From IonBin New tools and workflows every week. See what’s new
Give agents read-only access to your notes
Dev, web & IT · Research & market intelligence · checked 2026-10-17
Built by IonBin’s founder: a read-only MCP server over a Markdown notes folder, so any MCP-capable agent can search notes but never change them. Railway or a local machine can host it.
Independent review. IonBin has no partnership with any tool on this page and was not paid for this page. Our evaluation is our own, based on public documentation and our research. Product names are trademarks of their owners and are used for identification only. How disclosure works.
Goal
Let every agent use your knowledge without risking it.
Review the code to confirm there are no write tools, and control who can connect
Human step
Confirmed
Confirmed means the vendor documents it (linked). It doesn't mean IonBin has tested it. AI-platform and human steps need no source.
Human approval
You review the code and control access.
Watch out for
Keep the human approval step: You review the code and control access.
Starter prompt
Goal: Let every agent use your knowledge without risking it. Tools involved: Claude, Railway. Your part: writes a small mcp server that exposes only search and read tools over the folder; hosts the server if remote access is needed; railway’s mcp server can create the service and deploy it. Work step by step, show me each draft or proposed change, and wait for my approval before anything is sent, published, signed, filed or changed in a live system.
Assembled from this page’s goal and steps. Paste it into your AI platform and adjust it to your situation.
Every MCP and API step is documented for this platform.
ChatGPT
Confirmed
Every MCP and API step is documented for this platform.
Gemini
To verify
Railway: pairing not named in vendor docs
Perplexity
To verify
Railway: pairing not named in vendor docs
Computed from the MCP and API steps only: "Confirmed" needs the tool's docs to name the platform and the platform to support the connection. Browser, upload and human steps work from any platform.
What we checked (2026-10-17)
Obsidian stores notes locally as plain-text Markdown files, so any program can read the folder without Obsidian running.
MCP servers expose tools, resources and prompts. A server with only search and read tools gives connected agents no way to change your notes.
Railway MCP (mcp.railway.com) can create projects, deploy, manage environments and redeploy. It connects through the Railway CLI or OAuth, and it marks destructive actions so clients ask for confirmation. Railway’s Hobby plan is $5 a month in usage.
Authentication. A remote server needs it. Put the server behind a token or OAuth, and don’t expose it publicly without one. Locally, a stdio server needs no network access at all.
Set it up
Point the server at a copy or read-only mount of the vault, not your working folder, so a bug can’t touch the originals.
Ask Claude for two tools, search_notes and read_note, and no write, rename or delete tools.
Read the code and run it locally first.
Deploy remotely only if agents outside your machine need it, and rotate the access token if you ever share it.
Sources
Obsidian · Obsidian · official · accessed 2026-10-17
