obsidian-mcp: 初次落地 Obsidian Vault MCP Server (.NET 10, read+write)

把 Obsidian vault 通过 MCP 暴露给 Claude.ai，OAuth 走 nas-auth。设计文档见 vault Coding/obsidian-mcp/obsidian-mcp 设计.md。代码层落地参考 vault Coding/obsidian-mcp/MCP 实现指南.md。 V1+V2 同时实现（用户要求跳过分阶段直接全部）：读 Tools（需 scope=read:obsidian）： - list_vault_tree（一次性 vault 地图，限制深度） - list_files / read_file（含 offset/limit 大文件分页） - search（子串匹配 + glob 过滤，最多 50 hits） - get_metadata（size / modified_at / has_frontmatter）写 Tools（需 scope=write:obsidian）： - write_file / append_file - 多重门禁：scope 校验 + 路径黑名单 + 写入白名单 + 永禁文件 - 永禁写：任意目录的 AGENTS.md / PROFILE.md / README.md / CLAUDE.md / 01-Secret/** - 白名单：02-ShengquGames/logs/ + Coding/ + NAS/NAS 待办清单.md - 写入审计日志按天 rotate（JSON line）安全： - VaultPathResolver chroot：path traversal + symlink 双拒绝 - JwtBearer (HS256, Current+Previous fallback, MapInboundClaims=false) - aud=obsidian, iss=https://auth.zhengchentao.win - 黑名单：01-Secret / .obsidian / .trash / .git 技术栈： - .NET 10 + ModelContextProtocol SDK 1.0 - Streamable HTTP transport (POST /mcp) - JwtBearer 10.0 + IdentityModel.Tokens 8.x 部署： - Dockerfile multi-stage，runtime 装 ripgrep（V3 备用），non-root user - .gitea/workflows/build-image.yml：build + deploy 双 job，buildkit v0.13.2 - 容器内 :8080，宿主端口 9090 - 子域名 obs.zhengchentao.win - vault 挂载 /volume1/docker/webdav/data/Zhengchen:/vault:rw（V2 写入需要 rw）测试：35/35 单测过（VaultPathResolver path traversal/blacklist/symlink + VaultWriteGuard whitelist/forbidden） Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
2026-05-06 01:32:11 +08:00
commit 28f9a54ba9
28 changed files with 1625 additions and 0 deletions
@@ -0,0 +1,55 @@
+using System.ComponentModel;
+using ModelContextProtocol.Server;
+using ObsidianMcp.Auth;
+using ObsidianMcp.Services;
+
+namespace ObsidianMcp.Tools;
+
+[McpServerToolType]
+public class ListFilesTool(VaultPathResolver resolver, IHttpContextAccessor http)
+{
+    [McpServerTool]
+    [Description(
+        "List files and immediate subdirectories in a vault directory. " +
+        "Returns a flat list of names (not full paths). " +
+        "Use list_vault_tree for a recursive overview, or this tool to drill into one directory. " +
+        "Hidden directories and blacklisted paths (01-Secret, .obsidian, etc.) are excluded.")]
+    public List<string> ListFiles(
+        [Description("Vault-relative path to list. Defaults to root if omitted. " +
+                     "e.g. 'NAS', '02-ShengquGames/logs'")] string? path = null)
+    {
+        ToolScopeGuard.EnsureScope(http, ScopePolicies.ReadObsidian);
+
+        string absDir;
+        if (string.IsNullOrWhiteSpace(path))
+        {
+            absDir = resolver.VaultRoot;
+        }
+        else
+        {
+            absDir = resolver.Resolve(path);
+        }
+
+        if (!Directory.Exists(absDir))
+            throw new DirectoryNotFoundException($"目录不存在：{path}");
+
+        var result = new List<string>();
+
+        // 子目录（排除隐藏和黑名单）
+        foreach (var dir in Directory.GetDirectories(absDir).OrderBy(Path.GetFileName, StringComparer.OrdinalIgnoreCase))
+        {
+            var seg = Path.GetFileName(dir)!;
+            if (seg.StartsWith('.')) continue;
+            if (seg.Equals("01-Secret", StringComparison.OrdinalIgnoreCase)) continue;
+            result.Add(seg + "/");
+        }
+
+        // 文件
+        foreach (var file in Directory.GetFiles(absDir).OrderBy(Path.GetFileName, StringComparer.OrdinalIgnoreCase))
+        {
+            result.Add(Path.GetFileName(file));
+        }
+
+        return result;
+    }
+}