obsidian-intelligence 1.2.0 — explicit LLM endpoint, hardening

A maintenance and hardening release. No new MCP tools, no schema changes —
but one configuration change you need to check before upgrading.

⚠️ Configuration change: LLM_API_URL is now required for OpenAI-compatible providers

Until 1.1.0, an OPENAI_API_KEY or LLM_API_KEY on its own was enough:
auto mode picked OpenAI and silently sent every chat, catalyst, enrichment
and embedding call to https://api.openai.com/v1 — even if you meant to go
through a gateway or a local server. There is no default endpoint anymore.

What to do: if you use an OpenAI-compatible provider, set the endpoint
explicitly, e.g.

LLM_API_URL=https://api.openai.com/v1      # OpenAI directly
LLM_API_URL=http://localhost:4000/v1       # your own gateway

Without it, auto resolves to none (LLM features off, with a clear
message), and LLM_PROVIDER=openai fails with a configuration error before
any request is made. Ollama and Gemini are unaffected — they carry their own
endpoint. Embeddings fall back to LLM_API_URL unless EMBEDDINGS_API_URL
is set.

Security

• No silent direct route to OpenAI (see above).
• Browser open without a shell: report.js used exec() with an
  interpolated path when opening the HTML report; a crafted --output value
  could inject shell commands. It now uses execFile with an argument array.
• MCP SDK 1.32.1 (was 1.29.0): fixes an advisory in the SDK's OAuth client
  and pulls patched transitive dependencies. npm audit --omit=dev reports
  0 vulnerabilities as of 18.10.2026.
• Dev dependencies: vitest 3 → 4 (critical/high advisories in the test
  tooling). One moderate advisory in vitest remains until vitest 5; it
  affects the test runner only, not the published package.

Changed

• Error messages for an unconfigured LLM/embeddings provider now name the
  endpoint variable, not just the key.
• README: tool table lists all 14 MCP tools (find_similar was missing),
  positioning as an OKF-shaped local reader, badges, screenshots,
  acknowledgements.
• docs/ARCHITECTURE.md and docs/DISTRIBUTION.md added; glama.json for
  the Glama MCP directory.
• CI: the vitest step is skipped on Node 18 (vitest 4 needs Node 20+); the
  package itself still supports Node ≥ 18.

Install / upgrade: npm install -g obsidian-intelligence@1.2.0 or npx obsidian-intelligence. Full history: CHANGELOG.md.

v1.1.0 — Initial public release

obsidian-intelligence v1.1.0 — Initial public release

The MCP-first release. Make your Obsidian vault a first-class knowledge source for any MCP-enabled AI assistant — locally, privately, without a GUI.

What's in it

• 14 MCP tools for graph analysis, full-text search, semantic search, and hybrid RRF — works with Claude Desktop, Claude Code, Cursor, Open WebUI, or any MCP client
• FTS5 full-text search with BM25 ranking, phrases, AND/OR/NOT, folder/tag filters
• Semantic search via vector embeddings (Ollama, Gemini free tier, OpenAI, or none)
• Hybrid search combining keyword + semantic via Reciprocal Rank Fusion
• LLM enrichment: per-note category, summary, entities, language detection
• Provider-agnostic: works with Ollama, OpenAI, Gemini, Groq, Mistral, Together, LiteLLM, vLLM — or fully offline with no provider at all
• Graph analysis: orphans, hubs, backlinks, related, tag cloud, engagement metrics, catalysts
• HTML reports with Chart.js visualizations
• Optional document ingestion subpackage (obsidian-intelligence-docs) for external PDFs / DOCX / text

Privacy

Zero telemetry. Zero network calls by default. See PRIVACY.md for a complete inventory of what leaves your machine and under which configurations.

Install

npm install -g obsidian-intelligence
VAULT_PATH=/path/to/your/vault vault-intelligence index

Then wire it into your MCP client — see docs/MCP_SETUP.md.

Docs

• README — quickstart + value proposition
• docs/MCP_SETUP.md — per-client setup (Claude Desktop, Claude Code, Cursor, generic)
• docs/PROVIDERS.md — LLM + embeddings provider matrix
• docs/PRIVACY.md — network behavior and verification
• SECURITY.md — security policy and known transitive advisories
• CONTRIBUTING.md — dev setup and PR guidelines

Tests

255 passing across 15 suites. CI on Node 18/20/22 × Ubuntu/macOS/Windows.

Migration from 1.0

See the "Migration from 1.0" section in CHANGELOG.md.

---

🤖 Built with Claude Code