Every tool, by domain. Canonical spec with full ACL / HITL / idempotency / rate-limit annotations and I/O schemas: docs/G2.1-tools.md (design-era record + the post-1.0 additive ledger). This page is the at-a-glance index.

Every tool carries four annotations enforced by the dispatch pipeline: acl (read / write / delete / execute / admin), hitl (never / required / conditional), idem (pure / natural / keyed / non-idem), and ratelimit (read / write / bulk). See Security and ACL.

What tools/list advertises is controlled by toolFacade.mode: triad (default — find_capability, describe_capability, call_capability), domain (~a dozen domain meta-tools taking { action, args }), flat (the full surface), or auto (one of the three above, resolved per connecting client from its clientInfo.name; provisional, unmeasured and superseded by setting the mode explicitly — see the measured per-client advice under Choosing a facade mode per client on the docs site's MCP clients page). Every underlying tool stays callable by name in every mode; routing always goes through the same authorization pipeline.

Tools that return more than an acknowledgement accept response_format: "concise" | "detailed". Precedence: explicit response_format > the legacy verbosity alias > tools.defaults.responseFormat in config > detailed (the shipped default, unchanged output). Concise drops echo and bookkeeping fields but never a safety signal (quality_warning, a non-none poison_assessment, redactions, patch_note removal counts); errors are never shaped. Supported so far: read_note, read_notes, get_active_file, write_note, append_note, patch_note, update_frontmatter (the *_active_file tools pass it to their delegate), read_frontmatter, find_notes_by_property, list_notes, get_outgoing_links, get_backlinks, find_unresolved_links, read_resources, the search tools, note_quality_report, and (part 3) list_attachments, list_periodic_notes, list_snapshots, list_capture_queue, list_goals, search_and_read, vault_graph_search, knowledge_search, get_entity, query_entity_graph, get_session_traces, session_bootstrap, work_episodes, work_episode_chain, work_search, gap_report, rewrite_link and prune_hub_links (the last two trim only a real run), and (part 4a) vault_context, explain_answer, diagnose_retrieval, knowledge_get_critical, audit_provenance, vault_health_score, suggest_links, suggest_tags, bundle_files, bundle_folder, read_canvas and get_provenance. Reviewed and exempt, because there is nothing to drop: list_tags, list_properties, list_vaults, list_bookmarks, list_workspaces, list_kanban_boards, list_commands, list_quickadd_actions, list_templates, list_tasks, list_contradictions, episode_stats, find_orphans, the plur_* proxies and (part 4a) reflect, knowledge_challenge, the graph analysis tools (find_link_cycles, get_link_strength, graph_centrality, graph_communities, graph_path_between), the git_* tools, ocr_attachment, ocr_bulk, the base, canvas (except read_canvas), Excalidraw, Kanban and table tools, and the Dataview, Datacore, MakeMD, Omnisearch and Remotely Save passthroughs (the full table with reasons is on the Tools page of the user docs). Every other tool (memory, session and goal writes and acknowledgements, note, attachment, tag, property and snapshot operations, bookmark, workspace, periodic-note, template, task and plugin actions, and administration) is not yet covered and returns the full payload. resources/read takes no parameters, so only the config default applies to it (concise = the note body without frontmatter; scope, ACL, size ceiling and cache hints are unchanged). See Configuration for the config key.

Group	Domains	Examples
Notes & metadata	vault registry, note CRUD, frontmatter, tags, links	read_note, write_note, patch_note, update_frontmatter, get_backlinks
Search & retrieval	text / regex / semantic / JSONLogic / DQL search, indexing	search_vault, search_semantic, index_vault
Structured formats	Bases, Canvas, Excalidraw, periodic notes, tasks, attachments, bookmarks, workspaces	query_base, update_canvas, create_periodic_note, list_tasks
Plugin bridges	Dataview, Templater, QuickAdd, OCR, Smart Context, make.md, commands	eval_dataview_field, execute_template, execute_command
Memory & capture	memory entities, capture queue, workspace traces, plur proxy	add_observation, enqueue_capture, plur_recall
Knowledge & context (M7)	GraphRAG, composite context, reflection, red-team challenge	vault_graph_search, vault_context, reflect, knowledge_challenge
Work memory (M8, experiential)	quarantined agent-episode store, eligibility-gated readers	work_search, work_episodes, work_forget, record_retrieval_feedback
Git & sync bridges	Obsidian Git (commit is HITL-floored), Remotely Save	git_status, git_diff, git_commit, remotely_save_status
Bulk & URI	bulk create / move / set-property, obsidian:// URIs	bulk_create_notes, bulk_move_notes, generate_uri
Server admin	health, config, ACL introspection, metrics	server_health, inspect_acl, get_metrics

#	Domain	Tools
1	Multi-vault registry (4)	list_vaults, get_vault, reload_vault, reset_vault_cache
2	File / note CRUD (10)	read_note, read_notes, list_notes, note_exists, write_note, append_note, patch_note, delete_note, move_note, copy_note
3	Frontmatter / properties (5)	read_frontmatter, read_property, update_frontmatter, list_properties, find_notes_by_property
4	Tags (5)	list_tags, get_note_tags, add_tag, remove_tag, find_notes_by_tag
5	Links / backlinks / orphans (6)	get_outgoing_links, get_backlinks, find_orphans, find_unresolved_links, rewrite_link, prune_hub_links
6	Search (7)	search_vault, search_text, search_regex, search_semantic, search_jsonlogic, search_dql, index_vault
7	Bases .base (4)	read_base, create_base, update_base, query_base
8	Canvas .canvas (4)	read_canvas, create_canvas, update_canvas, query_canvas
9	Excalidraw (3)	read_excalidraw, create_excalidraw, update_excalidraw
10	Dataview standalone (2)	validate_dql, eval_dataview_field
11	Tasks (3)	list_tasks, update_task, tasks_filter
12	Periodic Notes (5)	get_periodic_note, create_periodic_note, find_or_create_periodic_note, append_to_periodic_note, list_periodic_notes
13	Templater (2)	list_templates, execute_template
14	QuickAdd (2)	list_quickadd_actions, trigger_quickadd
15	OCR / Text Extractor (2)	ocr_attachment, ocr_bulk
16	Smart Context bundling (2)	bundle_folder, bundle_files
17	make.md (2)	makemd_list_spaces, makemd_query
18	Workspaces (3)	list_workspaces, open_workspace, save_workspace
19	Bookmarks (3)	list_bookmarks, add_bookmark, remove_bookmark
20	Attachments (4)	list_attachments, get_attachment, move_attachment, delete_attachment
21	Capture / inbox queue (3)	enqueue_capture, list_capture_queue, commit_capture
22	Memory entities (5)	create_entity, get_entity, add_observation, link_entities, query_entity_graph
23	Workspace memory + traces (3)	start_session, end_session, get_session_traces
24	plur proxy (4)	plur_recall, plur_recall_hybrid, plur_similarity_search, plur_get
25	Bulk operations (3)	bulk_create_notes, bulk_set_property, bulk_move_notes
26	Command palette (2)	list_commands, execute_command
27	URI generation (1)	generate_uri
28	Server admin (4)	get_server_config, inspect_acl, get_metrics, server_health

• Facade meta-tools — find_capability, describe_capability, call_capability (+ domain-mode meta-tools). Boundary-only.
• Knowledge domain (M7) — vault_graph_search (GraphRAG: vector seeds + wikilink expansion fused with RRF), knowledge_challenge (red-team over decision history), vault_context (composite budgeted context with lesson surfacing + prewarm bootstrap), reflect (grounded synthesis / challenge / typed-delta preference profile).
• Work-memory domain (M8) — work_search, work_episodes, work_forget, record_retrieval_feedback — the experiential reader contract (eligible-only, tombstones, trust floor 0.3, caller partition). record_retrieval_feedback also takes verdicts (1 to 50 {chunk_id, feedback} items, applied in one transaction) and returns a per-item results array.
• Domain 30: Obsidian Git bridge — git_status, git_diff, git_log, git_stage, git_commit (execute-family HITL floor — commits always require human confirmation).
• Domain 31: Remotely Save bridge — remotely_save_status, remotely_save_trigger (independent backup verification).
• Additions to existing domains — snapshots/restore, vault health, add_vault, markdown tables, kanban, filesystem Excalidraw read.
• Offline CLI family (not MCP tools — run against the same config + caches): cluster, activation-recompute, citation-infer, contribution-report, prefetch, reflect, metrics, gaps, forget, context-export, context-import. See the server README.

A tool that needs an unavailable capability (a missing plugin, an unconfigured embedding provider) returns a typed error from the shared taxonomy (e.g. plugin_missing, embedding_provider_error) with a retryable flag — never an opaque failure. At the MCP boundary a dispatch failure surfaces as a Tool Execution Error (isError: true plus the structured error), so a model can self-correct.

Every error also carries a recovery string: bounded next-step guidance for that code, naming the tool to call next where one exists (acl_denied points at inspect_acl, dql_error at validate_dql, plugin_missing at refresh_plugin_capabilities). Where retryable says whether to retry, recovery says what to do instead. Hints are selected by error code alone, so they never echo a path, query, caller or vault back to the client.

Auto-generated from the tool registry — the exhaustive, always-current list. Run bun run docgen:render; do not hand-edit between the markers.

184 tools. Access is a coarse hint; the required scopes are authoritative. Profile is which toolFacade.profile value(s) make the tool visible/callable — see Tool profile.

Tool	Access	Profile	Scopes	Description
add_bookmark	write	full only	write:bookmarks	Add a bookmark (optionally into a named group, created if absent). A duplicate is a no-op unless allow_duplicate is set. Domain: workspace.
add_kanban_card	write	full only	write:notes	Add a card to a Kanban column (by name). Appends - [ ] text (or - [x] when checked) under the column heading, preserving the rest of the board.
add_observation	write	core, full	write:memory	Append a fact to a memory entity (re-materializing its note when materialized). observation must be a single non-blank fact with no embedded newline — a caller with more than one fact calls this more than once. An optional key opts the observation INTO supersession tracking — when the same entity already has an OPEN observation with that key, it is closed (not deleted: its text stays under the note's Superseded section, its interval's valid_to is set and superseded_by records what replaced it) and the new text opens a fresh interval. An observation added with no key never supersedes anything and is never superseded automatically; it just appends. Matching is always by this explicit key, never inferred from text similarity. To CORRECT or REMOVE an existing fact (including one with no key), do not add a contradicting observation: call update_observation with its observation_id (returned by create_entity, add_observation and get_entity). valid_from/valid_to (ISO 8601) let a caller backdate a fact or bound it explicitly. To retire a keyed fact WITHOUT replacing it, omit observation and pass key + valid_to — closes the open interval for that key with no new text appended. Domain: knowledge.
add_tag	write	core, full	write:notes	Add a tag to a note's frontmatter tags list or inline in the body (idempotent). Domain: metadata.
add_vault	write	core, full	admin:vault	Register a new vault at runtime (no restart). Validates the path is an existing directory, adds it to the registry, and indexes it for search. Runtime-only — add it to the config file to persist across restarts.
append_active_file	write	full only	write:notes	Append content to the note currently open in the live Obsidian session (append_note, aimed at the active note), preserving existing bytes. Same prev_hash compare-and-swap, snapshot, memoryDefense and provenance rules as append_note. Refuses a non-markdown active file.
append_note	write	core, full	write:notes	Append content to the END of a note (optionally creating it with create_if_missing: true), preserving existing bytes. It takes no anchor: to add under a specific heading, or anywhere other than the end, use patch_note instead. Set provenance: "agent_synthesis" when the appended content is a derived/inferred conclusion an agent produced rather than authored/copied text — this routes the appended content through a poison scan before the write lands (rejected outright on high risk) and surfaces the assessment in the result; also add source: agent-synthesis to the note's own frontmatter by convention. response_format=concise acknowledges with {vault, path, content_hash} only (plus quality_warning, poison_assessment or redactions when they carry something).
append_to_periodic_note	write	full only	write:periodic	Append content to a period's note (creating it if needed), optionally under a heading. idempotency_key is accepted (enforcement lands with the policy layer).
audit_provenance	read	core, full	read:notes	Provenance audit: flag claim-bearing notes that lack a 'sources' frontmatter field (the evidence a note's claims rest on), and report coverage of sources/confidence/verified across the readable note set. Read-only. Excludes daily notes, templates, and index files by default; tune scope with include/exclude globs and the field name. response_format=concise drops the field echo, with_provenance and the by_folder breakdown.
bulk_create_notes	write	core, full	write:notes, bulk:notes	Batch-create notes with per-item results. Each item creates/overwrites/upserts a note (content + optional frontmatter). HITL-floored (bulk) and throttled; best-effort by default (stop_on_first_error opt-in). response_format=concise omits processed, duration_ms and each item's mode_used.
bulk_move_notes	write	core, full	write:notes, delete:notes, bulk:notes	Batch-move notes and rewrite backlinks across the whole link graph (rewrite phase is all-or-nothing). dry_run (default true) previews predicted backlink updates without touching disk. Set overwrite to clobber existing destinations (each is soft-deleted to .trash, recoverable). HITL-floored (bulk) and throttled.
bulk_set_property	write	core, full	write:notes, bulk:notes	Set one frontmatter property across many notes, with per-item results (prev_value). HITL-floored (bulk) and throttled; best-effort by default (stop_on_first_error opt-in). response_format=concise omits processed and duration_ms.
bundle_files	read	core, full	read:context	Aggregate an explicit list of notes into a single markdown/XML bundle. ACL-filtered; byte budgeted; reports missing_paths for files that do not exist. response_format=concise drops the per-file list and total_bytes.
bundle_folder	read	core, full	read:context	Aggregate all notes under a folder into a single markdown/XML bundle (Smart Context). ACL-filtered; file-count and byte budgeted with an explicit truncated flag. When truncated, resume with the returned cursor; max_files and max_bytes apply per page, so loop until cursor is absent. response_format=concise drops the per-file list, total_bytes and the root echo.
cancel_task	read	core, full	—	Ask a long-running tool call that returned a task handle to stop (index_vault on a large vault does). Pass the task_id from the handle. Cancellation is cooperative: the task keeps working until it reaches a checkpoint, so the returned status may still be working; call get_task_status to see it end as cancelled. A task that already finished is returned unchanged. Only the caller that started the task can cancel it. Domain: admin.
close_goal	write	core, full	write:workspace	Close a stated goal into a terminal state: completed or abandoned. Once-only — a second close reports closed:false rather than silently succeeding, and there is no reopen verb, because a system that quietly reopened a goal the user completed is exactly the low-confidence mutation this plane forbids. 'expired' is not settable here; it is the deadline sweep's verdict alone.
commit_capture	write	core, full	write:capture	Write a queued capture to a vault path and mark it committed (or remove it from the queue). Refuses to overwrite an existing note.
commit_wiki_page	write	full only	write:notes, read:notes	Apply a wiki changeset in one step: a new page (path, frontmatter, the body you wrote) plus patches to existing pages that link them to it, from draft_wiki_page. The page must be inside the vault's configured wiki folder (vaults[].wiki.folder; a vault without one refuses). All or nothing on errors: every touched note is checked first (write and read ACL on each path, prev_hash compare-and-swap on each existing note, the poison and memory-defense scans), temp files for every note are staged, then the notes are replaced back to back, each re-hashed just before it is replaced, with a rollback if any write fails, so a failing patch leaves the vault as it was. NOT crash-atomic: a process crash in the middle of the renames can leave a partial batch; a pending write-provenance record naming every path and the hash it was about to hold is written before the first rename, so the batch is visible and every replaced note has a snapshot (restore_note). Creating a page in the wiki folder needs NO confirmation (a new page has no prior state, so it has no snapshot: delete_note removes it); patching a related note needs none either, as patch_note, and restore_note undoes patches and overwrites; overwriting an existing non-empty page (page.mode: overwrite) asks for confirmation exactly like write_note. Re-checks at commit time that no other page already covers the topic (an identity match refuses the commit with the existing page named; allow_duplicate: true overrides). Problems that are for you to fix do NOT block the write and come back in problems: frontmatter that breaks the wiki folder's SCHEMA.md (missing required field, unknown type or property, value outside the vocabulary), links in the page that resolve to no note, related notes from the link map the page does not link, patches that add no link, a page nothing links to. Open contradictions already flagged on a touched note come back in contradictions. Patches only ADD (link: a bullet under a heading, once; append: text at the end or under a heading); rewrite prose with patch_note. Every write is recorded in the write provenance chain and indexed. Snapshot retention and reindexing after the write are best-effort: a fault there is logged and comes back as a post_commit problem, never as an error. After the write the server queues regeneration of the wiki folder's generated index.md (pages grouped by type) and log.md (a projection of the write provenance chain), so even a very large wiki never delays this call. Generation lists only paths readable without a rule-scope and never an Excluded note; failures and hand-edited generated pages are logged and never fail or delay the committed write. Needs read:notes as well as write:notes: the duplicate re-check reads every note you may read.
copy_note	write	core, full	write:notes	Copy a note to a new path (backlinks are not rewritten for copies).
create_base	write	full only	write:bases	Create a new .base file from a base definition. Overwriting an existing base requires confirmation.
create_canvas	write	full only	write:canvas	Create a new .canvas with optional initial nodes/edges. Overwriting an existing canvas requires confirmation. Domain: structured.
create_entity	write	core, full	write:memory	Create a typed memory entity (optionally materialized as a vault .md note). SQLite is the source of truth. Each string in observations must be a single non-blank fact with no embedded newline — a caller with more than one fact passes more than one array element. The result lists each observation with its observation_id; to correct or retire a fact later, pass that id to update_observation (an observation needs no key to be edited). Domain: knowledge.
create_excalidraw	write	full only	write:excalidraw	Create a new Excalidraw note via the companion plugin. Overwriting an existing drawing requires confirmation.
create_periodic_note	write	full only	write:periodic	Create the periodic note for a period + date using the configured (or overridden) template. Fails if it already exists. Set expand_template=true to expand the template through Templater (requires write:templater; degrades to a verbatim copy when the companion/plugin is unavailable).
delete_active_file	destructive	full only	delete:notes	Delete the note currently open in the live Obsidian session (delete_note, aimed at the active note): to the vault's .trash mirror, or permanently. Destructive: requires human confirmation bound to the resolved note, so a confirmation raised while one note was active cannot be redeemed once another is. restore_note reads its undo from a snapshot when snapshots are enabled. Refuses a non-markdown active file.
delete_attachment	destructive	full only	delete:attachments	Delete an attachment (to the vault's .trash mirror, or permanently). Destructive — requires confirmation. Reports notes that still reference it.
delete_entity	destructive	core, full	delete:memory	Delete a memory entity outright — the escape hatch for 'created it by accident', NOT the primary retirement path (use rename_entity's status param to retire instead; that stays reversible, this doesn't). Destructive; requires confirmation. Dependency-aware like forget: refuses when the entity has any relation, incoming or outgoing, unless cascade is set — in which case those relations are removed too and every OTHER materialized entity that referenced this one has its note re-materialized so its links stop dangling. The entity's own note is trashed (recoverable) unless permanent is set.
delete_note	destructive	core, full	delete:notes	Delete a note (to the vault's .trash mirror, or permanently). Destructive — requires confirmation. restore_note reads its undo from a snapshot, which is captured only when the server's snapshots.enabled config is on; the default "trusted-local" posture leaves it on, so a deleted note has a restore_note path back unless snapshots have been explicitly disabled.
diagnose_retrieval	read	core, full	read:notes	Explain why a specific note was or was not returned for a query. Re-runs the retrieval pipeline with per-stage tracing and reports, for that one note, where it was present, its score and rank where a stage produces them, and the first stage that dropped it. Read-only and non-mutating; reports nothing about paths the caller cannot read. response_format=concise returns returned, dropped_at and summary without the per-stage trace.
draft_wiki_page	read	full only	read:notes	Plan a new wiki page WITHOUT writing anything: the step between find_existing_page and commit_wiki_page. Give a topic (and optionally a page type from the wiki folder's SCHEMA.md and sources, the notes or URLs the page draws on). Returns (1) the dedupe verdict from find_existing_page: if a page already exists you get it back with a suggestion to link to it or extend it instead of creating a duplicate, and no changeset; (2) the wiki folder's SCHEMA.md (page types, the frontmatter each requires, the allowed property vocabulary; a malformed file is a warning, never an error); (3) a link map: existing notes the new page should link TO (your sources, related pages) and notes that should link FROM it (notes that mention the topic without linking it, related wiki pages), and notes that already link it; (4) a CHANGESET SKELETON: the new page's path and frontmatter with the required fields empty, and a link patch (with the note's current prev_hash) for each note that should link to the new page. With source (a note in the vault's raw folder) the draft ingests it: that note is cited in the skeleton's sources and reported (size, the wiki pages that already cite it), raw notes are never offered as duplicates or patch targets, and a source under 1500 characters with no page in the wiki that covers, relates to or cites it comes back with no changeset (ingest.refused), because a page for it would only restate it; a source you may not read answers like a missing one. You write the page body (and any text for a patch); the server never writes prose. Pass the filled changeset to commit_wiki_page. Read-only: it never writes, respects the read ACL and Obsidian's Excluded files (an excluded note is never offered for patching), and with judge (default from the wikiJudge config) the dedupe check may send the topic and the opening text of up to 3 readable notes to the gateway judge model, exactly as find_existing_page does.
end_session	write	core, full	write:workspace	Finalize a workspace session, appending a session_end record to its JSONL trace.
enqueue_capture	write	core, full	write:capture	Stage content in the SQLite capture queue for later commit to the vault (no vault write at enqueue time).
episode_stats	read	core, full	read:workspace	Aggregate activity counts over the experiential episode log WITHOUT returning any episode content. work_search/work_episodes are all-or-nothing: seeing activity patterns otherwise requires admin:workspace, which also grants full row content. This returns counts only, so an operator can answer 'what is this agent doing' without reading what it did. Grouping by caller is not offered — the group_by enum excludes it deliberately. Buckets smaller than min_bucket are withheld and summed into suppressed, because a count of 1 in a narrow bucket is equivalent to reading the row.
eval_dataview_field	read	full only	read:dataview	Evaluate a Dataview field expression against a single note (useful for property derivation).
execute_command	write	full only	execute:command	Fire an Obsidian command by id. Deny-by-default and triple-gated: requires human confirmation (execute:command is a HITL floor), command execution must be enabled for the vault, and the id must be on the vault allowlist. Falls back to Local REST API's native /commands/{id}/ route when the companion is unreachable. Never silently runnable. Domain: automation.
execute_template	write	full only	write:templater	Run a Templater template and write the expanded output to a target path. Returns the vault-relative path Templater actually created. Always requires human confirmation (write:templater is a HITL floor) because templates can execute arbitrary user JavaScript. Domain: automation.
explain_answer	read	core, full	read:notes	Explain what an answer actually used: walks retrieval -> chunk -> citation -> episode for one session or time window and reports each link with how well it is known. Distinguishes a retrieval the citation pass never judged from one it judged and rejected, and a chunk whose note no longer exists from one that was never used. Read-only; reports nothing about paths the caller cannot read. response_format=concise drops the summary counts and each link's retrieval echo (time, surface, query text, rank); the caveat and the citation-pass record stay.
fetch	read	core, full	read:notes	Fetch one note by the id a search result returned and return {id, title, text, url, metadata}: the full note text (frontmatter included), an absolute citation url, and metadata {vault, path, content_hash, modified}. Refuses a note the caller may not read exactly as read_note does.
find_existing_page	read	full only	read:notes	Check whether a page on a topic ALREADY EXISTS before creating one (dedupe / page-exists check): run this before write_note when you are about to add a new wiki page, concept note or entity page, so you link to the existing page instead of writing a duplicate. Give a topic string (and optionally a folder to look in); get a verdict exists | ambiguous | new plus the candidate notes with the evidence for each: exact path or file name, an aliases frontmatter entry, a wikidata: property holding the same QID (pass 'Q42' or a wikidata URL), a title or H1, the text other notes (including property links) already link it under, and semantically near notes. Read-only and advisory: it never writes and never blocks. Respects the read ACL, and Obsidian's Excluded files: an excluded note still counts when its name or alias matches (it is a link target) but is never a similarity match. Ambiguous candidates that rest on similarity or link text alone can be resolved by an LLM judge (judge, default from config): exactly one same-topic ruling makes the verdict exists, all candidates ruled different makes it new, anything else (or any failure) stays ambiguous; a name, alias or wikidata match is never overridden or sent to it. response_format=concise returns {path, strength, evidence kinds} per candidate, without evidence details or scores.
find_link_cycles	read	full only	read:notes	Detect circular internal-link chains (a -> b -> ... -> a) in the readable note graph. Returns up to limit cycles as ordered path lists.
find_notes_by_property	read	core, full	read:notes	Find notes whose frontmatter has a key (optionally equal to a value, or containing it when the value is a list). Set response_format=concise (legacy alias verbosity=terse) to return path only (dropping the matched value). Set nested=true to match a dotted key path. Domain: metadata.
find_notes_by_tag	read	core, full	read:notes	Find notes carrying a tag, hierarchically (a query for project matches project and project/sub). response_format=concise returns {path} per match, without the matched tags and total.
find_or_create_periodic_note	write	full only	read:periodic, write:periodic	Get the periodic note for a period + date, creating it (empty/template) if absent. With expand_template=true a newly created note is expanded through Templater when available (requires write:templater). response_format=concise omits the period echo and the parsed frontmatter.
find_orphans	read	core, full	read:notes	Find notes that nothing else links to (optionally also requiring no outgoing links); a link in a property counts. A note whose frontmatter is not valid YAML does not fail the scan: its body is still read and it is named in warnings.
find_unresolved_links	read	core, full	read:notes	Find internal links that do not resolve to any note (dangling links), including quoted wikilinks in properties (tagged source=property). response_format=concise returns {source_path, target, line} per link, without col and kind.
format_table	write	full only	write:notes	Reformat a GFM markdown table in a note: realign columns to a uniform width, honoring the delimiter row's alignment. Addressed by 0-based table_index within the note. Domain: structured.
gap_report	read	core, full	read:notes	Read-only view of the latest gap-detector pass: which of the pass's queries scored below the calibrated coverage floor, with their nearest-hit context. Populated by the offline obsidian-tc gaps pass; computed_at tells you how fresh it is, and null means no pass has ever been persisted for this vault. Never recomputes — a fresh reading requires re-running the CLI pass. Nearest-hit paths are filtered to the caller's read ACL before being returned. response_format=concise returns {id, query, top_score, gap} per item, without results and nearest, and omits threshold, min_results and returned; computed_at, total, gaps and gap_rate are kept.
generate_uri	read	core, full	—	Build an obsidian:// URI for a target (open/search/new/daily/command/hookmark/advanced). Pure string builder — touches no vault state, requires no scope. vault_name is the Obsidian DISPLAY NAME (not a vault id) and is used verbatim.
get_active_file	read	full only	read:notes	Read the note currently open in the live Obsidian session (same result as read_note, including the optional anchor section). Resolves the active file through the companion plugin, then reads it under the normal read scope and folder ACL. response_format=concise is read_note's (the body, or just the section, without frontmatter). When the active file is not markdown (a canvas, PDF or image) it returns its path, extension and stat only. Errors, never guesses: note_not_found with reason no_active_file when nothing is open; plugin_unreachable / requires_live_obsidian when there is no live session.
get_attachment	read	full only	read:attachments	Read an attachment's bytes (base64) plus MIME type and size. Fails with invalid_input when the file exceeds max_bytes. Domain: attachments.
get_backlinks	read	core, full	read:notes	Find every note that links to the given note, with source line/column. A quoted wikilink in a property counts, tagged source=property with the property name. A note whose frontmatter is not valid YAML does not fail the scan: its body is still read and it is named in warnings. response_format=concise returns {source_path, line} per backlink, without col, raw, kind and display.
get_entity	read	core, full	read:memory	Read a memory entity by id, by type+name, or by unique name, with its observations and relations. Retired entities are hidden unless include_retired is set. An entity is readable only when its own note (//.md) is readable under the caller's folder read ACL (readPaths); one that is not reads as 'entity not found', and relations to such entities are omitted. Observations returned are filtered by as_of — a fact is included when valid_from <= as_of and (valid_to is unset or as_of < valid_to). Default as_of is now, so an as_of in the PAST excludes any observation added after that instant, even one that is still open today. Each observation carries an observation_id: to correct or retire a fact (keyed or not), pass it to update_observation. response_format=concise returns each observation as {observation_id, text, key?} (plus valid_to and superseded_by when set) and omits vault_path when null, created_at, updated_at and as_of.
get_index_status	read	core, full	—	Search-index health at a glance: boot reconcile state, write-failure count, notes/FTS/vec readiness, chunks_upserted from the last index_vault call, and in-flight progress while one is currently running. Read-only — self-diagnose before spending on an expensive search. chunks_upserted and in_flight count the shared index, notes a read rule hides included, so they are null / absent for a caller without unrestricted read. Domain: admin.
get_link_strength	read	core, full	read:notes	Score the connection strength (0-1) between two notes from the link graph: direct edge, co-citation (shared inbound sources), shared outbound neighbors, and undirected graph distance.
get_metrics	write	core, full	admin:metrics	Snapshot Prometheus-style metrics as structured JSON: per-(vault,tool,status) invocation counters and rate-limit-hit counters aggregated from the local event_log + live limiter, plus uptime/registered-vault/registered-tool gauges. Optionally filter to one vault. Domain: admin.
get_note_tags	read	core, full	read:notes	Get a note's tags, split into frontmatter, inline, and the combined set. response_format=concise returns only the combined set (all).
get_outgoing_links	read	core, full	read:notes	List a note's outgoing links (code-block links excluded), each resolved to a target path. Quoted wikilinks in its properties count too, tagged source=property with the property name. response_format=concise returns {target, line, resolved} per link, plus heading, target_path and candidates when present, without raw, kind, display and col.
get_periodic_note	read	full only	read:periodic	Get the periodic note for a period + date (no creation). Resolves the path from the vault's daily/periodic config or Obsidian defaults. response_format=concise omits the period echo and the parsed frontmatter (the content carries it). Domain: workspace.
get_provenance	read	full only	read:notes, read:provenance	Signed write history of one note: which mutating tool calls changed it, newest first, each with outcome, timestamp, sha256 before/after, and who made the call. verified holds what the server established (host, and the principal/persona/session only when a bearer token was verified); unauthenticated a caller label nobody proved; self_reported what the client claimed about itself (model, project, agent, client) and can be false. Moves (move_note, bulk_move_notes, move_attachment) are followed backwards to the note's earlier paths, but only through move records that verify: a move that fails stops the walk and is reported as lineage_incomplete. One bounded pass over the chain: scan_truncated means the row budget ran out and older history was not examined. Only paths you can read are listed, an unreadable path answers exactly like one with no history, and a record naming other paths never shows the ones you cannot read (its hash is then a hash of the visible view). cursor is the signed next_cursor of a previous page of the same request. include_verification re-checks each returned record's hash, signature and chain link (not whole-chain completeness: run obsidian-tc provenance verify). since/until are epoch milliseconds, inclusive. Needs read:provenance as well as read:notes. response_format=concise drops the host, the full path list, the record hash and machine.
get_server_config	write	core, full	admin:config	Read the non-secret server config: auth mode, server-global read_only + embeddings provider, throttle limits, observability targets, and a per-vault summary (id) plus a detected-plugins map. Never returns secrets. response_format=concise drops the per-class throttle tiers, the observability toggles and the retrieval-defaults report.
get_session_traces	read	core, full	read:workspace	Replay JSONL trace records for one session, or across a started-at date window, with optional tool filtering. response_format=concise drops args_hash and caller from each record and omits total_returned; every other field of a record is kept.
get_task_status	read	core, full	—	Status of a long-running tool call that returned a task handle instead of a result (index_vault on a large vault does). Pass the task_id from the handle; while status is working it reports progress, and once completed it carries the tool's result. Read-only; only the caller that started the task can read it. Domain: admin.
get_vault	read	core, full	read:vault	Inspect a single vault's configuration and cache state.
git_commit	write	full only	execute:git	Commit the staged changes of the vault's git repo. Always requires human confirmation (execute:git is a HITL-floor family) — a commit is irreversible-in-effect from the agent's side.
git_diff	read	full only	read:git	Unified diff for one vault file (working tree, or the staged copy with staged: true), via the Obsidian Git companion bridge.
git_log	read	full only	read:git	Recent commits of the vault's git repo (hash/message/author/date), via the Obsidian Git companion bridge. Unavailable under a read whitelist (log messages enumerate paths).
git_stage	write	full only	write:git	Stage vault files for the next commit, via the Obsidian Git companion bridge. Write-family: the readOnly kill switch applies.
git_status	read	full only	read:git	Working-tree status of the vault's git repo (changed/staged/conflicted), via the Obsidian Git companion bridge. Unavailable under a read whitelist (repo status enumerates every path).
graph_centrality	read	full only	read:notes	Structural importance of notes in the persisted link graph. metric 'pagerank' answers 'what do many notes point at' (power iteration, damping 0.85); metric 'betweenness' answers the different question 'what sits between otherwise disconnected areas' — a bridge note can score high on betweenness with only two links. ANALYTICS ONLY: these scores are never used for retrieval ranking. Notes outside your read scope are excluded from the graph entirely, not just from the output.
graph_communities	read	full only	read:notes	Community detection over the persisted link graph (Louvain). Partitions notes into clusters that link to each other more than to the rest of the vault. Deterministic: the same vault and seed always yield the same partition. ALWAYS read meaningful — a modularity below 0.3 means the partition is not distinguishable from chance, and presenting those clusters as 'your vault's topics' would be inventing structure. ANALYTICS ONLY, never used for retrieval ranking.
graph_path_between	read	core, full	read:notes	Trace how one note connects to another through the persisted link graph: the shortest chain of notes joining them, with the edge types behind each hop. Undirected by default, because a reader follows a backlink as readily as a link; directed:true answers the narrower 'can I reach B by following links out of A'. Returns connected:false when no chain exists within your read scope.
index_vault	write	core, full	admin:vault	Chunk and embed the vault (or a folder) into the search index. Incremental: chunks whose content hash is unchanged are skipped; removed chunks are pruned. response_format=concise drops the bookkeeping counters and keeps the failure, skip and degradation signals.
insert_table_column	write	full only	write:notes	Insert a column into a GFM table: a header plus per-row values (default empty) and an alignment. at is the 0-based column position (default: append).
insert_table_row	write	full only	write:notes	Insert a data row into a GFM table. values are cell strings (padded/truncated to the column count); at is the 0-based data-row position (default: append).
inspect_acl	write	core, full	admin:acl	Test whether a (vault, path, op, scopes) tuple would be permitted. Shares the live path evaluator (read-only kill switch + per-op whitelist) so it cannot drift from enforcement, then checks the op-family scope grant and the path-required rule-scopes (P1.4: a matching rule's scopes must all be held). Reports the matched path rule, the rule-based effective_scopes, and what denied it. Domain: admin.
inspect_visibility	write	core, full	admin:acl	Explain why a tool is or is not offered to a caller: returns listed | hidden | disabled | scope_denied | unregistered per tool, plus the RULE that decided it (which name/tag list matched, which required scopes are missing). Pass scopes/read_only to evaluate a hypothetical caller the way inspect_acl does, tool to ask about one, or visibility to filter. response_format=concise returns {name, visibility, reason} per tool (plus matched_tag and missing_scopes when the verdict has them). Shares the registry's own classifier and config, so it cannot drift from what tools/list does. admin:acl-scoped BY DESIGN: distinguishing hidden from unregistered is exactly the existence oracle the unauthenticated surface refuses to be.
knowledge_challenge	read	core, full	read:notes	Red-team a proposal against your documented decision history. Retrieves decision-bearing chunks (02-projects, 04-writing/Published, 09-reference/system-reviews, 09-reference/syntheses, or notes tagged decision, audit, self-audit, outcome, postmortem, reversal, lesson, review, analysis) and asks the inference gateway to flag DIRECT_CONTRADICTION / PATTERN_REPEAT / REVERSAL / HIDDEN_DEPENDENCY. That decision rule is fixed, not per-vault: a vault whose folders and tags match neither list gets no evidence, and coverage reports recalled and filtered_out counts so the cause is visible. Open contradictions are supplied only when the plane is enabled (plane.enabled). Cited paths are checked against the evidence shown; unseen ones are listed in coverage.unresolved_evidence_paths. Requires the gateway; reports unavailable when it is not configured.
knowledge_get_critical	read	core, full	read:docs	List the critical-severity docs in a vendor / external-docs corpus: the breaking changes, security issues, and production gotchas to read before starting work. A tight metadata pre-filter over frontmatter severity == 'critical', not a search. Optionally narrow by source (the vendor or tool the doc is about). Gated on read:docs so it stays isolated from the private vault. response_format=concise drops the count and the constant severity of each item.
knowledge_search	read	core, full	read:docs	Semantic + keyword search over a vendor / external-docs corpus (a reserved read-only docs vault), with wikilink graph expansion and RRF fusion. The docs-scoped analogue of vault_graph_search: bind vault to the docs corpus id. Returns source-attributed chunks tagged seed|expansion. Gated on read:docs so it stays isolated from the private vault. response_format=concise returns {chunk_id, path, content, rerank_score} per result without source, hop, via_edge and root_seed, and drops route and coverage.
link_entities	write	core, full	write:memory	Create a typed relation between two memory entities (idempotent; re-materializes the source's links). Domain: knowledge.
lint_wiki	read	full only	read:notes	Wiki health check in ONE call: lint a folder (or the whole vault) and get a list of PROPOSED fixes, each with a suggested action and the tool that applies it. Combines find_orphans, find_unresolved_links (property links included), list_contradictions (open rows only), note_quality_report (stale / duplicated notes), audit_provenance (notes missing sources), gap_report (topics with no good page) and a NEW near-duplicate pass over note-level embeddings that finds pages restating the same topic (so you merge or link instead of keeping two), optionally with an LLM judge (judge=true) that reads each near-duplicate pair and adds a verdict (same_topic / overlapping / different) to the proposal. Use it for periodic wiki upkeep, after a batch of writes, or when asked to clean up, audit or dedupe a wiki. Read-only: it never writes and never blocks anything; apply the proposals with the named tool yourself. A check that cannot run (no rollup, no embeddings) is listed under skipped rather than failing the call. Respects the read ACL and Obsidian's Excluded files (an excluded note is never the subject of a proposal, but still counts as a link source and target). The wiki folder's generated index.md and log.md are never the subject of a proposal and their links count for nothing; a hand-edited or foreign one is reported as a generated_page proposal. Pick checks with checks; response_format=concise returns {kind, subject, related, suggested_action, tool} per proposal without detail, tool_args and evidence.
list_attachments	read	full only	read:attachments	List attachment files in the vault (filtered by extension, read-ACL aware), with cursor pagination. Optionally count referencing notes per file. response_format=concise returns {path, reference_count?} per attachment, without size, mtime, mime, folder, attachment_folder and total_returned.
list_bookmarks	read	full only	read:bookmarks	List the vault's bookmarks tree (.obsidian/bookmarks.json), preserving groups and unknown fields. Domain: workspace.
list_capture_queue	read	core, full	read:capture	List captures in the queue (pending by default; committed:true lists committed), newest first. Each item carries the poison-scan verdict assessed at enqueue time — review poison_assessment before calling commit_capture. response_format=concise omits null and empty fields (title, tags, source, target_path_hint, committed_at, committed_path) and total_returned; poison_assessment is always kept.
list_commands	read	full only	read:command	Enumerate available Obsidian commands (optional substring filter). Uses the companion plugin, falling back to Local REST API's native /commands/ route when the companion is unreachable. Domain: automation.
list_contradictions	read	core, full	read:notes	List open contradictions (judge_verdict: 'contradiction' | 'tension') touching any of the given notes — the same detector output vault_context/reflect/knowledge_challenge surface indirectly, exposed directly for standalone inspection. Read-only.
list_goals	read	core, full	read:notes	List a vault's stated goals, newest first. Defaults to OPEN goals only — a consumer that forgets to filter should see current intent rather than a graveyard of closed ones. Pass status to narrow to a terminal state, or 'any' for the full history. 'expired' (the deadline sweep's verdict) and 'abandoned' (the user's) are deliberately distinct and must not be counted together. response_format=concise returns {id, text, status} per goal plus target_date and closed_at when set, without source, created_at and count.
list_kanban_boards	read	full only	read:notes	List Kanban board notes in the vault (frontmatter kanban-plugin: board), with column and card counts.
list_notes	read	core, full	read:notes	List notes under a folder (read-ACL filtered), with cursor pagination. response_format=concise returns {vault, notes: [{path}], next_cursor}, without size, mtime, folder and total_returned.
list_periodic_notes	read	full only	read:periodic	Enumerate existing periodic notes in a date range (probes the configured format/folder). Defaults to a recent window when from/to are omitted. response_format=concise returns {date, path} per item, without period and mtime; total, overflow and next_cursor are kept.
list_properties	read	core, full	read:notes	Aggregate frontmatter property keys across notes, with usage counts and value types.
list_quickadd_actions	read	full only	read:quickadd	Enumerate configured QuickAdd actions (template/macro/capture/multi) via the companion bridge.
list_snapshots	read	core, full	read:notes	List a note's point-in-time snapshots, newest first (id, op, content_hash, size, created_at). response_format=concise returns {id, op, created_at} per snapshot, without content_hash, size and total.
list_tags	read	core, full	read:notes	Aggregate all tags (frontmatter + inline) across notes, with usage counts.
list_tasks	read	full only	read:tasks	List tasks across the vault (or a root/paths subset) with typed status/priority/tag/due filters. Filesystem-only; needs no plugin.
list_templates	read	full only	read:templater	List available Templater templates with parsed metadata (user functions, parameters), via the companion bridge. Domain: automation.
list_vaults	read	core, full	read:vault	List configured vaults and their cache state. Domain: vault.
list_workspaces	read	full only	read:workspaces	List saved workspace names and the active workspace (.obsidian/workspaces.json).
makemd_list_spaces	read	full only	read:makemd	Enumerate make.md spaces (its alternative to folders) via the companion bridge.
makemd_query	read	full only	read:makemd	Forward a make.md space query through the companion bridge. Current make.md releases expose no query API, so the companion reports make.md as unreachable; sort, limit and cursor are not passed to make.md.
move_attachment	write	full only	write:attachments, delete:attachments	Move/rename an attachment and repoint note links to it (link style preserved). Crossing a folder boundary or overwriting requires confirmation.
move_kanban_card	write	full only	write:notes	Move a card (matched by text) from one Kanban column to another, preserving its original line (checkbox state, inline metadata).
move_note	write	core, full	write:notes, delete:notes	Move/rename a note and update backlinks. Crossing a folder boundary OR overwriting an existing destination requires confirmation; an overwritten destination is soft-deleted to .trash (recoverable).
note_exists	read	core, full	read:notes	Check whether a path exists in the vault and whether it is a file or folder.
note_quality_report	read	core, full	read:notes	Read-only note-health report from the note_quality rollup: which notes are duplicated, orphaned, stale by edit or by access, contradicted, or tombstoned — with the raw components behind each verdict. quality_score is NULL when there is no usage evidence yet, which means UNMEASURED, not bad. Populated by the offline obsidian-tc note-quality pass; computed_at tells you how fresh it is. Never used for ranking. response_format=concise returns {path, quality_score, flags} per note (plus activation_conflict when true), without the raw components.
ocr_attachment	read	full only	read:ocr	Run OCR on a single image or PDF attachment via the Text Extractor bridge. Returns extracted text (cached by the plugin per file+model). Domain: attachments.
ocr_bulk	read	full only	read:ocr	OCR a batch of attachments via the Text Extractor bridge. Resolves and ACL-filters the candidate set server-side; requires confirmation past 20 files.
open_workspace	write	full only	write:workspaces	Mark a saved workspace active and return its stored layout. Fails if the workspace does not exist.
patch_active_file	write	full only	write:notes	Patch a section of the note currently open in the live Obsidian session (patch_note, aimed at the active note): append, prepend, replace or replace_text under a heading, block reference or the frontmatter preamble. Required fields per operation (anchor or target_heading on append, prepend and replace only): append, prepend, replace: content; replace_text: old_string + new_string. Refused: old_string/new_string on append, prepend, replace; content on replace_text. insert_before is append-only: it inserts content above a unique matching line within the resolved section, useful for keeping signatures, Parent links and footnote blocks at the end. With neither anchor nor target_heading, replace_text is note-wide (the whole note body, frontmatter excluded). Same anchors, prev_hash compare-and-swap, confirm_replace guard, snapshot and memoryDefense rules as patch_note; response_format=concise is patch_note's acknowledgement. Refuses a non-markdown active file.
patch_note	write	core, full	write:notes	Edit part of an existing note in place. Name an anchor: a heading section (anchor:{type:"heading",heading:"Notes"}), a block reference (anchor:{type:"block",block_id}), or the preamble above the first heading (anchor:{type:"frontmatter"}); then an operation: append/prepend/replace content, or replace_text (old_string/new_string). Required fields per operation (anchor or target_heading on append, prepend and replace only): append, prepend, replace: content; replace_text: old_string + new_string. Refused: old_string/new_string on append, prepend, replace; content on replace_text. Frontmatter is preserved. Examples: add a line to the end of a section = operation append + heading anchor + content. insert_before is append-only: it inserts content above a unique matching line within the resolved section, useful for keeping signatures, Parent links and footnote blocks at the end. Move, reorder or duplicate sections = ONE replace_text anchored on an enclosing heading (the note's top-level H1 spans every section below it): old_string is those sections as they are now, new_string the same text rearranged; the anchor heading line itself is never touched. To add at the very end of a note use append_note, which needs no anchor. A heading that appears more than once needs anchor.occurrence (1-based, document order) or a path (heading:"Parent > Child"); without either the call is refused with every matching line number, never silently bound to the first match (same for a block id on more than one line). On a heading anchor, replace preserves the anchor heading line itself; if content's first non-blank line repeats it (same level and text), that line is dropped so the two calling conventions do not double the heading. replace_text takes old_string/new_string instead of content and substitutes an exact match scoped to the resolved anchor's section; with neither anchor nor target_heading it is note-wide (the whole note body, frontmatter excluded, heading lines included), so a heading typo can be fixed in one call. 0 or 2+ matches is refused (with the count for 2+); confirm_replace is ignored for it. A replace on a heading anchor that would discard more than 20 lines AND over half of the note's body (e.g. the note's only H1, which no lower-or-equal heading bounds) is refused unless confirm_replace is set. Snapshots (restore_note's undo) are captured only when the server's snapshots.enabled config is on; the default "trusted-local" posture leaves it on, so such a write is rollback-able via restore_note unless snapshots have been explicitly disabled. response_format=concise acknowledges with {vault, path, content_hash} only (plus quality_warning, redactions, and lines_removed/bytes_removed when non-zero).
plur_get	read	core, full	read:plur	Fetch a specific plur engram by id (read-only proxy).
plur_recall	read	core, full	read:plur	BM25 keyword recall over the global plur engram store (read-only proxy).
plur_recall_hybrid	read	core, full	read:plur	Hybrid BM25 + embedding recall (RRF) over the global plur engram store. bm25_weight is forwarded to the plur backend and only shifts ranking when that backend implements weighted hybrid RRF; the bundled local CLI backend applies default RRF and ignores it (audit #15).
plur_similarity_search	read	core, full	read:plur	Cosine similarity search over plur engram embeddings (read-only proxy).
prune_hub_links	write	full only	write:notes	Prune unresolved and/or duplicate links from a hub note. Defaults to dry_run; a real run requires confirmation. response_format=concise drops removed[] and prev_hash on a real run; removed_count and content_hash stay, and a dry run keeps both.
query_base	read	full only	read:bases	Execute a base view and return resolved rows. Filters/formulas may use obsidian-tc's JSONLogic model OR the real Obsidian Bases expression DSL (a documented subset); constructs outside the subset — and trees mixing both models — are refused with unsupported_base_filter.
query_canvas	read	full only	read:canvas	Find nodes matching criteria across one or more .canvas files (defaults to all canvases under the vault root).
query_datacore	read	full only	read:datacore	Run a Datacore query using its own query language (e.g. @page and #tag, @task and $completed = false) and return matching pages/blocks with their path, name, tags, types, and frontmatter fields. Datacore is Dataview's successor; use search_dql for classic Dataview DQL.
query_entity_graph	read	core, full	read:memory	Traverse the memory graph from a seed entity (BFS, depth-limited, type/direction filtered). Retired entities are excluded from the seed and the result set unless include_retired is set — traversal still walks THROUGH a retired node to reach its neighbors, only the returned/visible set is filtered. An entity whose own note is not readable under the caller's folder read ACL (readPaths) is NOT retired-like: it is never returned and never walked through, so nothing reachable only via it appears, and an unreadable seed reads as 'seed entity not found'. Each returned node's observations are filtered by as_of (default now — see get_entity's own description for the exact rule), so a graph walk answers 'what did we believe as_of D' the same way a direct get_entity does. response_format=concise drops each node's hop-by-hop path (distance stays), shapes observations as get_entity does, and omits as_of and total_returned. Domain: knowledge.
read_base	read	full only	read:bases	Read a .base file's structure (source, views, formulas). Domain: structured.
read_canvas	read	full only	read:canvas	Parse a .canvas file into its nodes and edges (JSONCanvas spec). response_format=concise drops the layout (node geometry and background, edge sides and ends) and the counts.
read_excalidraw	read	full only	read:excalidraw	Read an Excalidraw drawing's raw elements and/or extracted text. source=plugin (default) proxies the live companion plugin; source=filesystem parses the .excalidraw / .excalidraw.md file on disk (works headlessly, no plugin); source=auto tries the plugin and falls back to the filesystem when it is unavailable.
read_frontmatter	read	core, full	read:notes	Read a note's parsed YAML frontmatter (null when the note has none). Domain: metadata. response_format=concise returns {vault, path, frontmatter, content_hash}, without has_frontmatter (it is frontmatter !== null).
read_kanban_board	read	full only	read:notes	Parse a Kanban board note into its columns and cards (text + checked state). Domain: structured.
read_metadata_fields	read	full only	read:metadata-menu	Read a note's typed metadata fields via the Metadata Menu plugin: returns each configured field's name, value, type, validity, and source (frontmatter vs inline). Read-only field introspection.
read_note	read	core, full	read:notes	Read a note's raw content, parsed frontmatter, body, content hash, and stat. With anchor (same shape as patch_note's: a heading section, a block reference, or the frontmatter preamble), also returns section: the resolved span's text (including its heading/block-id marker line), 1-based start_line/end_line relative to the raw file, and heading_level for a heading anchor. content_hash stays the whole-note hash so it round-trips into patch_note's prev_hash unchanged. A note whose frontmatter is not valid YAML is still returned (frontmatter null) with raw_frontmatter, frontmatter_error {message, line, column} and a warning naming the repair (update_frontmatter replace with frontmatter_yaml). response_format=concise returns {vault, path, body, content_hash}: the note body without its frontmatter block (and, with an anchor, the section instead of the whole body).
read_notes	read	core, full	read:notes	Batch-read notes. Returns successful notes and a per-path error list (partial). The response is held under the server's byte budget: when the batch does not fit, the notes that fit are returned with next_cursor; call again with the same arguments plus cursor to continue exactly where the page stopped (request order, no duplicates, no gaps) until next_cursor is null. A single note too large to ever fit is reported as a too_large error (with its size and the budget) and skipped, so the walk always makes progress. A cursor is bound to the caller, the tool and these exact arguments, and expires. response_format=concise returns each note as {path, body, content_hash} (no raw content, no frontmatter); per-path errors are unchanged.
read_property	read	core, full	read:notes	Read a single frontmatter property. Set nested=true to address a dotted path (e.g. meta.author.name) through nested objects. response_format=concise omits the key and nested echoes.
read_resources	read	core, full	read:notes	Batch resources/read: read many obsidian-tc:/// note resource URIs in one call. Returns one result per URI in request order: {ok: true, uri, mimeType, text} (identical to a single resources/read) or {ok: false, uri, error} for a malformed or unsupported URI, a vault the caller may not read (a vault-bound caller may read only its own), a denied or missing note. The response is held under the server's byte budget: when the batch does not fit, the results that fit are returned with next_cursor; call again with the same arguments plus cursor to continue exactly where the page stopped (request order, no duplicates, no gaps) until next_cursor is null. A single resource too large to ever fit is reported as a too_large error (with its size and the budget) and skipped, so the walk always makes progress. A cursor is bound to the caller, the tool and these exact arguments, and expires. response_format=concise returns each item as {ok: true, uri, text} with the note body only (no frontmatter block, no mimeType); error items are unchanged.
read_snapshot	read	core, full	read:notes	Read the full stored content of a single snapshot by id.
record_retrieval_feedback	write	core, full	write:workspace	Report which retrieved chunks actually helped. CALL THIS after you act on a search result: feedback (-1|0|+1) = was this the right chunk to return for that query. Stamp the chunks you genuinely used, not every hit, and stamp -1 when a confidently-returned chunk was wrong — a negative is worth more than silence. This is the only signal separating a chunk that gets RETRIEVED from one that gets USED: it feeds the ACT-R activation recompute, so stamping is what makes later retrieval better, and not stamping leaves ranking blind. Judge the RETRIEVAL, not your task: whether the task went well is a different question this tool deliberately no longer accepts. Several chunks at once: send verdicts: [{chunk_id, feedback}, ...] (1-50 items), applied in one transaction. Otherwise send chunk_id + feedback for one chunk. Send one form or the other, never both. Each target is your most recent retrieval event(s) for that chunk (last_n, default 1, applies to every item). Returns updated; when that is 0 it also returns reason — session_scope (you own retrievals for this chunk, none in the current scope) or no_owned_retrievals (nothing of yours matches), so a no-op is never silent. A batch returns results, one {chunk_id, updated, reason?} per verdict. You may only stamp retrievals your own caller produced; an unidentified caller cannot stamp, and admin:workspace crosses both that and the session scope.
reflect	read	core, full	read:notes	The reflect verb (retain/recall/reflect): recall over the vault, then a gateway synthesis pass — one on-demand, query-scoped operation returning a grounded answer with source provenance. mode 'challenge' runs the adversarial red-team over the decision-bearing recall instead (the knowledge_challenge core) and returns a coverage object (recalled, decision_matched, filtered_out, kept, dropped, unresolved_evidence_paths). persist: true writes the answer as a derived note under the memory folder's reflections/ with source_model + chunk provenance (requires write:notes); it applies to mode 'synthesis' only and is rejected with mode 'challenge'. Degrades gracefully: without the inference gateway, recall still returns sources with available: false. The sleep-time half (episode-eligibility evaluator + preference profile) runs via the obsidian-tc reflect CLI command.
refresh_plugin_capabilities	write	full only	admin:vault	Re-probe the companion plugin for a vault and atomically replace the cached capability snapshot, so installing/enabling a plugin or upgrading the companion takes effect WITHOUT a server restart. Returns what changed (companion state, plugin/version deltas), not a bare ok. Admin-scoped, no HITL.
reload_vault	write	core, full	admin:vault	Re-read a vault's configuration from disk (does not touch the cache).
remotely_save_status	read	full only	read:remotely-save	Last sync state of the Remotely Save plugin (sync status + last successful sync time) — an independent backup-verification signal, via the companion bridge.
remotely_save_trigger	write	full only	write:remotely-save	Kick off a Remotely Save sync run (fire-and-poll: check remotely_save_status afterwards), via the companion bridge.
remove_bookmark	destructive	full only	delete:bookmarks	Remove every bookmark matching the criteria (recursively, or within a named group). Returns the number removed.
remove_tag	write	core, full	write:notes	Remove a tag from a note's frontmatter, its body, or both (exact, not hierarchical).
rename_entity	write	core, full	write:memory	Rename a memory entity and/or change its lifecycle status (active/retired). At least one of new_name/status is required. This is the reachable path for retiring an entity — get_entity and query_entity_graph filter status:retired out by default. Renaming moves the materialized note (preserving any frontmatter Obsidian or a person added directly to the file) and re-materializes every OTHER materialized entity that has a relation TO this one, so their links keep resolving under the new name. Does not rewrite free-text mentions of the old name elsewhere in the vault — only entities with a direct graph edge to this one are touched.
reset_vault_cache	destructive	core, full	admin:vault	Drop the SQLite cache for a vault (chunks, embeddings, idempotency keys; optionally the event log and committed capture_queue rows). include.embeddings accepts true (drop every embedding row), false, or "inactive" (drop only superseded embedding generations, keeping the vault's active vectors and search working — pass include.chunks: false too, or the default include.chunks: true cascades and drops the active rows as well). Destructive — requires confirmation.
resolve_daily_note	read	full only	read:daily-notes	Resolve the daily note for a date (default today) via the core Daily Notes plugin's configured folder + format. Returns whether it exists and its path — no path guessing. Read-only; does not create.
restore_note	write	core, full	write:notes	Restore a note to a prior snapshot's content. Destructive — overwrites the current note (whose current state is itself snapshotted first when snapshots are enabled, so the restore is reversible) and requires confirmation.
rewrite_link	write	core, full	write:notes	Repoint every link to from_target at to_target across the vault. Defaults to dry_run; a real run requires confirmation. response_format=concise drops the from_target/to_target echo (to_target stays when the memoryDefense scan redacted it) and, on a real run, the per-note changes list; notes_changed and links_rewritten stay.
save_workspace	write	full only	write:workspaces	Save a workspace layout under a name (optionally making it active). Overwriting an existing workspace requires confirmation.
search	read	core, full	read:notes	Search the vault for notes matching a natural-language query and return citable results: {results: [{id, title, url, text}]}, best first, one per note. Use this to find notes before answering from them; pass a result's id to fetch for the full note. url is an absolute link to the note (a published https url when the vault configures one, else an obsidian:// link). Hybrid text + semantic search; only notes the caller may read appear.
search_and_read	read	core, full	read:notes	Search a vault and return the top-k full notes in one call, instead of a search followed by read_notes. Ranking is vault_graph_search's, limited to notes you can read. mode=note (default) returns each note's frontmatter and body; mode=section returns the heading section each hit matched. Every item carries chunk_id, the chunk it was ranked by (pass it to record_retrieval_feedback). k is at most 20. The result is held under the server's byte budget, shared equally across the notes: a note over its share is cut and marked truncated: true with size_bytes (its full size); fetch it whole with read_note. Anything that still does not fit comes back with next_cursor: repeat the same call plus cursor until it is null. An item that cannot be returned is a per-item error with its rank (a missing note and an unreadable one look the same). A cursor is bound to the caller, the tool and these exact arguments, and expires. response_format=concise returns {path, rank, score, body, content_hash, chunk_id} per note, without frontmatter in note mode; size_bytes and truncated appear only on a truncated item, and section_resolved only when false.
search_dql	read	core, full	read:notes, read:dataview	Run a Dataview DQL query via the companion plugin bridge. Returns headers/rows and the matched note paths. Requires the Dataview bridge; reports plugin_missing when it is not configured.
search_jsonlogic	read	core, full	read:notes	Filter notes with a JSONLogic expression over frontmatter + { path, content }. Returns matching note paths.
search_omnisearch	read	full only	read:omnisearch	Ranked full-text search over the vault via the Omnisearch plugin. Returns scored matches with per-note excerpts and matched words. Complements the built-in search domain with Omnisearch's own ranking.
search_regex	read	core, full	read:notes	Regular-expression search across vault notes. Each match returns line/col + the matched text; capped per file. Pattern length is bounded, patterns with nested quantifiers are rejected, and execution is time-budgeted (governor.regexTimeoutMs) to prevent catastrophic backtracking; flags may only be i, m, s, u.
search_semantic	read	core, full	read:notes	Dense-vector retrieval over the chunk store (run index_vault first). Returns the top-k chunks by cosine similarity. response_format=concise (legacy alias verbosity=terse) drops chunk content/metadata, returning path/score/chunk_id only.
search_text	read	core, full	read:notes	Literal text search across vault notes (BM25-ranked). Supports case_sensitive and whole_word; scoped to an optional root folder. response_format=concise (legacy alias verbosity=terse) drops line/col, keeping path/score/snippet.
search_vault	read	core, full	read:notes	Unified search dispatch. mode=auto routes a string query text->semantic (fallback on zero hits) and an object query to jsonlogic; or force text/regex/semantic/jsonlogic/dql. Set response_format=concise (legacy alias verbosity=terse) to compact each hit to path/score/snippet, keeping chunk_id on hits that carry one.
server_health	read	core, full	—	Liveness + build info. Round-trips the full transport -> auth -> acl -> audit path. Domain: admin.
session_bootstrap	read	core, full	read:notes	Triage an opening session message (auto -> lightweight | standard | deep) and preload the matching vault context notes, so any MCP client gets session bootstrap, not only skill-enabled ones. Deep loads the configured deepPaths; standard loads the paths of every domain whose signals appear in the message; lightweight loads nothing. The routing table comes from server config (bootstrap.*); with none configured the tool degrades to lightweight. Read-only. response_format=concise drops each loaded note's parsed frontmatter (it is still inside content).
session_rerun	destructive	core, full	admin:rerun	Re-issue a recorded session's captured tool calls against a DISPOSABLE SANDBOX COPY of its vault (never the live one) and report divergence per call. Sandbox-only: there is no parameter that selects the live-vault observe mode obsidian-tc's rerun CLI command offers — that path stays operator-only. Replayed calls run with the caller's own granted scopes intersected against the fixed replay ceiling (read/write/delete/bulk/execute, never admin), so a caller who cannot themselves mutate cannot get a mutating call replayed as successful. Requires admin:rerun plus a human confirmation (destructive). Domain: admin.
set_goal	write	core, full	write:workspace	Record a STATED goal for a vault — what the user is trying to accomplish, as distinct from a learned preference (a preference is 'you tend to X' and never resolves; a goal is 'you intend to X' and ends in completed/abandoned/expired). Goals are stated by the user and never inferred: nothing in the reflect/extract path can write one. An optional target_date lets the expiry sweep mark it 'expired' rather than leaving stale intent to bias later reads.
show_file_in_obsidian	write	full only	execute:uri	Open a vault note in the running Obsidian app. Tries the companion plugin first (a live Obsidian session for the vault); falls back to the OS obsidian:// URI handler only when uri.allowOsLaunch is enabled and the call arrives over stdio. When neither is available it returns available:false with a reason and a hint instead of a silent success. Always requires human confirmation (execute:uri is a HITL floor): it causes a host-side effect. The path must pass the read ACL and name an existing note. generate_uri remains the pure URI builder.
snapshot_note	read	core, full	read:notes	Capture the current content of a note as a restorable point-in-time snapshot (retained per config.snapshots.retention). Returns the snapshot id and content hash.
sort_table_by_column	write	full only	write:notes	Sort a GFM table's data rows by a column (index or header name), ascending or descending, optionally numeric.
start_session	write	core, full	write:workspace	Begin a workspace memory session: a SQLite row plus an append-only JSONL trace file.
suggest_links	read	full only	read:notes	Suggest notes to link a given note to, from the link graph (co-citation with the note's inbound sources + 2-hop outbound neighbors), excluding notes it already links to. Graph-based (no embeddings). response_format=concise returns {path, score} per suggestion without the score components, the path echo and total.
suggest_tags	read	full only	read:notes	Suggest tags for a note, preferring the vault's existing tag vocabulary. Asks the calling client's own model over MCP sampling when the client supports it (source: client-sampled; the note text is sent to that client only); otherwise falls back to a deterministic match against existing tags (source: heuristic). Read-only: apply a suggestion with add_tag. response_format=concise returns only source and the suggestions. Domain: metadata.
tasks_filter	read	full only	read:tasks	Forward a Tasks-plugin filter expression (its DSL) through the companion bridge. The Tasks plugin exposes no programmatic filter API, so the companion reports it as unreachable and the other inputs are ignored; use list_tasks for native status/priority/tag/due filtering.
trigger_quickadd	write	full only	execute:quickadd	Fire a QuickAdd action by name. Always requires human confirmation (execute:quickadd is a HITL floor): actions can create or modify notes broadly and run macros.
unlink_entities	write	core, full	write:memory	Remove a typed relation between two memory entities — the inverse of link_entities. Removes only the named (source, target, relation_type) edge and leaves every other relation intact; re-materializes the source's links. A no-op (removed: false) when the relation didn't exist.
update_active_file	write	full only	write:notes	Replace the whole content of the note currently open in the live Obsidian session (write_note in overwrite mode, aimed at the active note). Overwriting a non-empty note requires human confirmation bound to the resolved note: a confirmation raised while one note was active cannot be redeemed once another is. Same prev_hash compare-and-swap, snapshot, memoryDefense and provenance rules as write_note; get_active_file returns the content_hash to pass as prev_hash. Refuses a non-markdown active file.
update_base	write	full only	write:bases	Patch a .base file's source/filters/properties/views/formulas. Unknown keys are preserved. Changing source (deprecated alias) or the note-set-defining top-level filters requires confirmation.
update_canvas	write	full only	write:canvas	Patch a .canvas: add/remove/update nodes and edges by id. Unknown fields are preserved. Removing more than 10 nodes requires confirmation.
update_excalidraw	write	full only	write:excalidraw	Add, remove, or update elements in an existing Excalidraw note via the companion plugin.
update_frontmatter	write	core, full	write:notes	Mutate a note's frontmatter (set/remove/merge/replace). replace discards all existing metadata and requires confirmation, except on a note whose frontmatter is not valid YAML (nothing parsed to discard): that is the repair route, and it needs no approval. replace takes properties (an object) or frontmatter_yaml (raw YAML for the whole block, no --- lines; validated before anything is written and refused with the parse error if invalid). set/remove/merge on a note whose frontmatter is not valid YAML are refused. Optional prev_hash gives compare-and-swap. Set nested=true to address a dotted key path for set/remove (intermediate objects are created as needed). response_format=concise acknowledges with {vault, path, content_hash} only (no frontmatter echo).
update_observation	write	core, full	write:memory	Correct or retire ONE existing memory observation, addressed by its observation_id (returned by create_entity, add_observation and get_entity; no key needed). Pass observation (the corrected single-line fact) to replace it, or retire: true to remove it without a replacement — exactly one of the two. Nothing is hard-deleted: the old text is closed (valid_to set; for a correction, superseded_by names the replacement), hidden from default reads, still visible with get_entity's as_of set before the edit and under the note's Superseded section. A correction keeps the old observation's key, so a later add_observation with that key still supersedes it. Use this instead of add_observation whenever a fact is WRONG or no longer true; only an open observation can be edited. Requires write access to the entity's note path. Domain: knowledge.
update_task	write	full only	write:tasks	Modify a task in place by line number (status, dates, priority, tags). Reopening a task completed more than 7 days ago requires confirmation.
validate_dql	read	full only	read:dataview	Check a Dataview DQL query by running it through Dataview and reporting only whether it succeeded. Returns valid; an invalid query also returns error.message. No rows are returned.
vault_context	read	core, full	read:notes	Composite budgeted context in ONE call (the Honcho-style context() primitive): graph-reranked chunks packed to a token budget and grouped by note, recent synthesis patterns touching the query, open contradictions on the packed notes, and applicable past lessons (decision/lesson/postmortem chunks relevant to the query) — with source metadata and packing stats. include_work adds eligible work-memory episodes (the work-memory reader contract; explicit opt-in, never default). Omit query for session bootstrap: the queued thread is read from the memory folder's _next-session.md signal note, so every session opens with its applicable lessons (push, not pull). response_format=concise drops the route, budget and stats blocks, each chunk's source and hop and each lesson's via.
vault_graph_search	read	core, full	read:notes	Cross-domain / multi-hop semantic search with wikilink graph expansion (GraphRAG). Seeds by vector similarity, expands through the links_to graph (vault_edges), and fuses by RRF. Run index_vault first so the edge graph is populated. Returns chunks tagged seed|expansion with hop + via_edge. Optional vaults[] federates the same query across additional vaults (max 8), fusing per-vault ranked lists by RRF; each result is tagged with its source vault. response_format=concise returns {chunk_id, path, content, rerank_score} per result (plus vault and changed_since_d when set) without source, hop, via_edge and root_seed, and drops route, query, hyde, variants_used, coverage, vaults_used and per_vault; mode_used, failed_variants and failed_vaults are kept.
vault_health_score	read	core, full	read:notes	Composite vault link-health score (0-100) with a breakdown: orphan count, unresolved-link count, hub density, and cycle count over the readable note graph. response_format=concise drops total_links and the per-penalty breakdown. Domain: links.
work_episode_chain	read	core, full	read:workspace	Walk an episode's amendment chain in one call. prev_id links each episode to the caller's previous one, and following it hop by hop cost one round trip per link. Returns the chain newest-first starting at id. The work-memory reader contract applies at every hop, not just the first: tombstoned rows never surface, expired rows are excluded, and the walk stays inside the calling principal unless any_caller (admin:workspace, P1.7). The walk STOPS at the first hop that fails those filters rather than skipping over it — a gap in a returned chain would itself disclose that a hidden episode exists. response_format=concise returns each episode as work_episodes does; truncated is always kept.
work_episodes	read	core, full	read:workspace	List/inspect the raw experiential episode log (management surface, the first-party list/inspect verb). Shows pending and ineligible state for review; tombstoned rows stay hidden unless include_blocked. Partitioned to the calling principal unless any_caller, which requires the admin:workspace scope (P1.7). Set unstamped_debt to see judgeable work that still carries no verdict — yours, or every principal's when combined with any_caller — pair it with until to mean 'older than' — then clear it with work_result. Protocol traffic and the verdict verbs themselves never appear there; they are not work anyone can judge. response_format=concise returns each episode without vault, caller, channel, episode_type, duration_ms, result_size and null or empty fields; trust, eligibility, session_id and a true blocked flag are kept.
work_forget	write	core, full	write:workspace	Tombstone an experiential episode — the first-party forget verb for the work-memory tier. A forgotten episode never surfaces in work_search again; each successful forget appends a hash-chained forget_log row for forensics. Idempotent: a repeat call, foreign, or unknown episode id is a silent no-op (forgotten:false) that appends NO additional log row. P1.7: only your OWN episodes unless you hold admin:workspace — a foreign or unknown id is a silent no-op, not an error.
work_result	write	core, full	write:workspace	Record how the task you just finished went, as -1 (it failed or produced a bad result), 0 (neutral) or +1 (it worked). The verdict applies to every judgeable tool call in your current session that has no verdict yet, and then a fresh window opens — so calling this once at the end of a session covers the session, and calling it after each task partitions the session into those tasks. Protocol traffic and this verb itself are never judged. Nothing else writes agent_episodes.task_result, and two retrieval behaviours read it: a -1 holds those episodes out of promotion, and the preference extractor only ever learns from episodes carrying a verdict.
work_search	read	core, full	read:workspace	Search the experiential work-memory (agent_episodes) — what the agent actually did. MEMORY semantics with the work-memory reader contract enforced: only evaluator-approved (eligible) episodes by default, tombstoned/expired rows never surface, results are partitioned to the calling principal, and a trust floor (default 0.3) excludes high-risk content. include_pending opts into not-yet-evaluated episodes (still trust-floored); any_caller crosses the agent partition and requires the admin:workspace scope (P1.7: the partition is an authorization boundary, not a free filter). semantic (opt-in) fuses a cosine-similarity channel over summary alongside the lexical match via Reciprocal Rank Fusion, so a paraphrased query can find an episode the lexical LIKE match misses — lexical stays the exact-match failsafe for names/dates/ids, and the SAME reader-contract filters above apply to both channels identically (the fused pool is never wider than what lexical alone could already see). Degrades silently to lexical-only when no query, no embedding provider is configured, or the provider errors. response_format=concise returns each episode without vault, caller, channel, episode_type, duration_ms, result_size and null or empty fields; trust, eligibility and a true blocked flag are kept.
write_attachment	write	full only	write:attachments	Write a binary attachment (image, PDF, audio, video) into the vault from base64 content. A bare filename goes to the vault's attachment folder; a path with a folder is used as given. Refuses existing files unless overwrite is set, which requires confirmation and soft-deletes the prior bytes to .trash. Capped by writes.maxAttachmentBytes (default 25 MB decoded).
write_note	write	core, full	write:notes	Create, overwrite, or upsert a note. Optional prev_hash gives compare-and-swap; overwriting a non-empty note requires confirmation. Set provenance: "agent_synthesis" when the content is a derived/inferred conclusion an agent produced (not directly stated in any single source) rather than authored/copied text — this routes the content through a poison scan before the write lands (rejected outright on high risk) and surfaces the assessment in the result; also add source: agent-synthesis to the note's own frontmatter by convention. response_format=concise acknowledges with {vault, path, content_hash} only (plus quality_warning, poison_assessment or redactions when they carry something).