Back to Directory/Security & Auth

gosidian

Self-hosted Obsidian-compatible markdown vault with a web UI and a 61-tool MCP server for AI agents

Security & AuthGov2.71.0

gosidian

Markdown notes your AI agents can read, write, and reason over — via MCP.

A self-contained markdown vault with a built-in MCP server. Humans edit through a web UI, agents talk to it over MCP, everything lives in plain .md files that Obsidian (and every other markdown tool) reads natively.

gosidian in action

Try it in your browser

Open in GitHub Codespaces

Launch a free, throwaway gosidian in GitHub Codespaces — no install, running on your own Codespaces quota. It builds from source, seeds a small demo vault, and opens the web UI. Log in with demo / gosidian-demo.

Quick start

docker run -d --name gosidian \
  -p 8080:8080 \
  -v "$(pwd)/vault:/vault" \
  ghcr.io/daniele-chiappa/gosidian:latest
# open http://localhost:8080, create admin, copy the MCP token from /admin/tokens
claude mcp add gosidian http://localhost:8080/mcp \
  --transport http --header "Authorization: Bearer $TOKEN"

Three commands: Docker up → token created from the web UI → agent wired. Your .md vault is persisted under ./vault/; stop the container and the files are still there.

Other installation paths (source, custom compose, bare-metal): docs/getting-started.md.

What is gosidian

  • A markdown vault. Notes are .md files on disk. Open the same folder in Obsidian, VS Code, vim, or any editor you already use. Zero lock-in: delete .gosidian/ and you have a pure Obsidian vault.
  • An MCP server. 57 typed tools let agents bootstrap a session, ingest files, search, read, write, link, handoff, self-check, audit. Bearer-token authentication with per-project scoping.
  • A web UI. A Vue 3 single-page app served from the same binary (built with Vite, embedded via go:embed). Notes, graph, search and config forms open as windows in a tiling "plancia" workspace — full-text search, backlinks, graph view, editor with live preview, audit trail, admin pages for tokens and users.

All three views hit the same files on disk. The SQLite FTS5 index is a cache — drop it and it rebuilds.

Who it's for

  • AI engineers wiring agents that need persistent structured memory: note-taking, plans, skills, ADRs, handoffs, audit.
  • Obsidian users who want a programmable layer on top of a vault they already trust.
  • Teams with shared vault + per-project scoped tokens per agent.

Why gosidian instead of X

  • vs RAG / vector search: gosidian retrieves by identity (path, tag, frontmatter, backlinks) — more predictable than similarity search for an agent's working memory. Semantic search is deliberately deferred: see ADR-007 rationale.
  • vs Obsidian Sync: Sync mirrors a vault between human devices. gosidian adds a typed automation surface (MCP) to the same vault. Not competitive — complementary.
  • vs Notion / Roam: hosted or proprietary formats; migration is a project. gosidian's vault is already .md files you can take anywhere.

FAQ covers the long form.

Feature highlights

  • Single binary, ≤50 MB, Alpine-based Docker image
  • Web UI: a Vue 3 SPA (Vite, Pinia, Tailwind, CodeMirror, Cytoscape), embedded in the binary — editor + live preview, sidebar, search, graph view, attachments, audit log, admin pages
  • Plancia tiling window manager (niri-style): notes, graph, search and config forms open as resizable, side-by-side windows in a horizontally-scrollable workspace, restorable from the URL
  • MCP server over Streamable HTTP (legacy HTTP+SSE kept) with 57 typed tools
  • Bearer tokens with scopes (read / write) and per-project restriction — including multi-project tokens for orchestrators; cascade-revoke on user disable
  • Agent orchestration bus: handoff notes with an atomic claim/complete lifecycle, server-stamped identity, and a memory_wait_changes long-poll change feed — a minimal multi-agent task queue where everything stays plain markdown
  • Multi-user web login with role-based access (owner / member / guest), per-project public/private visibility, and invite-only signup (24h TTL)
  • Optional TOTP two-factor (global mode + per-user override) and LDAP / Active Directory login with guest auto-provisioning
  • Optional git sync (debounced commits, push with token auth)
  • SQLite FTS5 full-text search + ETag optimistic locking
  • First-class .html notes, rendered in a sandboxed iframe (off by default, opt-in per project)
  • Graph analytics over the wikilink graph: memory_hubs (most-linked notes) and memory_path (shortest path between two notes)
  • Opt-in self-improve loop: agents record usage-friction insights per token, off by default
  • Print / Save-as-PDF for any markdown note straight from the web UI
  • Internationalization (IT + EN complete; ES / FR / DE scaffolding)
  • Light & dark theme presets (Catppuccin, Tokyo Night, Solarized) + custom palette
  • Opinionated Karpathy-Wiki-Stack project layout with one-call scaffolding
  • Optional global projects for skills, agents & scaffold templates shared across projects (opt-in per project, local-overrides-global)

Documentation

AreaStart here
Install + configureGetting started, Configuration, Deployment
MCP integrationOverview, Tool catalogue, Authentication, Client setup, Agent patterns
Web UIOverview, Editor, Authentication & roles, Settings
VaultFormat, Conventions, Multi-project, Global projects, Obsidian compatibility
InternalsArchitecture, Development
Common questionsFAQ

Full index: docs/README.md.

Contributing

Contributions welcome. See CONTRIBUTING.md for the workflow, test expectations, and translation guidelines.

Security

Security issues are reported privately. See SECURITY.md for the disclosure process.

License

Released under the MIT License.

See also

Installation

Source-derived launch command. Check the maintainer’s required arguments and credentials before running:

bash
docker run -i --rm ghcr.io/daniele-chiappa/gosidian:v2.71.0

Set up in your AI client

Merge this template into ~/Library/Application Support/Claude/claude_desktop_config.json. Keep existing servers. Add any arguments, credentials, and permissions required by the maintainer; this template has not been install-tested.

json
{
  "mcpServers": {
    "io-github-daniele-chiappa-gosidian": {
      "command": "docker",
      "args": [
        "run",
        "-i",
        "--rm",
        "ghcr.io/daniele-chiappa/gosidian:v2.71.0"
      ]
    }
  }
}

Restart Claude Desktop completely for changes to take effect. Confirm the server appears connected in the client’s tool list, then try a read-only example from its documentation.

Claude Desktop setup reference

Package

ghcr.io/daniele-chiappa/gosidian:v2.71.0docker

Compatible MCP Clients

gosidian works with any MCP-compatible client. Copy the config snippet from the Configuration section above and add it to the file shown for your client, then restart the application.

  • Claude Desktop~/Library/Application Support/Claude/claude_desktop_config.jsonRestart Claude Desktop completely for changes to take effect.
  • Cursor~/.cursor/mcp.jsonRestart Cursor for changes to take effect.
  • VS Code.vscode/mcp.jsonReload VS Code window for changes to take effect.
  • Windsurf~/.codeium/windsurf/mcp_config.jsonRestart Windsurf for changes to take effect.
  • Claude Code.mcp.jsonSave at the project root, then start Claude Code in that project and review the MCP server approval prompt. Keep real credentials out of shared files.

Learn More