MediaWiki MCP Server

An MCP (Model Context Protocol) server that enables Large Language Model (LLM) clients to interact with any MediaWiki wiki.

Features

Tools

Page reads

Page writes

Wiki management

OAuth

Extension packs

Resources

mcp://wikis/{wikiKey} — per-wiki resource exposing sitename, server, articlepath, scriptpath, and a private flag.

• Credentials (token, username, password) are never exposed in resource content.
• After add-wiki or remove-wiki, the server sends notifications/resources/list_changed so clients refresh.

{
  "contents": [
    {
      "uri": "mcp://wikis/en.wikipedia.org",
      "mimeType": "application/json",
      "text": "{ \"sitename\":\"Wikipedia\",\"server\":\"https://en.wikipedia.org\",\"articlepath\":\"/wiki\",\"scriptpath\":\"/w\",\"private\":false }"
    }
  ]
}

Environment variables

Configuration

[!NOTE] Config is only required when interacting with a private wiki or using authenticated tools.

Create a config.json file to configure wiki connections. Use the config.example.json as a starting point.

{
  "defaultWiki": "en.wikipedia.org",
  "wikis": {
    "en.wikipedia.org": {
      "sitename": "Wikipedia",
      "server": "https://en.wikipedia.org",
      "articlepath": "/wiki",
      "scriptpath": "/w"
    }
  }
}

For the full field reference, env-var substitution, secret sources, change tags, upload directories, and authentication options, see docs/configuration.md.

Authentication

Tools marked 🔐 require authentication. They are also hidden from tools/list when the active wiki has readOnly: true — see Deployment.

• Browser-based OAuth (recommended). Sign in through a browser tab the first time a tool needs auth. Set oauth2ClientId and oauth2CallbackPort per wiki — see docs/configuration.md — OAuth (browser-based).
• Per-request bearer token (HTTP). Each request carries Authorization: Bearer <token>; the server forwards it to MediaWiki. See docs/deployment.md — per-request bearer token.
• Manual OAuth2 access token. Paste a long-lived token into config.json. See docs/configuration.md — manual OAuth2 access token.
• Bot password. Fallback when Extension:OAuth isn't installed. See docs/configuration.md — bot password.

The Cargo tools (cargo-query, cargo-list-tables, cargo-describe-table) call API actions gated by the runcargoqueries user right. Most wikis grant this to all users by default; wikis that restrict it require the Create, query and delete data through the Cargo extension grant on the bot password or OAuth consumer. The Cargo extension is also detected on wiki.gg-hosted wikis (Helldivers, Terraria, Ark, etc.), where it ships under the rebranded name LIBRARIAN.

Installation

{
  "mcpServers": {
    "mediawiki-mcp-server": {
      "command": "npx",
      "args": [
        "@professional-wiki/mediawiki-mcp-server@latest"
      ],
      "env": {
        "CONFIG": "path/to/config.json"
      }
    }
  }
}

code --add-mcp '{"name":"mediawiki-mcp-server","command":"npx","args":["@professional-wiki/mediawiki-mcp-server@latest"]}'

{
  "mcpServers": {
    "mediawiki-mcp-server": {
      "command": "npx",
      "args": [
        "@professional-wiki/mediawiki-mcp-server@latest"
      ],
      "env": {
        "CONFIG": "path/to/config.json"
      }
    }
  }
}

{
  "mcpServers": {
    "mediawiki-mcp-server": {
      "command": "npx",
      "args": [
        "@professional-wiki/mediawiki-mcp-server@latest"
      ],
      "env": {
        "CONFIG": "path/to/config.json"
      }
    }
  }
}

claude mcp add mediawiki-mcp-server npx @professional-wiki/mediawiki-mcp-server@latest

"mcpServers": {
  "mediawiki-mcp-server": {
    "type": "stdio",
    "command": "npx",
    "args": [
      "@professional-wiki/mediawiki-mcp-server@latest"
    ],
    "env": {
      "CONFIG": "path/to/config.json"
    }
  }
},

gemini extensions install https://github.com/ProfessionalWiki/MediaWiki-MCP-Server

Deployment

Running the server as a remote HTTP endpoint for other users has its own configuration requirements — see docs/deployment.md. A pre-built image is published at ghcr.io/professionalwiki/mediawiki-mcp-server. For day-2 operations (logs, /health//ready, metrics, graceful shutdown), see docs/operations.md.

Security

Defaults are safe for single-user use. Before exposing the HTTP transport to others, lock down three things:

• Trust the proxy, not the header. The server forwards any Authorization: Bearer header straight to MediaWiki — authentication is the reverse proxy's job. Terminate TLS there, and don't expose the MCP port directly on an untrusted network. See docs/deployment.md — reverse proxy requirements.
• Pair MCP_BIND with MCP_ALLOWED_HOSTS and MCP_ALLOWED_ORIGINS. The HTTP transport binds to 127.0.0.1 by default. When you open it up with MCP_BIND=0.0.0.0, set MCP_ALLOWED_HOSTS to the hostnames your proxy forwards and MCP_ALLOWED_ORIGINS to the browser origins allowed to call the server — these block DNS-rebinding and cross-origin attacks respectively.
• Uploads are opt-in. upload-file is disabled until you list allowed directories in uploadDirs or MCP_UPLOAD_DIRS. See docs/configuration.md — upload directories.

Report a vulnerability via GitHub's security advisory form — full policy in SECURITY.md.

Contributing

Contributions are welcome — pull requests and issues (bugs, feature requests, suggestions) both work.

• Working on tool code? Start from AGENTS.md for repo layout, commands, and testing patterns.
• Adding or modifying a tool? Read docs/tool-conventions.md — it covers description voice, parameter docs, annotation hints, and MediaWiki terminology conventions.
• Running a release? See docs/releasing.md.

License

This project is licensed under the MIT License. See the LICENSE file for details.