feat: add --read-only flag to disable mutating tools (closes #112) - #113
Open
vdhome-dev wants to merge 197 commits into
Open
feat: add --read-only flag to disable mutating tools (closes #112)#113vdhome-dev wants to merge 197 commits into
vdhome-dev wants to merge 197 commits into
Conversation
- Replace Bun scripts with npm equivalents using tsx and vitest - Convert Bun.file(), Bun.write(), Bun.Glob(), and Bun.YAML APIs to Node.js equivalents - Update dependencies: remove @types/bun, add Node.js tooling (tsx, typescript, vitest, js-yaml) - Add TypeScript configuration and Vitest test config - Update shebang and usage messages from bun to node - Maintain backward compatibility for all MCP server functionality - All tests passing after conversion 🤖 Generated with [Claude Code](https://claude.ai/code) Co-Authored-By: Claude <noreply@anthropic.com>
- Update README.md with npm/npx commands replacing all Bun references - Bump version to 0.5.0 in package.json and server.ts - Update installation instructions for Node.js runtime - Replace all bunx commands with npx equivalents - Update developer documentation and troubleshooting guides 🤖 Generated with [Claude Code](https://claude.ai/code) Co-Authored-By: Claude <noreply@anthropic.com>
- Add build script using tsc with separate build configuration - Update bin configuration to point to compiled JS files in dist/ - Include compiled JavaScript files in npm package - Fix TypeScript strict mode errors for compilation - Update .gitignore to include dist/ in version control for publishing - Resolves Claude Desktop execution issues with direct TypeScript execution This ensures the package works without requiring users to have tsx installed.
Update error message to show correct npx command instead of referencing server.ts file directly.
Prepare for npm publish with corrected Node.js compatibility.
- Change main field from server.ts to dist/server.js - Add executable permission to compiled JavaScript file - This resolves the 'env: bun: No such file or directory' error - Version bump to 0.5.2
- Normalize '.' path to empty string for root directory listing - Ensure consistent behavior between '.', '/', and '' paths - All now correctly return both files and directories from vault root - Version bump to 0.5.3 Resolves issue where LLMs using '.' path only received files without directories.
- Remove js-yaml dependency and use gray-matter for all YAML operations - Fix write_note, update_frontmatter, and manage_tags YAML serialization errors - Add comprehensive integration tests for all frontmatter operations - Tests cover write_note with frontmatter, append/prepend modes, update operations - Tests cover tag management (add, remove, list) and edge cases - All 22 tests now passing including frontmatter validation - Version bump to 0.5.4 Resolves: 'yaml.dump is not a function' error in all frontmatter tools
- Add detailed changelog documenting all versions from 0.1.0 to 0.5.4 - Document major migration from Bun to Node.js in v0.5.0 - Document YAML frontmatter fixes and comprehensive test suite in v0.5.4 - Include migration notes and breaking changes - Update README configuration examples to use @latest tag to prevent caching - Follows Keep a Changelog format with semantic versioning
Prevents Claude Code local settings from being tracked in git
File is now properly ignored and won't appear as modified
- Add centered MCP-Obsidian logo at top of README - Include embedded demo video with autoplay and loop features - Improve visual presentation and user engagement 🤖 Generated with [Claude Code](https://claude.ai/code) Co-Authored-By: Claude <noreply@anthropic.com>
- Add website link (mcp-obsidian.org) to header section - Include Windsurf IDE in supported platforms - Add performance and dependency highlights to features - Enhance developer experience with MCP Inspector tips - Add advanced use case examples for better user guidance - Complete architecture section with missing src/search.ts 🤖 Generated with [Claude Code](https://claude.ai/code) Co-Authored-By: Claude <noreply@anthropic.com>
Add goose desktop docs
Introduces a new patch_note tool that allows replacing specific strings in notes without rewriting the entire file, reducing token usage and improving performance for small edits. Features: - String-based replacement with oldString/newString parameters - Safety: fails if multiple matches found (unless replaceAll=true) - Preserves frontmatter and file structure - Returns match count and detailed success/error messages Changes: - Added PatchNoteParams and PatchNoteResult types - Implemented patchNote() method in FileSystemService - Added patch_note tool to MCP server - Comprehensive test coverage (8 new tests) - Bumped version to 0.6.0
## Changes - Add comprehensive tests for patch_note feature (16 tests) - Single/multiple occurrence handling - Empty string validation - Special characters and whitespace preservation - Case sensitivity - Performance testing - Add validation for empty oldString/newString in patchNote - Reorganize test structure - Move tests from tests/ to src/ (co-location) - Merge filesystem, patch, and integration tests into src/filesystem.test.ts - Move frontmatter tests to src/frontmatter.test.ts All 38 tests passing
- Remove .npmrc from git tracking to prevent auth token exposure - Add .npmrc to .gitignore for security - Update package-lock.json with peer dependency changes
- Remove duplicate GitHub Sponsors badge from README - Add npm version badge as second badge in README - Badges now: GitHub Stars, npm version, Sponsors, Ko-Fi, Liberapay
### Added - prettyPrint parameter (default: false) for all JSON responses - Token-optimized responses with 40-60% reduction ### Changed - Minified search result field names (path→p, title→t, excerpt→ex, matchCount→mc, lineNumber→ln) - Reduced search excerpt context from 50 to 21 characters - Removed redundant fields from all responses - Compact JSON format by default for minimal token usage ### Performance - 40-60% token reduction in typical API responses - More efficient for high-volume operations - Better cost optimization for AI interactions All tests passing (76/76).
…letter attribution to Resend
…n/minor-and-patch-e2f43b3205 deps: bump the minor-and-patch group with 2 updates
fix: block symlinks that resolve outside vault boundary
…tory feat: extract createServer factory for library consumers
feat: add list_all_tags tool and Obsidian CLI routing in skill
send-broadcast.ts uses Node builtins that aren't available in the Astro/Cloudflare type context. It's a CLI-only script and doesn't need to be checked during the website build.
Replace the single hardcoded binary check with a cascading priority table and stale PATH detection. Obsidian 1.12.7+ bundles a dedicated obsidian-cli binary (~10x faster) and changes the PATH registration mechanism from a ~/.zprofile entry to a /usr/local/bin symlink. Closes bitbonsai#92
Bumps [typescript](https://github.com/microsoft/TypeScript) from 5.9.3 to 6.0.2. - [Release notes](https://github.com/microsoft/TypeScript/releases) - [Commits](microsoft/TypeScript@v5.9.3...v6.0.2) --- updated-dependencies: - dependency-name: typescript dependency-version: 6.0.2 dependency-type: direct:development update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
- Add preserveStringify() using yaml.parseDocument for AST-aware updates - Only modified keys are rewritten; unmodified fields keep raw formatting - Fixes YYYY-MM-DD dates becoming ISO timestamps (bitbonsai#77) - Fixes HH:MM values parsed as sexagesimal integers (bitbonsai#75) - Fixes quoted strings losing their quote style (bitbonsai#76) - Applies to update_frontmatter, manage_tags, and write_note append/prepend
- Update CHANGELOG, README, and package version to 0.11.1 - Refresh website copy: FeatureGrid, ComparisonTable, UpdateCallout - Sync markdown mirrors: features, demo, how-it-works, index
Bumps the minor-and-patch group with 3 updates in the / directory: [@modelcontextprotocol/sdk](https://github.com/modelcontextprotocol/typescript-sdk), [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) and [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest). Updates `@modelcontextprotocol/sdk` from 1.27.1 to 1.29.0 - [Release notes](https://github.com/modelcontextprotocol/typescript-sdk/releases) - [Commits](modelcontextprotocol/typescript-sdk@v1.27.1...v1.29.0) Updates `@types/node` from 25.5.0 to 25.5.2 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node) Updates `vitest` from 4.1.0 to 4.1.2 - [Release notes](https://github.com/vitest-dev/vitest/releases) - [Commits](https://github.com/vitest-dev/vitest/commits/v4.1.2/packages/vitest) --- updated-dependencies: - dependency-name: "@modelcontextprotocol/sdk" dependency-version: 1.29.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: "@types/node" dependency-version: 25.5.2 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: vitest dependency-version: 4.1.2 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: minor-and-patch ... Signed-off-by: dependabot[bot] <support@github.com>
…rn/minor-and-patch-b219d17f8d deps: bump the minor-and-patch group across 1 directory with 3 updates
- Add ignoreDeprecations for node10 moduleResolution - Add explicit types: ["node"] for TS 6 resolution
…n/typescript-6.0.2 deps: bump typescript from 5.9.3 to 6.0.2
- Change validation from falsy check to explicit undefined/null check - Empty string is now a valid way to delete matched text - Update test to verify deletion behavior
- none (default): permanent delete (previous behavior) - local: move to .trash/ inside vault, preserving folder structure - system: move to OS trash via the trash package - Add trashMode parameter to tool schema, types, and handler - Add tests for local and system trash modes - Update docs: CHANGELOG, README, website
The marketing site shows --read-only true but the code did not plumb it
through. This adds the flag end-to-end:
- server.ts parses --read-only (positional-tolerant)
- createServer accepts readOnly: boolean (default false; no behavior
change for existing users)
- The dispatcher rejects calls to the 7 mutating tools when readOnly
is true, returning {isError: true}
Includes 4 new vitest cases covering the default-allows path, the
write-blocked path with disk verification, the read-still-works path,
and a parameterized check that all 7 mutating tools are blocked.
ErycM
added a commit
to ErycM/mcpvault
that referenced
this pull request
May 15, 2026
Anyone cloning this fork (including future-self) should immediately understand (a) why it exists, (b) what's different from upstream, (c) how the cherry-picks were security-audited before pulling them in, (d) how to keep the fork in sync as upstream evolves, and (e) the plan to eventually retire the fork once PRs bitbonsai#113/bitbonsai#115 + our own --allowed-extensions all land upstream. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Owner
|
Hey @vdhome-dev, thanks for the --read-only flag, this is a feature I want. The branch has fallen behind main and needs a rebase onto current main before it can merge. If you rebase and push just the flag change, I'll review and get it in. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
12 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #112
Context
The marketing site (
website/src/components/CodeExample.astro:144,213) shows a--read-only trueflag, butserver.tsdoesn't parse it andcreateServerdoesn't enforce it. This PR plumbs it through end-to-end — a mode where the server exposes only read tools and rejects all mutating-tool calls with a clear error.Happy to convert this back to issue-only / discussion if you'd prefer to scope before reviewing code (issue #112 has the design questions).
Changes
server.ts— parse--read-only(positional-tolerant; can appear anywhere in argv, including after a path-with-spaces).--helptext updated.src/createServer.ts—readOnly?: booleanadded toCreateServerOptions(defaults tofalse, so no behavior change for existing users). Whentrue, the dispatcher rejects calls to the 7 mutating tools (write_note,patch_note,delete_note,move_note,move_file,update_frontmatter,manage_tags) with{isError: true}and the vault is guaranteed untouched.src/createServer.test.ts— 4 new vitest cases:write_notereturns error AND verifies the file was NOT created on diskTests
npx vitest run src/createServer.test.ts→ 8 passed (4 pre-existing + 4 new).npx vitest run(full suite) → 166 passed / 18 failed. The 18 failures are pre-existing path-join issues insearch.test.ts+integration.test.tson Windows-host development environments; they are unchanged by this PR.Backward compatibility
readOnlydefaults tofalse. Existing CLI invocations and library consumers see no behavior change.Open to feedback
Particularly on:
--read-onlymatches the website wording — happy to switch to--readonlyor--roif you prefer).tools/listresponses when read-only is active, vs the current "list-everything, reject-on-call" approach. (The current approach lets MCP clients show users what's available + makes the read-only state discoverable; the alternative is cleaner from a least-surprise standpoint.)