Deploy and Host Vault Cortex on Railway

Vault Cortex is a standalone MCP server that gives any AI agent hybrid search, task management, structured memory, and read/write access to your Obsidian vault. No plugins, no running Obsidian, no separate bridge. One container, your vault, a full tool suite + guided prompts — secured with OAuth 2.1 and reachable from your phone, claude.ai, Claude Desktop, Claude Code, Cursor, or any remote MCP client.

Hybrid search — FTS5 keyword matching + vector semantic similarity via RRF fusion, refined by cross-encoder reranking. Keywords stay precise on exact terms and jargon; vectors find notes even when your words differ from the vault's.
Structured memory — dated, append-only entries accumulate into a personal knowledge layer. Topic recall answers "what do I think about X?" with the current take and the dated history behind it.
Tasks — Kanban-aware task queries and updates: triage by status, dates, or priority, then complete, reprioritize, or move tasks between lanes in one call. Parses both Tasks-plugin emoji and Dataview inline-field formats.
Link graph — backlinks, outgoing links, and orphan detection across the vault.
Files, not just notes — images arrive as actual images, PDFs as structured text or rendered pages, canvases as readable outlines, data files as text. Their contents are indexed and searchable alongside your notes.
Obsidian-native — understands frontmatter, wikilinks, tags, headings, and daily notes. Anything that mirrors an Obsidian concept behaves the way Obsidian does.
Guided workflows — built-in prompts for vault health, memory review, and daily reconciliation, assembled from live vault data each time.

About Hosting Vault Cortex

One container, one volume. The template runs the vault-cortex:remote image, which bundles Obsidian Sync and the MCP server. One persistent volume holds your vault, the search index, and Sync's device state.

You supply three values:

Your Obsidian Sync token
Your vault name
Your timezone

Railway generates the MCP auth token and the public HTTPS domain; the template sets everything else.

First start, in order:

Logs in to Obsidian Sync and registers a device
Downloads your vault
Builds the search index
Goes live

Sync runs both ways. Edits made in Obsidian reach the server within seconds; tool writes show up on every device you sync.

Built to protect your notes. Vault Cortex writes to personal notes, so the file-safety layer is built to prevent corruption, not just errors: every write is atomic, concurrent edits are serialized per file, and Obsidian's .obsidian/ folder is off-limits to every tool. Mechanism details: README → Data Integrity.

Common Use Cases

Your vault from anywhere — ask Claude on your phone about a past trip, a decision, or a project, and it searches the vault on the server, not the device. Writes in one session are available in the next.
Persistent AI memory — preferences, principles, and opinions stored as dated entries in an About Me/ folder that any MCP client can read and append to, with the evolution of each view intact.
Task triage — "what's overdue?", "what's open per project?", "what did I finish this week?" answered across every Kanban board in the vault in one call, then updated in place.
Reason over everything you've saved — session logs, PDFs, canvases, and daily notes searched together, so the answer draws on the whole record rather than the notes you remembered to tag.

Dependencies for Vault Cortex Hosting

An Obsidian Sync subscription, plus your Sync login token — npx vault-cortex@latest get-sync-token prints it in one step on your own computer (walkthrough).
A Railway plan with a 5 GB volume (Hobby or higher). The trial plan's 0.5 GB volume is too small for a vault and its search index.

Implementation Details

Deploy-form inputs:

OBSIDIAN_AUTH_TOKEN — from the get-sync-token step above
VAULT_NAME — exactly as it appears in Obsidian Sync
TZ — an IANA name such as America/Toronto; it decides what "today" means for daily notes, due-date filters, and memory timestamps
VAULT_PASSWORD — only if your vault uses end-to-end encryption

Pre-configured, editable in the Variables tab:

MEMORY_ENABLED — the About Me/ memory layer and its tools
EMBEDDING_ENABLED — semantic search; set false for keyword-only and a much smaller memory footprint
READONLY_MODE — hide every tool that changes the vault
FILE_TOOLS_ENABLED — reading non-markdown files
SYNC_MODE — bidirectional, pull-only, or push-only

Connect your MCP client — the same three steps in every app:

In Claude Desktop, claude.ai, Perplexity, or any app with an Add custom connector (remote MCP server) option, paste https://your-domain.up.railway.app/mcp. Leave Client ID and Secret empty.
A consent page opens in your browser. Approve it with the MCP_AUTH_TOKEN Railway generated.
Done — the client renews its own access from then on. Under the hood that is full OAuth 2.1, with PKCE, dynamic client registration, and refresh-token rotation on a 60-day sliding expiry.

Other clients:

Claude Code — one command instead of a settings screen: claude mcp add --scope user --transport http vault-cortex followed by your /mcp URL. The same consent page opens.
Scripts and MCP Inspector — send MCP_AUTH_TOKEN as an Authorization: Bearer header.

Security

Out of the box:

Traffic to the container is encrypted (https://), and Railway keeps that working — nothing to set up or renew.
Nothing works without your token. Any request without it is turned away, and repeated login attempts from one address are rate-limited.
Your vault is encrypted at rest on Railway's volume. Logs record which notes were touched and what was searched, never tokens, passwords, or note text.
The container runs as an unprivileged user with no package managers inside, and every release is signed so you can verify what you're running.

What the server can't protect is the Railway account that holds it. Four dashboard steps close that gap:

Seal the secrets. Values are masked in the dashboard, but anyone with access can reveal them; sealing makes that impossible. Open the three-dot menu beside MCP_AUTH_TOKEN, OBSIDIAN_AUTH_TOKEN, and VAULT_PASSWORD and choose Seal — these are the credentials that grant access to your vault. Copy MCP_AUTH_TOKEN for your MCP client first; a sealed value can't be viewed again.
Two-factor authentication on your Railway account, and keep the project to yourself — workspace members can reveal unsealed variables and read every log line, search queries included.
Schedule volume backups on the volume's Backups tab.
Set READONLY_MODE=true if you only want search and recall; it removes every tool that writes to the vault.

Learn more

Railway deploy guide — Sync-token walkthrough, first start, security, updating, troubleshooting
GitHub repository — source, README, architecture
SECURITY.md — how the server is hardened, and how to report a vulnerability

Why Deploy Vault Cortex on Railway?

Railway is a singular platform to deploy your infrastructure stack. Railway will host your infrastructure so you don't have to deal with configuration, while allowing you to vertically and horizontally scale it.

By deploying Vault Cortex on Railway, you are one step closer to supporting a complete full-stack application with minimal burden. Host your servers, databases, AI agents, and more on Railway.