Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add pvliesdonk/markdown-vault-mcp --skill vault-setupgit clone --depth 1 https://github.com/pvliesdonk/markdown-vault-mcpWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/pvliesdonk/markdown-vault-mcp/vault-setup)<a href="https://agentmods.dev/skills/pvliesdonk/markdown-vault-mcp/vault-setup"><img src="https://agentmods.dev/badge/skills/pvliesdonk/markdown-vault-mcp/vault-setup/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/pvliesdonk/markdown-vault-mcp/vault-setup"><img src="https://agentmods.dev/badge/skills/pvliesdonk/markdown-vault-mcp/vault-setup.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 4 findings, up to high
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- high Agent Snooping · line 22 Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.Fix: Remove all code or instructions that access agent configuration directories (.claude/, .codex/, .gemini/). If configuration values are needed, pass them explicitly as parameters or environment variabl
- high Agent Snooping · line 24 Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.Fix: Remove all code or instructions that access agent configuration directories (.claude/, .codex/, .gemini/). If configuration values are needed, pass them explicitly as parameters or environment variabl
- high Agent Snooping · line 51 Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.Fix: Remove all code or instructions that access agent configuration directories (.claude/, .codex/, .gemini/). If configuration values are needed, pass them explicitly as parameters or environment variabl
- medium Rogue Agent · line 45 Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.Fix: Remove any persistence mechanisms (cron jobs, startup scripts, state files). Skills should not maintain state across sessions without explicit user consent.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00064 | $0.00959 |
| Opus 5 | $0.00032 | $0.00479 |
| Sonnet 5 | $0.00013 | $0.00192 |
| Haiku 4.5 | $0.00006 | $0.00096 |
Grade B, and why
vault-setup scanned grade B with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 9d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Reads agent configuration directoriesmediumAgent snooping
.claude/, .codex/, .gemini/ hold keys, settings and other credentials a mod has no legitimate need for.
`options.source_dir` in `~/.claude/settings.json`. How it starts
The opening of the file, as written. The whole thing — 91 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Setting up or repairing the markdown vault connection
The vault MCP server refuses to start without a valid
MARKDOWN_VAULT_MCP_SOURCE_DIR, and a broken value shows up only as a dead
Failed to connect entry in /mcp. This flow fixes both first-run setup
and later-life breakage (moved vault, expired git token). The vault tools
are down while you run it — use only local file access.
1. Diagnose
Read the effective configuration before changing anything. The plugin's
.mcp.json wires the server to plugin userConfig values, so the
authoritative source is the plugin's stored configuration:
CLAUDE_PLUGIN_OPTION_SOURCE_DIRin the environment, and the persisted copy underpluginConfigs(the key containingmarkdown-vault-mcp) →options.source_dirin~/.claude/settings.json.- Legacy fallbacks from installs that predate the config screen: the
envblock of~/.claude/settings.json, then the shell environment. If a legacy value disagrees with the plugin option, the plugin option is the one the server uses — say so.
If the directory is set and exists, the problem is elsewhere (embedding provider, git token) — skip to step 4.
2. Discover candidate vaults
Look for likely vault directories and present what you find rather than asking the user to type a path cold:
.obsidian/markers: check common roots such as~/Documents,~/Obsidian,~/Notes,~/vaults, one level deep.- Directories whose names suggest notes (
vault,notes,wiki,zettelkasten) containing.mdfiles. - If the old configured path exists nearby under a new name (moved vault), suggest the match.
Offer the candidates; let the user pick or supply another path. Expand ~.
3. Validate and write
Validate the choice before persisting: the directory must exist, be
readable, and (warn, do not block, if not) contain at least one .md file.
Then write the value where the plugin's .mcp.json substitution reads it —
the plugin's stored options in the user-scope ~/.claude/settings.json
(project-scope settings are ignored for plugin configuration). Find the
existing pluginConfigs key containing markdown-vault-mcp (or create
one matching how other plugins are keyed there) and set:
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 9d ago First seen · 91 lines · 64 tokens per session scan B 1a45ff09fc18
vault-setup is a skill published in the GitHub repository pvliesdonk/markdown-vault-mcp (32 stars, last pushed today), licensed MIT. It adds 64 tokens to every session and 959 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it B with 1 finding (reads agent configuration directories). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
mnemonic
Search local indexed markdown knowledge bases. Use when the user asks to find notes, dig up a concept from personal docs, cross-reference ideas across wikis, or answer from indexed local files. Triggers on "look up in notes", "search my docs", "what did I write about", "find in my vault", "check my index", "retrieve…
youtube-fetcher
Retrieve YouTube transcripts and subtitles, summarize or analyze what was said, or save an Obsidian-ready Markdown knowledge-base note with captions, creator metadata, chapters, language, and source provenance. Use for a YouTube URL or video ID when the request needs spoken content or an archival note. A bare YouTube…
link-memory
Use after important user-approved decisions, when durable context should be proposed or reviewed, and for explicit Link memory lifecycle work: remember, recall, review, update, archive, restore, forget, or explain local memories through the CLI without requiring MCP.
link-retrieve
Use before answering work that may depend on user memory, project history, source-backed notes, or prior decisions; retrieve compact Link context through the CLI without loading the whole wiki or requiring MCP.
link-ingest
Use when raw files are present, source pages look stale, or a user asks to ingest notes into Link; refresh source-backed wiki pages, propose memories, and validate updates through the CLI without MCP.
reduce
Extract structured knowledge from source material. Comprehensive extraction is the default — every insight that serves the domain gets extracted. For domain-relevant sources, skip rate must be below 10%. Zero extraction from a domain-relevant source is a BUG. Triggers on "/reduce", "/reduce [file]", "extract…