bitbonsai/mcp-obsidian — agentic threat model

Not certain from the listing — the server is client-agnostic and relies on external models (Claude, ChatGPT). The primary threat is prompt injection via malicious note content that hijacks the model's tool-calling capabilities.

Direct read/write access to local Obsidian vaults. Threats include unauthorized data exfiltration of sensitive personal notes, knowledge-base poisoning via malicious file writes, and directory traversal if path validation is weak.

Exposes 11 methods for search, batch operations, and tag/frontmatter handling. Threat of tool misuse is high if an LLM is tricked into executing destructive batch deletes or mass modifications of local files.

Runs locally as an MCP server. The primary threat is local privilege escalation or unauthorized file system access if the host environment does not properly sandbox the node/python process running the server.

Not certain from the listing — there is no mention of built-in logging, audit trails, or guardrails to monitor and intercept destructive file operations before they are executed on the local disk.

The listing claims 'safe read/write access' but does not detail authentication, authorization, or user-confirmation prompts (Human-in-the-Loop) before executing destructive file modifications.

Designed to integrate with any MCP client. If chained with other agents in a multi-agent workflow, a compromised upstream agent could abuse this tool to read or corrupt the user's entire personal knowledge base.