes before base64 encoding. Images exceeding the budget are downscaled/recompressed server-side to fit; raise for clients that accept larger tool responses.
`MAX_PDF_RENDER_PAGES` Optional	Maximum PDF pages to render as images when raw: true is set on vault_read_file. The per-page byte budget is MAX_IMAGE_OUTPUT_BYTES divided evenly across the rendered pages.

Details

Package	`ghcr.io/aliasunder/vault-cortex:0.57.5` (OCI, streamable-http)
First published	13 Nov 2026
Last updated	13 Nov 2026
Registry name	`io.github.aliasunder/vault-cortex`

More productivity servers See all

Live status

Local install

Installed and run on your own machine, so there is no public endpoint to check.

Pair it with live search

Agents that use Vault Cortex often also need current facts. NestDaddy MCP gives your AI today's internet: web search, real-time breaking news and full page reading in one connector.

See NestDaddy MCP

For maintainers

[![NestDaddy MCP](https://nestdaddy.com/mcp/servers/io-github-aliasunder-vault-cortex/badge.svg)](https://nestdaddy.com/mcp/servers/io-github-aliasunder-vault-cortex)

Add the badge to your README. It turns green while your server passes our daily check. Listing details come from the official MCP registry; update them there.

Listing data from the official MCP registry. Status and tools from NestDaddy's daily check. Browse all MCP servers.