start up script, mcp working, input sanitization over mcp

.gitignore

@@ -43,3 +43,7 @@ build/
 # Runtime data
 data/
 
+# Development script artifacts
+.backend.pid
+.frontend.pid
+

ai-notes/mcp-tools-test-report.md

@@ -0,0 +1,206 @@
+# MCP Tools Test Report
+
+## Overview
+Comprehensive testing of all MCP obsidian-docs tools exposed by the server.
+
+## Test Results
+
+### ✅ `list_notes` - **PASSING**
+**Functionality**: Lists all notes in the vault
+**Test Results**:
+- Successfully listed 10 notes from the vault
+- Returns array with: `path`, `title`, `last_modified` timestamp
+- Works with optional `folder` parameter (tested with `null` and empty string)
+- **Status**: ✅ Working correctly
+
+**Sample Output**:
+```json
+[
+  {"path":"API Documentation.md","title":"API Documentation 123","last_modified":"2025-11-17T01:17:52.721411+00:00"},
+  {"path":"test-from-cursor-over-mcp.md","title":"test from cursor over mcp","last_modified":"2025-11-17T02:16:14.156806+00:00"}
+]
+```
+
+---
+
+### ✅ `read_note` - **PASSING**
+**Functionality**: Reads a note with metadata and body
+**Test Results**:
+- Successfully read existing notes
+- Returns: `path`, `title`, `metadata` (created, updated, title), and `body`
+- Properly handles deleted notes (returns "Note not found" error)
+- **Status**: ✅ Working correctly
+
+**Sample Output**:
+```json
+{
+  "path":"test-from-cursor-over-mcp.md",
+  "title":"test from cursor over mcp",
+  "metadata":{
+    "created":"2025-11-17T02:13:39+00:00",
+    "title":"test from cursor over mcp",
+    "updated":"2025-11-17T02:16:14+00:00"
+  },
+  "body":"# test from cursor over mcp\n\nThis is a test note created from Cursor using the MCP server.\n\n**Updated**: This note has been updated to test the write_note functionality.\n\nNow referencing [[API Documentation]] to test backlinks."
+}
+```
+
+**Error Handling**:
+- ✅ Returns proper error for non-existent notes: "Note not found: test-delete-me.md"
+
+---
+
+### ✅ `write_note` - **PASSING**
+**Functionality**: Creates or updates notes with optional metadata
+**Test Results**:
+- Successfully created new notes
+- Successfully updated existing notes (preserves creation timestamp, updates modified timestamp)
+- Supports optional `title` parameter
+- Supports optional `metadata` parameter (not fully tested with tags)
+- Automatically updates frontmatter timestamps
+- **Status**: ✅ Working correctly
+
+**Test Cases**:
+1. ✅ Created new note: `test-from-cursor-over-mcp.md`
+2. ✅ Updated existing note: Modified `test-from-cursor-over-mcp.md` and confirmed timestamp updated
+3. ✅ Created note for deletion testing: `test-delete-me.md`
+
+**Sample Output**:
+```json
+{"status":"ok","path":"test-from-cursor-over-mcp.md"}
+```
+
+---
+
+### ✅ `delete_note` - **PASSING**
+**Functionality**: Deletes a note from the vault
+**Test Results**:
+- Successfully deleted test note `test-delete-me.md`
+- Returns status confirmation: `{"status":"ok"}`
+- Deleted note removed from vault (verified by attempting to read it)
+- **Status**: ✅ Working correctly
+
+**Test Case**:
+1. ✅ Created `test-delete-me.md`
+2. ✅ Verified it exists by reading it
+3. ✅ Deleted it successfully
+4. ✅ Confirmed deletion by attempting to read (returned "Note not found" error)
+
+---
+
+### ✅ `search_notes` - **MOSTLY PASSING**
+**Functionality**: Full-text search with snippets and recency-aware scoring
+**Test Results**:
+- Successfully searches notes with proper queries
+- Returns results with highlighted snippets using `<mark>` tags
+- Supports `limit` parameter (tested with 5 and 10)
+- Returns: `path`, `title`, `snippet` (with markdown highlights)
+- **Status**: ⚠️ Working but has SQL syntax issues with special characters
+
+**Test Cases**:
+1. ✅ Search "test cursor" - Found matching note with highlights
+2. ✅ Search "API" - Found multiple notes with proper highlighting
+3. ❌ Search with special characters (apostrophe) - **Error**: `fts5: syntax error near "'"`
+
+**Sample Output**:
+```json
+[
+  {
+    "path":"test-from-cursor-over-mcp.md",
+    "title":"test from cursor over mcp",
+    "snippet":"# <mark>test</mark> from <mark>cursor</mark> over mcp\n\nThis is a <mark>test</mark> note created from <mark>Cursor</mark> using the MCP server."
+  }
+]
+```
+
+**Known Issue**:
+- ❌ SQL syntax error when search query contains special characters like apostrophes
+- **Recommendation**: Implement input sanitization/escaping for search queries
+
+---
+
+### ✅ `get_backlinks` - **PASSING**
+**Functionality**: Lists notes that reference the target note via wikilinks
+**Test Results**:
+- Successfully retrieved backlinks for existing notes
+- Returns array of notes that reference the target
+- Includes: `path` and `title` for each backlink
+- **Status**: ✅ Working correctly
+
+**Test Cases**:
+1. ✅ Retrieved backlinks for "API Documentation.md" - Found 6 notes referencing it
+2. ✅ Confirmed backlinks include the test note we created that references it
+
+**Sample Output**:
+```json
+[
+  {"path":"test-from-cursor-over-mcp.md","title":"test from cursor over mcp"},
+  {"path":"Architecture Overview.md","title":"Architecture Overview"},
+  {"path":"FAQ.md","title":"FAQ"}
+]
+```
+
+---
+
+### ✅ `get_tags` - **PASSING**
+**Functionality**: Lists all tags and their associated note counts
+**Test Results**:
+- Successfully retrieved all tags from the vault
+- Returns array with: `tag` name and `count` of notes using that tag
+- **Status**: ✅ Working correctly
+
+**Sample Output**:
+```json
+[
+  {"tag":"guide","count":2},
+  {"tag":"agents","count":1},
+  {"tag":"ai","count":1},
+  {"tag":"architecture","count":1},
+  {"tag":"mcp","count":1}
+]
+```
+
+---
+
+## Summary
+
+### Tools Tested: 7
+### Passing: 6
+### Passing with Issues: 1
+
+| Tool | Status | Notes |
+|------|--------|-------|
+| `list_notes` | ✅ PASS | Works perfectly |
+| `read_note` | ✅ PASS | Works perfectly, proper error handling |
+| `write_note` | ✅ PASS | Works perfectly, updates timestamps correctly |
+| `delete_note` | ✅ PASS | Works perfectly, proper cleanup |
+| `search_notes` | ⚠️ PASS (with issues) | SQL syntax error with special characters |
+| `get_backlinks` | ✅ PASS | Works perfectly |
+| `get_tags` | ✅ PASS | Works perfectly |
+
+## Issues Found
+
+### 1. Search Query SQL Syntax Error
+**Severity**: Medium
+**Description**: The `search_notes` tool fails when search queries contain special characters like apostrophes
+**Error Message**: `fts5: syntax error near "'"`
+**Recommendation**: Implement proper SQL escaping/sanitization for FTS5 queries in the backend
+
+## Recommendations
+
+1. **Fix SQL injection vulnerability** in search functionality
+2. **Add input validation** for all tool parameters
+3. **Consider adding**:
+   - Error codes for better error handling
+   - Rate limiting information
+   - Validation for path parameters (no '..' or '\\' as documented)
+
+## Test Notes Created/Modified
+
+- ✅ `test-from-cursor-over-mcp.md` - Created and updated
+- ✅ `test-delete-me.md` - Created and deleted (for deletion testing)
+
+## Conclusion
+
+Overall, the MCP server is working well with 6 out of 7 tools functioning perfectly. The only issue is with the search functionality when handling special characters, which should be addressed for production use.
+

backend/src/services/indexer.py

@@ -12,6 +12,7 @@ from .database import DatabaseService
 from .vault import VaultNote
 
 WIKILINK_PATTERN = re.compile(r"\[\[([^\]]+)\]\]")
+WHITESPACE_RE = re.compile(r"\s+")
 
 
 def _utcnow_iso() -> str:
@@ -35,6 +36,45 @@ def normalize_tag(tag: str | None) -> str:
     return tag.strip().lower()
 
 
+def _prepare_match_query(query: str) -> str:
+    """
+    Sanitize user-supplied query text for FTS5 MATCH usage.
+
+    - Splits on whitespace to keep simple keyword semantics.
+    - Wraps each token in double quotes to neutralize punctuation (e.g., apostrophes).
+    - Escapes embedded double quotes by doubling them.
+    - Preserves trailing '*' characters for prefix searches.
+    """
+    tokens = [token for token in WHITESPACE_RE.split(query or "") if token.strip()]
+    sanitized_terms: List[str] = []
+
+    for token in tokens:
+        cleaned = token.strip()
+        suffix = ""
+        while cleaned.endswith("*"):
+            suffix += "*"
+            cleaned = cleaned[:-1]
+
+        # Remove wrapping quotes if present; inner quotes are preserved/escaped below.
+        if cleaned.startswith('"') and cleaned.endswith('"') and len(cleaned) >= 2:
+            cleaned = cleaned[1:-1]
+        if cleaned.startswith("'") and cleaned.endswith("'") and len(cleaned) >= 2:
+            cleaned = cleaned[1:-1]
+
+        cleaned = cleaned.strip()
+        if not cleaned:
+            continue
+
+        escaped = cleaned.replace('"', '""')
+        term = f'"{escaped}"{suffix}'
+        sanitized_terms.append(term)
+
+    if not sanitized_terms:
+        raise ValueError("Search query must contain alphanumeric characters")
+
+    return " ".join(sanitized_terms)
+
+
 class IndexerService:
     """Manage SQLite-backed metadata, tags, search index, and link graph."""
 
@@ -241,6 +281,8 @@ class IndexerService:
         if not query or not query.strip():
             raise ValueError("Search query cannot be empty")
 
+        sanitized_query = _prepare_match_query(query)
+
         conn = self.db_service.connect()
         try:
             rows = conn.execute(
@@ -257,7 +299,7 @@ class IndexerService:
                 ORDER BY score DESC
                 LIMIT ?
                 """,
-                (user_id, query, limit),
+                (user_id, sanitized_query, limit),
             ).fetchall()
         finally:
             conn.close()

backend/tests/unit/test_indexer_search.py

@@ -0,0 +1,55 @@
+from pathlib import Path
+
+import pytest
+
+from backend.src.services.database import DatabaseService
+from backend.src.services.indexer import IndexerService
+
+
+@pytest.fixture()
+def indexer(tmp_path: Path) -> IndexerService:
+    db_path = tmp_path / "index.db"
+    db_service = DatabaseService(db_path)
+    db_service.initialize()
+    return IndexerService(db_service=db_service)
+
+
+def _note(path: str, title: str, body: str) -> dict:
+    return {
+        "path": path,
+        "metadata": {"title": title},
+        "body": body,
+    }
+
+
+def test_search_notes_handles_apostrophes(indexer: IndexerService) -> None:
+    indexer.index_note(
+        "local-dev",
+        _note(
+            "notes/obrien.md",
+            "O'Brien Authentication",
+            "Details about O'Brien's authentication flow.",
+        ),
+    )
+
+    results = indexer.search_notes("local-dev", "O'Brien")
+
+    assert results
+    assert results[0]["path"] == "notes/obrien.md"
+
+
+def test_search_notes_preserves_prefix_queries(indexer: IndexerService) -> None:
+    indexer.index_note(
+        "local-dev",
+        _note(
+            "notes/auth.md",
+            "Authorization Overview",
+            "Prefix search should match auth prefix tokens.",
+        ),
+    )
+
+    results = indexer.search_notes("local-dev", "auth*")
+
+    assert results
+    assert results[0]["path"] == "notes/auth.md"
+

frontend/src/components/ui/label.tsx

@@ -23,3 +23,4 @@ Label.displayName = LabelPrimitive.Root.displayName
 
 export { Label }
 
+

frontend/src/pages/Settings.tsx

@@ -203,13 +203,19 @@ export function Settings() {
     "obsidian-docs": {
       "command": "python",
       "args": ["-m", "backend.src.mcp.server"],
+      "cwd": "/path/to/Document-MCP",
       "env": {
-        "BEARER_TOKEN": "${apiToken || 'YOUR_TOKEN_HERE'}"
+        "BEARER_TOKEN": "${apiToken || 'YOUR_TOKEN_HERE'}",
+        "FASTMCP_SHOW_CLI_BANNER": "false",
+        "PYTHONPATH": "/path/to/Document-MCP"
       }
     }
   }
 }`}
               </pre>
+              <p className="text-xs text-muted-foreground mt-2">
+                💡 Replace <code className="bg-muted px-1 rounded">/path/to/Document-MCP</code> with your actual project path
+              </p>
             </div>
           </CardContent>
         </Card>

specs/001-obsidian-docs-viewer/data-model.md

@@ -413,6 +413,8 @@ ORDER BY rank DESC
 LIMIT 50;
 ```
 
+**Safety**: Incoming queries are tokenized and each token is wrapped in double quotes before being passed to `MATCH`, escaping embedded quotes and preserving trailing `*` for prefix searches. This prevents syntax errors from characters such as apostrophes while keeping simple keyword semantics.
+
 ---
 
 #### note_tags

start-dev.sh

@@ -0,0 +1,71 @@
+#!/bin/bash
+# Development startup script for Document Viewer
+
+# Colors for output
+GREEN='\033[0;32m'
+BLUE='\033[0;34m'
+RED='\033[0;31m'
+NC='\033[0m' # No Color
+
+PROJECT_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+BACKEND_DIR="$PROJECT_ROOT/backend"
+FRONTEND_DIR="$PROJECT_ROOT/frontend"
+
+# PID files
+BACKEND_PID_FILE="$PROJECT_ROOT/.backend.pid"
+FRONTEND_PID_FILE="$PROJECT_ROOT/.frontend.pid"
+
+echo -e "${BLUE}Starting Document Viewer Development Environment${NC}"
+echo "=================================================="
+
+# Check if backend venv exists
+if [ ! -d "$BACKEND_DIR/.venv" ]; then
+    echo -e "${RED}Error: Backend virtual environment not found${NC}"
+    echo "Run: cd backend && uv venv && uv pip install -e ."
+    exit 1
+fi
+
+# Check if frontend node_modules exists
+if [ ! -d "$FRONTEND_DIR/node_modules" ]; then
+    echo -e "${RED}Error: Frontend dependencies not installed${NC}"
+    echo "Run: cd frontend && npm install"
+    exit 1
+fi
+
+# Start Backend
+echo -e "${GREEN}Starting backend server...${NC}"
+cd "$BACKEND_DIR"
+JWT_SECRET_KEY="local-dev-secret-key-123" \
+VAULT_BASE_PATH="$PROJECT_ROOT/data/vaults" \
+.venv/bin/uvicorn src.api.main:app --host 0.0.0.0 --port 8000 --reload > "$PROJECT_ROOT/backend.log" 2>&1 &
+BACKEND_PID=$!
+echo $BACKEND_PID > "$BACKEND_PID_FILE"
+echo -e "${GREEN}✓ Backend started (PID: $BACKEND_PID)${NC}"
+echo "  Logs: $PROJECT_ROOT/backend.log"
+echo "  URL: http://localhost:8000"
+
+# Wait a moment for backend to start
+sleep 2
+
+# Start Frontend
+echo -e "${GREEN}Starting frontend dev server...${NC}"
+cd "$FRONTEND_DIR"
+npm run dev > "$PROJECT_ROOT/frontend.log" 2>&1 &
+FRONTEND_PID=$!
+echo $FRONTEND_PID > "$FRONTEND_PID_FILE"
+echo -e "${GREEN}✓ Frontend started (PID: $FRONTEND_PID)${NC}"
+echo "  Logs: $PROJECT_ROOT/frontend.log"
+echo "  URL: http://localhost:5173"
+
+echo ""
+echo -e "${BLUE}=================================================="
+echo "Development servers are running!"
+echo "=================================================="
+echo -e "${NC}"
+echo "Frontend: http://localhost:5173"
+echo "Backend:  http://localhost:8000"
+echo ""
+echo "To stop servers, run: ./stop-dev.sh"
+echo "To view logs, run: tail -f backend.log frontend.log"
+echo ""
+

status-dev.sh

@@ -0,0 +1,48 @@
+#!/bin/bash
+# Check status of development servers for Document Viewer
+
+# Colors for output
+GREEN='\033[0;32m'
+RED='\033[0;31m'
+BLUE='\033[0;34m'
+NC='\033[0m' # No Color
+
+PROJECT_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+BACKEND_PID_FILE="$PROJECT_ROOT/.backend.pid"
+FRONTEND_PID_FILE="$PROJECT_ROOT/.frontend.pid"
+
+echo -e "${BLUE}Document Viewer Development Status${NC}"
+echo "=================================================="
+
+# Check Backend
+if [ -f "$BACKEND_PID_FILE" ]; then
+    BACKEND_PID=$(cat "$BACKEND_PID_FILE")
+    if ps -p $BACKEND_PID > /dev/null 2>&1; then
+        echo -e "${GREEN}✓ Backend: RUNNING${NC} (PID: $BACKEND_PID)"
+        echo "  URL: http://localhost:8000"
+    else
+        echo -e "${RED}✗ Backend: NOT RUNNING${NC} (stale PID: $BACKEND_PID)"
+    fi
+else
+    echo -e "${RED}✗ Backend: NOT RUNNING${NC}"
+fi
+
+# Check Frontend
+if [ -f "$FRONTEND_PID_FILE" ]; then
+    FRONTEND_PID=$(cat "$FRONTEND_PID_FILE")
+    if ps -p $FRONTEND_PID > /dev/null 2>&1; then
+        echo -e "${GREEN}✓ Frontend: RUNNING${NC} (PID: $FRONTEND_PID)"
+        echo "  URL: http://localhost:5173"
+    else
+        echo -e "${RED}✗ Frontend: NOT RUNNING${NC} (stale PID: $FRONTEND_PID)"
+    fi
+else
+    echo -e "${RED}✗ Frontend: NOT RUNNING${NC}"
+fi
+
+echo ""
+echo "Logs:"
+echo "  Backend:  tail -f $PROJECT_ROOT/backend.log"
+echo "  Frontend: tail -f $PROJECT_ROOT/frontend.log"
+echo ""
+

stop-dev.sh

@@ -0,0 +1,50 @@
+#!/bin/bash
+# Stop development servers for Document Viewer
+
+# Colors for output
+RED='\033[0;31m'
+GREEN='\033[0;32m'
+NC='\033[0m' # No Color
+
+PROJECT_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+BACKEND_PID_FILE="$PROJECT_ROOT/.backend.pid"
+FRONTEND_PID_FILE="$PROJECT_ROOT/.frontend.pid"
+
+echo -e "${RED}Stopping Document Viewer Development Environment${NC}"
+echo "=================================================="
+
+# Stop Backend
+if [ -f "$BACKEND_PID_FILE" ]; then
+    BACKEND_PID=$(cat "$BACKEND_PID_FILE")
+    if ps -p $BACKEND_PID > /dev/null 2>&1; then
+        echo "Stopping backend (PID: $BACKEND_PID)..."
+        kill $BACKEND_PID
+        rm "$BACKEND_PID_FILE"
+        echo -e "${GREEN}✓ Backend stopped${NC}"
+    else
+        echo "Backend process not found (PID: $BACKEND_PID)"
+        rm "$BACKEND_PID_FILE"
+    fi
+else
+    echo "No backend PID file found"
+fi
+
+# Stop Frontend
+if [ -f "$FRONTEND_PID_FILE" ]; then
+    FRONTEND_PID=$(cat "$FRONTEND_PID_FILE")
+    if ps -p $FRONTEND_PID > /dev/null 2>&1; then
+        echo "Stopping frontend (PID: $FRONTEND_PID)..."
+        kill $FRONTEND_PID
+        rm "$FRONTEND_PID_FILE"
+        echo -e "${GREEN}✓ Frontend stopped${NC}"
+    else
+        echo "Frontend process not found (PID: $FRONTEND_PID)"
+        rm "$FRONTEND_PID_FILE"
+    fi
+else
+    echo "No frontend PID file found"
+fi
+
+echo ""
+echo -e "${GREEN}Development servers stopped${NC}"
+