How do I install MediaWiki?

MediaWiki is a local plugin. Install it using npm package: @professional-wiki/mediawiki-mcp-server and add the generated configuration snippet to your AI app's MCP config file. Then restart your AI app.

What credentials does MediaWiki need?

MediaWiki requires the following credentials or environment variables: CONFIG, MCP_ALLOW_STATIC_FALLBACK, MCP_CONTENT_MAX_BYTES, MCP_LOG_LEVEL, MCP_MAX_REQUEST_BODY, MCP_METRICS, MCP_OAUTH_CREDENTIALS_FILE, MCP_OAUTH_NO_BROWSER, MCP_PUBLIC_URL, MCP_SESSION_IDLE_TIMEOUT, MCP_SHUTDOWN_GRACE_MS, MCP_TRANSPORT, PORT. You can find setup instructions on the server detail page.

What AI apps work with MediaWiki?

MediaWiki uses the Model Context Protocol (MCP) and works with any MCP-compatible AI app, including Claude, ChatGPT / Codex, Gemini, Copilot, Cursor, and more.

Back to Browse

MediaWiki MCP Server

by ProfessionalWiki

Content & MediaLow Risk9.3MCP RegistryLocal

Free

Server data from the Official MCP Registry

MCP server enabling AI clients to interact with any MediaWiki wiki through standard tools

About

MCP server enabling AI clients to interact with any MediaWiki wiki through standard tools

Security Report

9.3

Low Risk9.3Low Risk

Valid MCP server (2 strong, 1 medium validity signals). 2 known CVEs in dependencies Package registry verified. Imported from the Official MCP Registry.

5 files analyzed · 3 issues found

Security scores are indicators to help you make informed decisions, not guarantees. Always review permissions before connecting any MCP server.

Permissions Required

This plugin requests these system permissions. Most are normal for its category.

file_system

Check that this permission is expected for this type of plugin.

What You'll Need

Set these up before or after installing:

Path to your configuration fileOptional

Environment variable: CONFIG

Set to 'true' to allow HTTP startup when config.json has static credentials. Otherwise the server refuses to start, preventing silent shared-identity fallback for unauthenticated requests.Optional

Environment variable: MCP_ALLOW_STATIC_FALLBACK

Byte cap for content bodies (wikitext, rendered HTML, diffs) returned by get-page, get-pages, parse-wikitext, and compare-pages. Oversized bodies are truncated with a trailing marker.Optional

Environment variable: MCP_CONTENT_MAX_BYTES

Minimum severity for logger output (stderr telemetry and sendLoggingMessage broadcast). Invalid values fail loudly on first log call.Optional

Environment variable: MCP_LOG_LEVEL

Maximum HTTP request body size on the StreamableHTTP transport. Accepts size strings like 1mb or 512kb.Optional

Environment variable: MCP_MAX_REQUEST_BODY

Set to 'true' to expose Prometheus metrics at GET /metrics on the HTTP transport. Has no effect on the stdio transport.Optional

Environment variable: MCP_METRICS

Override the default OAuth credentials store path. Default: ~/.config/mediawiki-mcp/credentials.json on Linux/macOS, %APPDATA%\mediawiki-mcp\credentials.json on Windows.Optional

Environment variable: MCP_OAUTH_CREDENTIALS_FILE

Set to '1' to skip launching a browser during the OAuth dance and log the auth URL to stderr instead. Useful in headless environments and CI.Optional

Environment variable: MCP_OAUTH_NO_BROWSER

Override the request-derived public URL used in the protected-resource discovery doc and WWW-Authenticate header. Set this when running behind a proxy that rewrites the request Host.Optional

Environment variable: MCP_PUBLIC_URL

Seconds an HTTP session may sit idle before it is closed and removed on the StreamableHTTP transport. Any request resets the timer. Set to 0 to disable expiry.Optional

Environment variable: MCP_SESSION_IDLE_TIMEOUT

Maximum milliseconds to wait for in-flight /mcp calls to drain on SIGTERM/SIGINT before exiting. Capped at 600000.Optional

Environment variable: MCP_SHUTDOWN_GRACE_MS

Type of MCP server transportOptional

Environment variable: MCP_TRANSPORT

Port used for StreamableHTTP transportOptional

Environment variable: PORT

How to Install

Add this to your MCP configuration file:

{
  "mcpServers": {
    "io-github-professionalwiki-mediawiki-mcp-server": {
      "env": {
        "PORT": "your-port-here",
        "CONFIG": "your-config-here",
        "MCP_METRICS": "your-mcp-metrics-here",
        "MCP_LOG_LEVEL": "your-mcp-log-level-here",
        "MCP_TRANSPORT": "your-mcp-transport-here",
        "MCP_PUBLIC_URL": "your-mcp-public-url-here",
        "MCP_MAX_REQUEST_BODY": "your-mcp-max-request-body-here",
        "MCP_OAUTH_NO_BROWSER": "your-mcp-oauth-no-browser-here",
        "MCP_CONTENT_MAX_BYTES": "your-mcp-content-max-bytes-here",
        "MCP_SHUTDOWN_GRACE_MS": "your-mcp-shutdown-grace-ms-here",
        "MCP_SESSION_IDLE_TIMEOUT": "your-mcp-session-idle-timeout-here",
        "MCP_ALLOW_STATIC_FALLBACK": "your-mcp-allow-static-fallback-here",
        "MCP_OAUTH_CREDENTIALS_FILE": "your-mcp-oauth-credentials-file-here"
      },
      "args": [
        "-y",
        "@professional-wiki/mediawiki-mcp-server"
      ],
      "command": "npx"
    }
  }
}

Documentation

View on GitHub

From the project's GitHub README.

MediaWiki MCP Server

An MCP (Model Context Protocol) server that enables Large Language Model (LLM) clients to interact with any MediaWiki wiki.

Features

Tools

Every tool that operates on a wiki accepts an optional wiki argument naming the wiki to act on (the wiki-management and OAuth tools do not) — pass a wiki key (e.g. en.wikipedia.org) or the full mcp://wikis/{wikiKey} URI. Omit it to use the configured default wiki (see Configuration). Each tool response reports the wiki the call ran against.

Page reads

Name	Description
`compare-pages`	Diff two versions of a wiki page by revision, title, or supplied wikitext.
`get-category-members`	List members of a category (up to 500 per call, paginated via `continueFrom`).
`get-file`	Fetch a file page.
`get-file-data`	Fetch a file's image bytes inline (base64) for visual analysis — for clients that can't reach the wiki host. Returns a scaled rendition (set `width`); non-renderable types (audio, video, binaries) error. For metadata or a download URL, use `get-file`.
`get-links-here`	List pages that reference a wiki page — pages that link to it, embed it as a template, or display it as a file (select via `type`), including pages that reach it through a redirect. Up to 500 per call, paginated via `continueFrom`.
`get-page`	Fetch a wiki page.
`get-page-history`	List recent revisions of a wiki page.
`get-pages`	Fetch multiple wiki pages in one call (up to 50).
`get-recent-changes`	List recent change events across the wiki, filterable by timestamp, namespace, user, tag, type, and hide flags (up to 50 per call, paginated via `continue`).
`get-revision`	Fetch a specific revision of a page.
`get-site-info`	Get a wiki's key settings: MediaWiki version, content language, title-case rules, namespaces, installed extensions, license, and (optionally) statistics.
`list-wikis`	List every configured wiki — its key, sitename, server, whether it is read-only or the default, whether it is reachable, which extension-gated tools work on it, and, for an OAuth-configured wiki, its authorization server. Disabled when fewer than two wikis are configured.
`parse-wikitext`	Render wikitext to HTML without saving. Returns parse warnings, wikilinks, templates, and external URLs.
`search-page`	Search wiki page titles and contents.
`search-page-by-prefix`	Search page titles by prefix.
`whoami`	Report the identity the current session is authenticated as on the targeted wiki — username, whether it is anonymous, and group memberships (optionally user rights).

Page writes

Name	Description	Permissions
`create-page` 🔐	Create a new wiki page.	`Create, edit, and move pages`
`delete-page` 🔐	Delete a wiki page.	`Delete pages, revisions, and log entries`
`move-page` 🔐	Move (rename) a wiki page.	`Create, edit, and move pages`
`undelete-page` 🔐	Undelete a wiki page.	`Delete pages, revisions, and log entries`
`update-file` 🔐	Upload a new revision of an existing file from local disk.	`Upload, replace, and move files`
`update-file-from-url` 🔐	Upload a new revision of an existing file from a URL.	`Upload, replace, and move files`
`update-page` 🔐	Update an existing wiki page.	`Edit existing pages`
`upload-file` 🔐	Upload a file to the wiki from local disk.	`Upload new files`
`upload-file-from-url` 🔐	Upload a file to the wiki from a URL.	`Upload, replace, and move files`

Wiki management

Name	Description
`add-wiki`	Add a wiki as an MCP resource from its URL. Disabled when `allowWikiManagement` is `false`.
`remove-wiki`	Remove a wiki resource. Disabled when `allowWikiManagement` is `false` or fewer than two wikis are configured.

OAuth

Name	Description
`oauth-logout`	Remove stored OAuth tokens. Stdio only.
`oauth-status`	List stored OAuth tokens with scopes and expiry (no token values). Stdio only.

Extension packs

Name	Description
`bucket-query`	Run a Bucket extension Lua query. Enabled only when the wiki has Bucket installed.
`cargo-describe-table`	List the fields of a Cargo extension table with their types and list-flags. Enabled only when the wiki has Cargo installed.
`cargo-list-tables`	List Cargo tables defined on the wiki. Enabled only when the wiki has Cargo installed.
`cargo-query`	Run a Cargo extension SQL-style query. Enabled only when the wiki has Cargo installed.
`smw-list-properties`	List Semantic MediaWiki properties with copy-paste templates for `smw-query`. Enabled only when the wiki has SMW installed.
`smw-query`	Run a Semantic MediaWiki `#ask` query. Enabled only when the wiki has SMW installed.

Resources

mcp://wikis/{wikiKey} — per-wiki resource exposing sitename, server (the wiki's public address), articlepath, scriptpath, and a private flag.

Credentials (token, username, password) are never exposed in resource content.
After add-wiki or remove-wiki, the server sends notifications/resources/list_changed so clients refresh.

{
  "contents": [
    {
      "uri": "mcp://wikis/en.wikipedia.org",
      "mimeType": "application/json",
      "text": "{ \"sitename\":\"Wikipedia\",\"server\":\"https://en.wikipedia.org\",\"articlepath\":\"/wiki\",\"scriptpath\":\"/w\",\"private\":false }"
    }
  ]
}

Environment variables

Name	Description	Default
`CONFIG`	Path to your configuration file	`config.json`
`MCP_ALLOW_STATIC_FALLBACK`	Set to `true` to allow HTTP startup when `config.json` has static credentials. See docs/deployment.md — Shape 2.	`unset`
`MCP_CONTENT_MAX_BYTES`	Byte cap for content bodies (wikitext, rendered HTML, diffs). Tune to the target LLM client's tool-response budget.	`50000`
`MCP_FILE_DATA_MAX_BYTES`	Hard cap on the base64-encoded size of a `get-file-data` response. A transport/safety backstop; tune the actual size per call with the tool's `width`. Over-cap calls error rather than truncate.	`1000000`
`MCP_LOG_LEVEL`	Minimum severity for logger output. One of `debug`, `info`, `notice`, `warning`, `error`, `critical`, `alert`, `emergency`, or `silent`.	`debug`
`MCP_OAUTH_CREDENTIALS_FILE`	Override the default credentials store path. Default: `~/.config/mediawiki-mcp/credentials.json` (Linux/macOS) or `%APPDATA%\mediawiki-mcp\credentials.json` (Windows).	`unset`
`MCP_OAUTH_NO_BROWSER`	Set to `1` to skip launching a browser during the OAuth flow; the auth URL is logged to stderr instead. Useful in headless environments.	`unset`
`MCP_PUBLIC_URL`	Override the request-derived public URL used in OAuth protected-resource discovery. Useful for reverse-proxy setups that rewrite the `Host` header.	`unset`
`MCP_MAX_REQUEST_BODY`	Maximum HTTP request body size (StreamableHTTP transport). Accepts size strings like `512kb` or `1mb`. Oversize requests get a JSON-RPC 413.	`1mb`
`MCP_METRICS`	Set to `true` to expose Prometheus metrics at `GET /metrics` on the HTTP transport.	`unset`
`MCP_SESSION_IDLE_TIMEOUT`	Seconds an HTTP session may sit idle before it is closed and removed (StreamableHTTP transport). Any request resets the timer. `0` disables expiry.	`1800`
`MCP_SHUTDOWN_GRACE_MS`	Maximum ms to wait for in-flight `/mcp` calls to drain on `SIGTERM` / `SIGINT`. See docs/operations.md — Graceful shutdown.	`10000`
`MCP_TRANSPORT`	Type of MCP server transport (`stdio` or `http`)	`stdio`
`PORT`	Port used for StreamableHTTP transport	`3000`

Configuration

[!NOTE] Config is only required when interacting with a private wiki or using authenticated tools.

Create a config.json file to configure wiki connections. Use the config.example.json as a starting point.

{
  "defaultWiki": "en.wikipedia.org",
  "wikis": {
    "en.wikipedia.org": {
      "sitename": "Wikipedia",
      "server": "https://en.wikipedia.org",
      "articlepath": "/wiki",
      "scriptpath": "/w"
    }
  }
}

Internal vs public address. The server you configure is the address the MCP server uses to reach the wiki's API — it may be an internal hostname (e.g. http://mediawiki in Docker). URLs handed back to the AI (page links, the server field in list-wikis and mcp://wikis resources) are built from the wiki's own public address, so internal hostnames don't leak into links. If a wiki can't be reached, links fall back to the configured server.

For the full field reference, env-var substitution, secret sources, change tags, upload directories, and authentication options, see docs/configuration.md.

Authentication

Tools marked 🔐 require authentication. They are also hidden from tools/list when the configured default wiki has readOnly: true — see Deployment.

Browser-based OAuth (recommended). Sign in through a browser tab the first time a tool needs auth. Set oauth2ClientId and oauth2CallbackPort per wiki — see docs/configuration.md — OAuth (browser-based).
Per-request bearer token (HTTP). Each request carries Authorization: Bearer <token>; the server forwards it to MediaWiki. See docs/deployment.md — per-request bearer token.
Manual OAuth2 access token. Paste a long-lived token into config.json. See docs/configuration.md — manual OAuth2 access token.
Bot password. Fallback when Extension:OAuth isn't installed. See docs/configuration.md — bot password.

The Cargo tools (cargo-query, cargo-list-tables, cargo-describe-table) call API actions gated by the runcargoqueries user right. Most wikis grant this to all users by default; wikis that restrict it require the Create, query and delete data through the Cargo extension grant on the bot password or OAuth consumer. The Cargo extension is also detected on wiki.gg-hosted wikis (Helldivers, Terraria, Ark, etc.), where it ships under the rebranded name LIBRARIAN.

Installation

Follow the guide, use following configuration:

{
  "mcpServers": {
    "mediawiki-mcp-server": {
      "command": "npx",
      "args": [
        "@professional-wiki/mediawiki-mcp-server@latest"
      ],
      "env": {
        "CONFIG": "path/to/config.json"
      }
    }
  }
}

code --add-mcp '{"name":"mediawiki-mcp-server","command":"npx","args":["@professional-wiki/mediawiki-mcp-server@latest"]}'

Go to Cursor Settings -> MCP -> Add new MCP Server. Name to your liking, use command type with the command npx @professional-wiki/mediawiki-mcp-server. You can also verify config or add command like arguments via clicking Edit.

{
  "mcpServers": {
    "mediawiki-mcp-server": {
      "command": "npx",
      "args": [
        "@professional-wiki/mediawiki-mcp-server@latest"
      ],
      "env": {
        "CONFIG": "path/to/config.json"
      }
    }
  }
}

Follow the guide, use following configuration:

{
  "mcpServers": {
    "mediawiki-mcp-server": {
      "command": "npx",
      "args": [
        "@professional-wiki/mediawiki-mcp-server@latest"
      ],
      "env": {
        "CONFIG": "path/to/config.json"
      }
    }
  }
}

Follow the Claude Code MCP docs.

Run the below command, optionally with -e flags to specify environment variables.

claude mcp add mediawiki-mcp-server npx @professional-wiki/mediawiki-mcp-server@latest

You should end up with something like the below in your .claude.json config:

"mcpServers": {
  "mediawiki-mcp-server": {
    "type": "stdio",
    "command": "npx",
    "args": [
      "@professional-wiki/mediawiki-mcp-server@latest"
    ],
    "env": {
      "CONFIG": "path/to/config.json"
    }
  }
},

Run:

gemini extensions install https://github.com/ProfessionalWiki/MediaWiki-MCP-Server

This installs the extension from the latest GitHub Release. To pin a specific version, append --ref=<tag> (for example --ref=v0.6.5).

See the Gemini CLI extensions documentation for how to update, list, or uninstall extensions.

Deployment

Running the server as a remote HTTP endpoint for other users has its own configuration requirements — see docs/deployment.md. A pre-built image is published at ghcr.io/professionalwiki/mediawiki-mcp-server. For day-2 operations (logs, /health//ready, metrics, graceful shutdown), see docs/operations.md.

Security

Defaults are safe for single-user use. Before exposing the HTTP transport to others, lock down three things:

Trust the proxy, not the header. The server forwards any Authorization: Bearer header straight to MediaWiki — authentication is the reverse proxy's job. Terminate TLS there, and don't expose the MCP port directly on an untrusted network. See docs/deployment.md — reverse proxy requirements.
Pair MCP_BIND with MCP_ALLOWED_HOSTS and MCP_ALLOWED_ORIGINS. The HTTP transport binds to 127.0.0.1 by default. When you open it up with MCP_BIND=0.0.0.0, set MCP_ALLOWED_HOSTS to the hostnames your proxy forwards and MCP_ALLOWED_ORIGINS to the browser origins allowed to call the server — these block DNS-rebinding and cross-origin attacks respectively.
Uploads are opt-in. upload-file is disabled until you list allowed directories in uploadDirs or MCP_UPLOAD_DIRS. See docs/configuration.md — upload directories.

Report a vulnerability via GitHub's security advisory form — full policy in SECURITY.md.

Contributing

Contributions are welcome — pull requests and issues (bugs, feature requests, suggestions) both work.

Working on tool code? Start from AGENTS.md for repo layout, commands, and testing patterns.
Adding or modifying a tool? Read docs/tool-conventions.md — it covers description voice, parameter docs, annotation hints, and MediaWiki terminology conventions.
Running a release? See docs/releasing.md.

License

This project is licensed under the MIT License. See the LICENSE file for details.

Reviews

No reviews yet

Be the first to review this server!

MediaWiki MCP Server

About

Security Report

Findings (3)

Permissions Required

What You'll Need

How to Install

Documentation

MediaWiki MCP Server

Features

Tools

Page reads

Page writes

Wiki management

OAuth

Extension packs

Resources

Environment variables

Configuration

Authentication

Installation

Deployment

Security

Contributing

License

Reviews

No reviews yet

More Content & Media MCP Servers

MarkItDown

Toleno

mcp-creator-python

mcp-creator-typescript

FinAgent

Google Workspace MCP