跳到主要内容
知仓学习社ZHICANG

obsidian-rest-api

Call the Obsidian Local REST API directly (over HTTP) for vault operations the mcp__obsidian__* tools do NOT expose — move/rename a note, overwrite …

读凭据严重 0 · 高危 3davepoon/buildwithclaude

它会碰到什么

扫了多少3 个文本文件,14 KB
它会碰到什么读凭据
命中总数3 处
命中统计严重 0 · 高 3 · 中 0 · 低 0
逐条看命中(3 条严重或高危)
  • scripts/olrapi.sh:40cred-envread
    host = os.environ.get('OBSIDIAN_HOST', host).replace('https://','').replace('http://','')
  • scripts/olrapi.sh:41cred-envread
    port = os.environ.get('OBSIDIAN_PORT', port)
  • scripts/olrapi.sh:42cred-envread
    key  = os.environ.get('OBSIDIAN_API_KEY', key)

这一栏是扫描器报的事实,不是结论。命中多不等于有毒(安全工具、规则库、示例脚本本来就会包含危险写法),命中少也不等于干净。它和你手上的凭据、文件、网络有什么关系,需要你自己看。

技能内容

Obsidian Local REST API

The connected obsidian MCP server exposes only a subset of the Obsidian

Local REST API

(plugin obsidian-local-rest-api). This skill provides the full API surface plus

an authenticated request wrapper, so a missing MCP method is called over HTTP

instead of being worked around with hacks (e.g. delete+recreate to rename a note).

When to Use This Skill

Use the mcp__obsidian__* tools first for read, append, patch, delete, and search.

Fall back to this skill only for operations that have no MCP tool:

  • Move / rename a note (preserves history, updates internal links)
  • Overwrite a whole file atomically (PUT) instead of delete+recreate
  • Act on the currently-open "active" file in the Obsidian UI
  • Run an Obsidian command from the command palette
  • Open / focus a note in the UI
  • List all vault tags with counts
  • Create/update/delete date-specific periodic notes

What This Skill Does

  1. Resolves the API host, port, and key from the connected obsidian MCP server

config (~/.claude.json) or OBSIDIAN_* env vars — no hardcoded secrets.

  1. Handles the plugin's self-signed TLS certificate.
  2. Exposes every endpoint of the Local REST API (see references/api_reference.md),

with the header enums (Operation, Target-Type, Target-Scope), the custom

MOVE contract, and the search (JsonLogic/Dataview) formats.

How to Use

Call the wrapper scripts/olrapi.sh <METHOD> <path> [curl args...]:

S=scripts/olrapi.sh   # adjust to the skill's install path

# rename/move a note (the most common reason to reach for this skill)
"$S" MOVE "/vault/Path/To/Old Name.md" -H 'Destination: Path/To/New Name.md'

# move into a folder, keeping the filename (trailing slash on Destination)
"$S" MOVE "/vault/Inbox/todo.md" -H 'Destination: Archive/'

# atomically overwrite a whole note
"$S" PUT "/vault/Path/Note.md" -H 'Content-Type: text/markdown' --data-binary @/tmp/body.md

# read a note as structured JSON (frontmatter + tags + stat)
"$S" GET "/vault/Path/Note.md" -H 'Accept: application/vnd.olrapi.note+json'

# list tags, run a command, open a note in the UI
"$S" GET /tags/
"$S" POST "/commands/editor:toggle-bold/"
"$S" POST "/open/Path/Note.md?newLeaf=true"

The wrapper prints <<HTTP nnn>> after the body. Success: 200/204.

On MOVE, 409 means the destination exists — add -H 'Allow-Overwrite: true' to force.

For non-trivial calls, load references/api_reference.md.

Path & encoding rules

  • {filename} is vault-relative (no leading slash on the vault path).
  • Percent-encode non-ASCII in URL paths and in the MOVE Destination header

(e.g. r%C3%A9sum%C3%A9.md). Destination rejects absolute (/…) paths.

  • Target a sub-part of a note with Target-Type (heading|block|frontmatter)
  • Target headers on GET/PATCH/POST.

Example

User: "Rename 3-Resources/Draft.md to 3-Resources/Final.md in my vault."

Output:

scripts/olrapi.sh MOVE "/vault/3-Resources/Draft.md" \
  -H 'Destination: 3-Resources/Final.md'
# <<HTTP 204>>  — moved, history preserved, internal links updated

Tips

  • Regenerate the reference against the live plugin if it was updated:

scripts/olrapi.sh GET /openapi.yaml. GET / shows the plugin version.

  • Prefer PUT over delete+recreate for whole-file overwrites — it is atomic and

keeps the file's identity.

  • The API serves HTTPS on port 27124 (self-signed → curl -k) and HTTP on 27123.

想直接用这个技能?

本站把开放许可(MIT / Apache 等)的技能按仓库打包整理到网盘,点一下转存到你自己的网盘,不用一个个从 GitHub 拉。许可未声明的技能只给原始仓库链接,不打包。

它属于哪个仓库

星标★ 3,470
本站分层T1
该仓技能数381
原文件路径plugins/all-skills/skills/obsidian-rest-api/SKILL.md

同一个仓库里的其他技能

看这个仓库的全部 381 个技能