Does mcp-obsidian send data, and where? — data-flow verdict
provisional · AUTOMATED — forensic confirmation pending. A preliminary, fact-based result, not a judgment.
100/100 integrity
100% evidence coverage
evidence-backed
Measures evidence support, not confidence — how this is scored
Verdict (the facts)
- Tool
- npm/mcp-obsidian
- Integrity axis
- honest — Observed behaviour matches its description; no undisclosed recipient.
- Data-flow axis
- No network egress to external destinations was observed — the tool ran purely locally.
- Disclosure
- n/a — No external egress was observed; there is nothing to disclose.
- Capture self-test
- verified
- Severity
- none — integrity axis (no undeclared exfiltration; no egress at all).
- Version (pinned)
- 1.0.0 · commit 474dd95a284f62191f30533ff53b87f9cb37c52b
- Content hash
- sha256:1242049487537f2dfad2d597f26165946aa4af7685f535d39cc8a4bcfd186900
- Signature
- ed25519:GHdaI7LNITE7qxJlVBxC90LA1dtG/Xcl1sPNAu… · Ed25519 public key · sha256:49cf8457b42a7048
- Scanned
- 2026-06-14T00:00:00Z — Pinned to mcp-obsidian@1.0.0 (git 474dd95a284f62191f30533ff53b87f9cb37c52b), published 2024-11-29. This verdict applies to that exact version; a newer release would require a re-scan.
- Re-verified
- 2026-06-14 — pinned version current
- Categories
- docs-knowledge no-egress published
- Observation history
- 1 scan(s); first seen 2026-06-14T00:00:00Z · latest 2026-06-14T00:00:00Z
Observed egress destinations
| host | country | jurisdiction | class | disclosure | frequency | kind |
|---|
Jurisdiction context:
Disclosure check (the §824 evidence)
- Read
- Quoted from the tool's own docs
- “”
- Match
- No external egress was observed; there is nothing to disclose.
- Residual gap
How we know this — claims by basis
A verdict is a reproducible evidence container, not just a claim. Each assertion is tagged: an observation is in the capture and reproducible; an inference is our reasoning over it; documented is the tool’s own statement; a classification is our adversarially-reviewed judgment. Observation never reads as inference.
Observed — directly in the capture, reproducible
- No network egress to an external destination was observed during the scan. — Capture self-test: verified — a decoy beacon emitted from the tool's own network context appeared in the intercept, so the absence is a verified negative, not a blind spot. (confidence: high)
Classified — our adversarially-reviewed judgment
- No telemetry, analytics or error-reporting side-channel was found. — Reviewed against the tool's observed behaviour in the run. (confidence: medium)
Method
Installed and run in an isolated container; fed traceable decoy data; all outbound traffic intercepted (TLS broken via own CA, iptables transparent redirect). A beacon self-test confirmed the capture was live.
Scope
Compares the tool's declared destinations against what was observed in one sandbox run. Checks transparency / integrity for a cooperative tool, NOT resistance to deliberate evasion. "honest"/"clean" means "observed without deviation within our reach", NOT "guaranteed no hidden egress".
Out of scope: exfiltration split/chunked across requests; tool-side encryption of the payload before egress; input/time/state-triggered processing not triggered in the run.
Machine-readable verdict: /verdict/obsidian.json.
This page describes observed behaviour and its relation to the tool's own disclosures — it is not a legal judgment.
Search context: does mcp-obsidian send data, mcp-obsidian privacy, mcp-obsidian data flow, mcp-obsidian telemetry, where does mcp-obsidian send data, is mcp-obsidian safe, what data does mcp-obsidian collect, how to disable mcp-obsidian telemetry, mcp-obsidian opt out tracking, mcp-obsidian GDPR data residency, mcp-obsidian third-party / jurisdiction.