Obsidian Sync Mcp

What was checked

Plain notes from the hygiene checks.

• Permissions

  Pass

  No shell or command execution found, and no extra permission was declared.

• Install and update

  Serious

  install fetches a script from the network.

  INSTALL_REMOTE_SCRIPT

  README.md, line 75

  curl -L https://fly.io/install.sh | sh

  README.md, line 128

  curl -L https://fly.io/install.sh | sh

  deploy/setup.sh, line 10

  echo " curl -L https://fly.io/install.sh | sh"

• Network

  Concern

  can reach a host that is not written as a fixed address.

  NETWORK_NO_FIXED_HOST

  deploy/mcp-with-db/entrypoint.sh, line 11

  if curl -s -o /dev/null -w "%{http_code}" http://localhost:5984/ 2>/dev/null | grep -qE "^[2-4]"; then

  deploy/mcp-with-db/entrypoint.sh, line 33

  HTTP_CODE=$(curl -s -o /dev/null -w "%{http_code}" -u "$ADMIN_USER:$ADMIN_PASS" "http://localhost:5984/$DB")

  deploy/mcp-with-db/entrypoint.sh, line 36

  curl -s -u "$ADMIN_USER:$ADMIN_PASS" -X PUT "http://localhost:5984/$DB"

  Show more

  deploy/mcp-with-db/entrypoint.sh, line 53

  curl -s -o /dev/null -u "$ADMIN_USER:$ADMIN_PASS" -X PUT "http://localhost:5984/_users" 2>/dev/null || true

  deploy/mcp-with-db/entrypoint.sh, line 59

  RESP=$(curl -s -u "$ADMIN_USER:$ADMIN_PASS" -X PUT \

  deploy/mcp-with-db/entrypoint.sh, line 72

  curl -s -o /dev/null -u "$ADMIN_USER:$ADMIN_PASS" -X PUT \

  src/couchdb-preflight.ts, line 37

  /** Short reason for a failed request: fetch() keeps the useful part (ECONNREFUSED, ...) in `cause`. */

  src/host-guard.ts, line 55

  * rebinding and directly `fetch('http://127.0.0.1:<port>/mcp')` - that request

  src/redact.test.ts, line 49

  it("appends the cause, as fetch() reports it", () => {

  src/redact.ts, line 21

  * The cause chain is appended: fetch() reports "fetch failed" and keeps the

• Secrets

  Concern

  reads a credential or environment file.

  SECRETS_ENV_READ SECRETS_PATH_DOTENV

  deploy/generate-setup-uri.mjs, line 25

  couchDB_PASSWORD: process.env.password,

  src/main.ts, line 33

  const COUCHDB_PASSWORD = process.env.COUCHDB_PASSWORD;

  src/main.ts, line 37

  const COUCHDB_ID_DERIVATION_KEY = process.env.COUCHDB_ID_DERIVATION_KEY || undefined;

  Show more

  src/main.ts, line 42

  const AUTH_TOKEN = process.env.MCP_AUTH_TOKEN;

  .dockerignore, line 5

  docker-compose.yml

  .gitignore, line 2

  dist/

  CHANGELOG.md, line 19

  - **docker-compose:** add `MCP_AUTH_TOKEN` to your `.env` - compose now refuses to start without it. The port is bound to `localhost`; to reach the server from another machine, put

  README.md, line 102

  cat > .env <<EOF

  docker-compose.yml, line 1

  # Create a .env file to override defaults:

  docker-compose.yml, line 15

  COUCHDB_PASSWORD: ${COUCHDB_PASSWORD:?Set COUCHDB_PASSWORD in .env}

  docker-compose.yml, line 29

  COUCHDB_PASSWORD: ${COUCHDB_PASSWORD:?Set COUCHDB_PASSWORD in .env}

  docker-compose.yml, line 58

  COUCHDB_PASSWORD: ${COUCHDB_PASSWORD:?Set COUCHDB_PASSWORD in .env}

• Agent instructions

  Pass

  No instruction to ignore earlier instructions or to hide a step.

• Obfuscation

  Pass

  No encoded or minified payload found.

• Licence

  Pass

  A licence file is present (LICENSE).

• Maintainer activity

  Pass

  The latest commit is within the last 365 days.

Get the full report on this tool, £49

Note

Hygiene check of commit 1a4d53fbb95c. install fetches a script from the network. can reach a host that is not written as a fixed address. reads a credential or environment file.

Date and source

Date checked: 22 Oct 2026

Read how this letter is chosen