feat: support remote MCP asset server

Add Streamable HTTP transport for the source-file MCP server with bearer-token auth, configurable HTTP runtime options, and user-level systemd service helpers. Document remote client setup and cover auth/service behavior with unit tests.
2026-07-05 11:30:42 +00:00
parent 76a480a0b7
commit 31b0e8dba2
14 changed files with 945 additions and 10 deletions
@@ -332,6 +332,53 @@ Configure your agent to run `obsidian-wiki-mcp` as a stdio MCP server. The serve

 By default the MCP layer is stricter than local CLI lookup: it only serves engineering files such as drawings, 3D/STEP models, specifications, product parameters, and test reports. It blocks raw orders, prices, email correspondence, complaint evidence, claims, personal data, and files missing from `_meta/source-registry.jsonl`. Use `OBSIDIAN_MCP_BOT_PROFILE`, `OBSIDIAN_MCP_MAX_FILE_BYTES`, and `OBSIDIAN_MCP_EXPOSE_PATHS` to tune the runtime behavior.

+Optional: run the same MCP server over Streamable HTTP for a remote MCP client:
+
+```bash
+export OBSIDIAN_MCP_TOKEN='<long-random-token>'
+obsidian-wiki-mcp --transport streamable-http --host 127.0.0.1 --port 8765 --path /mcp
+```
+
+Remote HTTP requests must include:
+
+```http
+Authorization: Bearer <long-random-token>
+```
+
+Client configuration example:
+
+```json
+{
+  "mcpServers": {
+    "obsidian-wiki": {
+      "type": "streamable-http",
+      "url": "http://127.0.0.1:8765/mcp",
+      "headers": {
+        "Authorization": "Bearer <long-random-token>"
+      }
+    }
+  }
+}
+```
+
+For long-running access from another machine, use the managed user service:
+
+```bash
+bash scripts/new_mcp_service_token.sh
+bash scripts/start_mcp_service.sh
+```
+
+`new_mcp_service_token.sh` writes `.runtime/obsidian-wiki-mcp.env` with `0600` permissions and prints the remote URL, `Authorization` header, and client JSON. `start_mcp_service.sh` writes `~/.config/systemd/user/obsidian-wiki-mcp.service` and starts it. The service defaults to `0.0.0.0:8765/mcp` because it is intended for remote clients, but it still requires the bearer token. Prefer SSH tunnel, Tailscale, WireGuard, or another trusted network boundary instead of directly exposing the port to the public internet.
+
+Useful service commands:
+
+```bash
+bash scripts/show_mcp_service_config.sh
+bash scripts/stop_mcp_service.sh
+bash scripts/uninstall_mcp_service.sh
+python3 scripts/manage_mcp_service.py status
+```
+
 ### `_raw/` Staging Directory

 `_raw/` is a staging area inside your vault for unprocessed captures — rough notes, clipboard pastes, quick voice-memo transcripts. Drop files there and the next `wiki-ingest` run will promote them to proper wiki pages and remove the originals.