Regan-Milne/obsideo-mcp

Give any MCP-capable agent (Claude Desktop, Claude Code, Cursor, Cline, ...)
durable storage that is encrypted on your machine before it is uploaded and
that you can independently prove is still held. Zero setup: the first
put/get/ls auto-creates a free no-email trial account (100 MB, proof-of-work
instead of identity), so storage just works with nothing to configure. Want more?
Self-serve signup from inside the conversation upgrades to 12 GB free, no card,
no CAPTCHA, no expiry.
Obsideo is S3-compatible object storage where every
stored object is replicated to 3 providers and challenged with chunk-level
merkle proofs on a continuous cycle; providers are paid only for proofs
they pass. 12 GB free with an email, no card. Paid plans are 200 GB blocks at
$5/month each by card (Stripe), started from the upgrade tool and paid on
Stripe's own page; the plan never changes size without the human's agreement.
Privacy posture (read this first)
- **This server runs on YOUR machine.** Obsideo never hosts it. Credentials,
the account signing key, and the encryption key live in ~/.obsideo/ and are
sent nowhere except the endpoints they authenticate against.
- **The account signing key is generated locally**; only the public half is
ever sent. Keep ~/.obsideo/signing.pem private. Re-running signup rotates
credentials and the keypair with no overlap, so do not re-run casually.
- **Encrypted by default.** put encrypts client-side (AES-256-GCM) with a
locally generated, user-held key before anything leaves the machine, so the
platform stores ciphertext it is architecturally incapable of reading. Pass
encrypt: false only when another tool must read the stored bytes directly
(S3 interop).
Back up your key
The encryption key is generated on your machine when the account is created and written to
~/.obsideo/mcp.json. **Obsideo does not have a copy and cannot recover it.**
If that file is lost, every encrypted object is permanently unreadable, no
matter how many providers still hold it and how many proofs it passes.
Replication protects against providers losing your bytes; it does not protect
against you losing your key. Call backup_keys with a destination right after
signup and keep the archive somewhere you would still have after losing this
machine. Encrypted
objects are readable only with this key: there is no sharing of encrypted objects
between people or machines today, so treat an account as one person's.
~/.obsideo/roots.json is written alongside it: the merkle root of each object
as committed at upload time. It holds no secrets, and it is what lets verify
prove providers hold *your* bytes without re-uploading them. Encryption uses a
fresh IV per upload, so ciphertext cannot be recomputed from a plaintext file
later; this record is what keeps the strong proof available for encrypted
objects. Losing it costs you strength of proof, not data. If it is damaged, the
server moves it aside unchanged and says so in the next result, rather than
overwriting it.
Install
**Claude Desktop, one click:** download
obsideo-mcp.mcpb
from the latest release,
then Settings -> Extensions and drag the file in. No Node or npm setup needed.
**Everything else, via npx:**
(Claude Desktop: claude_desktop_config.json. Claude Code:
claude mcp add obsideo -- npx -y obsideo-mcp. Cursor/Cline: their MCP
settings, same command.)
**Hermes Agent:** paste https://obsideo.io/agent-storage to your Hermes and say "set
this up". That page is a runbook the agent executes: install, first store, first
proof, then the free 12 GB tier with your email. The install it runs is one
command on any OS (Node 18 or newer is required for npx):
It writes the server into Hermes's own config, connects, lists the 13 tools and