🎩 You're Invited:Meet the Socket team at Black Hat in Las Vegas, August 3-6.RSVP
Sign In

@gogogadgetbytes/smart-connections-mcp

Package Overview
Dependencies
Maintainers
1
Versions
1
Alerts
File Explorer

Advanced tools

Socket logo

Install Socket

Detect and block malicious and high-risk dependencies

Install

@gogogadgetbytes/smart-connections-mcp

Secure, minimal MCP server for Smart Connections semantic search

latest
Source
npmnpm
Version
0.2.0
Version published
Maintainers
1
Created
Source

Smart Connections MCP Server

License: MIT Node.js Version

A security-first MCP server for Smart Connections. Read-only. Path-validated. Auditable.

Exposes Smart Connections embeddings to Claude Code and other MCP clients for semantic search of your Obsidian vault.

Why This Exists

We needed semantic search of our Obsidian vault from Claude Code. Existing options have problems:

  • No path validation - User input passed directly to file operations
  • Write access - Some expose mutation tools we don't need
  • Heavy dependencies - PyTorch/transformers for what's essentially vector math

This implementation:

  • Minimal dependencies - MCP SDK + Transformers.js (for text search)
  • Fail-closed security - path validation with realpath, symlink detection
  • Auditable - small TypeScript codebase you can actually read

Features

  • Text search - query with plain text, not just note paths
  • Semantic search using Smart Connections embeddings
  • Local inference - uses Transformers.js (same model as Smart Connections)
  • Read-only - no write operations, no shell execution
  • Secure - strict path validation, bounded responses
  • Offline - works without Obsidian running

Security Model

PropertyGuarantee
Path confinementAll file access validated against vault root
No traversal../ and symlink attacks blocked
Read-onlyNo write operations exposed
Bounded responsesCapped results (50), content length (10KB)
Fail closedErrors deny access, never bypass
Audit loggingSecurity events logged with context

Installation

Prerequisites

  • Node.js 18+
  • Obsidian with Smart Connections plugin installed
  • Embeddings built (open vault in Obsidian, let Smart Connections index)

Setup

git clone https://github.com/gogogadgetbytes/smart-connections-mcp
cd smart-connections-mcp
npm install
npm run build

Configure Claude Code

Add to your Claude Code config:

claude mcp add smart-connections \
  -e VAULT_PATH="/path/to/your/obsidian/vault" \
  -- node /path/to/smart-connections-mcp/dist/index.js

Or manually add to ~/.claude.json:

{
  "mcpServers": {
    "smart-connections": {
      "command": "node",
      "args": ["/path/to/smart-connections-mcp/dist/index.js"],
      "env": {
        "VAULT_PATH": "/path/to/your/obsidian/vault"
      }
    }
  }
}

Restart Claude Code to load the server.

Usage

Once configured, Claude Code can use these tools:

Search by Text

"Search my vault for notes about backup strategies"
→ Uses search_by_text tool

Search Similar Notes

"Find notes similar to Topics/Claude_Code.md"
→ Uses search_similar tool

Get Note Content

"Show me the content of Topics/Obsidian.md"
→ Uses get_note tool

List Indexed Notes

"What notes are indexed in my vault?"
→ Uses list_indexed tool

Tools

ToolDescription
search_by_textSearch using freeform text (computes embedding locally)
search_similarFind notes semantically similar to a given note
search_by_embeddingSearch using a raw embedding vector
get_noteGet content of a specific note (path validated)
get_model_infoGet embedding model configuration
list_indexedList all indexed notes

Configuration

VariableRequiredDescription
VAULT_PATHYesAbsolute path to Obsidian vault

Limitations

  • Single vault - Configure one vault per MCP server instance
  • Index from Smart Connections - Note embeddings come from the plugin; text queries are embedded locally
  • No write access - By design; use Obsidian for edits
  • First run downloads model - ~50MB model cached in ~/.cache/huggingface/

Development

# Build
npm run build

# Test with MCP Inspector
npx @modelcontextprotocol/inspector node dist/index.js

Contributing

See CONTRIBUTING.md. Security-focused PRs welcome.

Security

To report security vulnerabilities, please email gogogadgetcode@proton.me. Do not open public issues for security concerns.

License

MIT - see LICENSE

Credits

Keywords

mcp

FAQs

Package last updated on 03 Feb 2026

Did you know?

Socket

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Install

Related posts