Integrate LLMs with MediaWiki

MediaWiki MCP Server

An MCP (Model Context Protocol) server that enables Large Language Model (LLM) clients to interact with any MediaWiki wiki.

Features

Tools

Every tool that operates on a wiki accepts an optional wiki argument naming the wiki to act on (the wiki-management and OAuth tools do not) - pass a wiki key (e.g. en.wikipedia.org) or the full mcp://wikis/{wikiKey} URI. Omit it to use the configured default wiki (see Configuration). Each tool response reports the wiki the call ran against.

Page reads

Page writes

Wiki management

OAuth

Extension packs

Each pack's tools register only on wikis where its extension is installed.

NeoWiki

Semantic MediaWiki

Bucket

Cargo

Resources

mcp://wikis/{wikiKey} - per-wiki resource exposing sitename, server (the wiki's public address), articlepath, scriptpath, and a private flag.

• Credentials (token, username, password) are never exposed in resource content.
• After add-wiki or remove-wiki, the server sends notifications/resources/list_changed so clients refresh.

{
  "contents": [
    {
      "uri": "mcp://wikis/en.wikipedia.org",
      "mimeType": "application/json",
      "text": "{ \"sitename\":\"Wikipedia\",\"server\":\"https://en.wikipedia.org\",\"articlepath\":\"/wiki\",\"scriptpath\":\"/w\",\"private\":false }"
    }
  ]
}

Environment variables

Configuration

Create a config.json file to configure wiki connections. Use the config.example.json as a starting point.

{
  "defaultWiki": "en.wikipedia.org",
  "wikis": {
    "en.wikipedia.org": {
      "sitename": "Wikipedia",
      "server": "https://en.wikipedia.org",
      "articlepath": "/wiki",
      "scriptpath": "/w"
    }
  }
}

Internal vs public address. The server you configure is the address the MCP server uses to reach the wiki's API - it may be an internal hostname (e.g. http://mediawiki in Docker). URLs handed back to the AI (page links, the server field in list-wikis and mcp://wikis resources) are built from the wiki's own public address, so internal hostnames don't leak into links. If a wiki can't be reached, links fall back to the configured server.

For the full field reference, env-var substitution, secret sources, change tags, upload directories, and authentication options, see docs/configuration.md.

Authentication

Tools marked 🔐 require authentication. Write tools (including extension-pack writes) are hidden from tools/list when the configured default wiki has readOnly: true - see Deployment.

• Browser-based OAuth (recommended). Sign in through a browser tab the first time a tool needs auth. Set oauth2ClientId and oauth2CallbackPort per wiki - see docs/configuration.md - OAuth (browser-based).
• Per-request bearer token (HTTP). Each request carries Authorization: Bearer <token>; the server forwards it to MediaWiki. See docs/deployment.md - per-request bearer token.
• Hosted OAuth proxy (HTTP). The server fronts one MediaWiki consumer as an OAuth 2.1 Authorization Server, so an OAuth-aware client signs each user in - no manual tokens. Point it at https://<wiki>/mcp; anonymous read still works. See docs/deployment.md - hosted OAuth sign-in.
• Manual OAuth2 access token. Paste a long-lived token into config.json. See docs/configuration.md - manual OAuth2 access token.
• Bot password. Fallback when Extension:OAuth isn't installed. See docs/configuration.md - bot password.

The Cargo tools (cargo-query, cargo-list-tables, cargo-describe-table) call API actions gated by the runcargoqueries user right. Most wikis grant this to all users by default; wikis that restrict it require the Create, query and delete data through the Cargo extension grant on the bot password or OAuth consumer. The Cargo extension is also detected on wiki.gg-hosted wikis (Helldivers, Terraria, Ark, etc.), where it ships under the rebranded name LIBRARIAN.

Installation

{
  "mcpServers": {
    "mediawiki-mcp-server": {
      "command": "npx",
      "args": [
        "@professional-wiki/mediawiki-mcp-server@latest"
      ],
      "env": {
        "CONFIG": "path/to/config.json"
      }
    }
  }
}

code --add-mcp '{"name":"mediawiki-mcp-server","command":"npx","args":["@professional-wiki/mediawiki-mcp-server@latest"]}'

{
  "mcpServers": {
    "mediawiki-mcp-server": {
      "command": "npx",
      "args": [
        "@professional-wiki/mediawiki-mcp-server@latest"
      ],
      "env": {
        "CONFIG": "path/to/config.json"
      }
    }
  }
}

{
  "mcpServers": {
    "mediawiki-mcp-server": {
      "command": "npx",
      "args": [
        "@professional-wiki/mediawiki-mcp-server@latest"
      ],
      "env": {
        "CONFIG": "path/to/config.json"
      }
    }
  }
}

claude mcp add mediawiki-mcp-server npx @professional-wiki/mediawiki-mcp-server@latest

"mcpServers": {
  "mediawiki-mcp-server": {
    "type": "stdio",
    "command": "npx",
    "args": [
      "@professional-wiki/mediawiki-mcp-server@latest"
    ],
    "env": {
      "CONFIG": "path/to/config.json"
    }
  }
},

gemini extensions install https://github.com/ProfessionalWiki/MediaWiki-MCP-Server

Deployment

Running the server as a remote HTTP endpoint for other users has its own configuration requirements - see docs/deployment.md. A pre-built image is published at ghcr.io/professionalwiki/mediawiki-mcp-server. For day-2 operations (logs, /health//ready, metrics, graceful shutdown), see docs/operations.md.

Security

Defaults are safe for single-user use. Before exposing the HTTP transport to others, lock down three things:

• Trust the proxy, not the header. The server forwards any Authorization: Bearer header straight to MediaWiki - authentication is the reverse proxy's job. Terminate TLS there, and don't expose the MCP port directly on an untrusted network. See docs/deployment.md - security checklist.
• Pair MCP_BIND with MCP_ALLOWED_HOSTS and MCP_ALLOWED_ORIGINS. The HTTP transport binds to 127.0.0.1 by default. When you open it up with MCP_BIND=0.0.0.0, set MCP_ALLOWED_HOSTS to the hostnames your proxy forwards and MCP_ALLOWED_ORIGINS to the browser origins allowed to call the server - these block DNS-rebinding and cross-origin attacks respectively.
• Uploads are opt-in. upload-file is disabled until you list allowed directories in uploadDirs or MCP_UPLOAD_DIRS. See docs/configuration.md - upload directories.
• Internal destinations need MCP_TRUSTED_HOSTS. Outbound fetches - the anonymous siteinfo probe, wiki discovery, *-file-from-url - are SSRF-guarded: a destination resolving to a private or loopback address is refused. To deliberately run against an internal host - e.g. a Docker-network alias like mediawiki.svc that bypasses your public proxy - list it in MCP_TRUSTED_HOSTS to exempt it from the public-IP check. The host is still resolved and pinned, and the guard stays on for every other destination. This is the outbound counterpart to the inbound MCP_ALLOWED_HOSTS (Host-header) check - the two are unrelated despite the similar names.

Report a vulnerability via GitHub's security advisory form - full policy in SECURITY.md.