Obsidian MCP uses path checks, permission scopes, hashed-token authentication, and configurable destructive tools to constrain agent access to a vault.
