Semantic Notes Vault MCP 0.12.6

Semantic Notes Vault MCP 0.12.6

Tighter outbound security posture (ADR-109, #284).

The plugin no longer makes any outbound network connection by default. system.fetch_web — the one feature that could reach the internet — is now off for every install, including upgrades, behind a dedicated "Allow outbound web fetch" toggle in Settings → Security. With default settings the plugin talks only to the local MCP endpoint you configured.

When you enable it, requests are validated by the security layer rather than passed straight to the network:

• Internal targets are refused — loopback, private/RFC1918, link-local (including the 169.254.169.254 cloud-metadata address), CGNAT, and IPv6 loopback/unique-local/link-local — and the refusal names the address that was resolved.
• Address canonicalization happens before the check, so decimal (2130706433), octal (017700000001), hex, IPv4-mapped ([::ffff:127.0.0.1]) and NAT64 spellings of an internal address are all caught. A hostname string comparison passes these; that is the point.
• A DNS name is refused if any address it resolves to is internal, and the connection is then pinned to the validated address, closing the rebinding window between check and connect.
• Every redirect hop is re-validated, so a public URL cannot bounce a request into your LAN.
• Non-http(s) schemes are refused.

Known limit, stated plainly: once enabled, an agent reading untrusted notes could still be induced to put vault data in a URL to a public host. Range filtering cannot prevent that — the off-by-default posture is the mitigation, and the settings text says so.

Settings changes now reach connected agents (#285).

Tool enumeration was snapshotted when a session was created, so toggling a tool on or off did not reach clients already connected — a tool switched off stayed advertised until reconnect, and one switched on stayed invisible. The tool list is now built per request from current settings, and the server announces notifications/tools/list_changed (declaring the listChanged capability) when a toggle changes what is visible. Enforcement was already immediate; this makes what agents see keep pace.

Also fixed

• #293: fetching any large page returned the literal string "undefined". The response limiter dropped oversized values wholesale instead of shortening them, and the formatter stringified the absence. Both are fixed, and a truncated response now says so and points at maxLength/startIndex.
• Tool enumeration for fetch_web fails closed when its flag is omitted.
• Dependency advisories resolved: npm audit reports 0 for both the production and full trees.

Upgrading: if you used fetch_web, re-enable it in Settings → Security → Allow outbound web fetch. It takes effect immediately, and connected agents now pick up the change without reconnecting.

Since 0.12.5

• Transport failures while announcing a tool-list change are now caught and logged instead of escaping as an unhandled rejection (the send is async; the previous guard only caught synchronous throws).
• Built through CI, so this release carries build-provenance attestation — 0.12.5 was published by hand during a GitHub Actions outage and does not.

Claude Desktop (.mcpb connector)

If you connect Claude Desktop via the .mcpb bundle, re-import obsidian-mcp.mcpb from this release to update the connector — BRAT updates only the Obsidian plugin, not the Desktop bridge.

Installation via BRAT (Obsidian plugin)

1. Install the BRAT plugin if you haven't already
2. Command palette → "BRAT: Add a beta plugin for testing"
3. Enter: aaronsb/obsidian-mcp-plugin
4. Enable the plugin in Community Plugins

What's Changed

• fix(mcp): catch async transport failures when announcing a tool list change by @aaronsb in #297

Full Changelog: 0.12.5...0.12.6