MediaWiki MCP Server

An MCP (Model Context Protocol) server that enables Large Language Model (LLM) clients to interact with any MediaWiki wiki.

Features

Tools

Every tool that operates on a wiki accepts an optional wiki argument naming the wiki to act on (the wiki-management and OAuth tools do not) — pass a wiki key (e.g. en.wikipedia.org) or the full mcp://wikis/{wikiKey} URI. Omit it to use the configured default wiki (see Configuration). Each tool response reports the wiki the call ran against.

Page reads

Page writes

Wiki management

OAuth

Extension packs

Resources

mcp://wikis/{wikiKey} — per-wiki resource exposing sitename, server, articlepath, scriptpath, and a private flag.

• Credentials (token, username, password) are never exposed in resource content.
• After add-wiki or remove-wiki, the server sends notifications/resources/list_changed so clients refresh.

{
  "contents": [
    {
      "uri": "mcp://wikis/en.wikipedia.org",
      "mimeType": "application/json",
      "text": "{ \"sitename\":\"Wikipedia\",\"server\":\"https://en.wikipedia.org\",\"articlepath\":\"/wiki\",\"scriptpath\":\"/w\",\"private\":false }"
    }
  ]
}

Environment variables

Configuration

[!NOTE] Config is only required when interacting with a private wiki or using authenticated tools.

Create a config.json file to configure wiki connections. Use the config.example.json as a starting point.

{
  "defaultWiki": "en.wikipedia.org",
  "wikis": {
    "en.wikipedia.org": {
      "sitename": "Wikipedia",
      "server": "https://en.wikipedia.org",
      "articlepath": "/wiki",
      "scriptpath": "/w"
    }
  }
}

For the full field reference, env-var substitution, secret sources, change tags, upload directories, and authentication options, see docs/configuration.md.

Authentication

Tools marked 🔐 require authentication. They are also hidden from tools/list when the configured default wiki has readOnly: true — see Deployment.

• Browser-based OAuth (recommended). Sign in through a browser tab the first time a tool needs auth. Set oauth2ClientId and oauth2CallbackPort per wiki — see docs/configuration.md — OAuth (browser-based).
• Per-request bearer token (HTTP). Each request carries Authorization: Bearer <token>; the server forwards it to MediaWiki. See docs/deployment.md — per-request bearer token.
• Manual OAuth2 access token. Paste a long-lived token into config.json. See docs/configuration.md — manual OAuth2 access token.
• Bot password. Fallback when Extension:OAuth isn't installed. See docs/configuration.md — bot password.

The Cargo tools (cargo-query, cargo-list-tables, cargo-describe-table) call API actions gated by the runcargoqueries user right. Most wikis grant this to all users by default; wikis that restrict it require the Create, query and delete data through the Cargo extension grant on the bot password or OAuth consumer. The Cargo extension is also detected on wiki.gg-hosted wikis (Helldivers, Terraria, Ark, etc.), where it ships under the rebranded name LIBRARIAN.

Installation

Follow the guide, use following configuration:

{
  "mcpServers": {
    "mediawiki-mcp-server": {
      "command": "npx",
      "args": [
        "@professional-wiki/mediawiki-mcp-server@latest"
      ],
      "env": {
        "CONFIG": "path/to/config.json"
      }
    }
  }
}

code --add-mcp '{"name":"mediawiki-mcp-server","command":"npx","args":["@professional-wiki/mediawiki-mcp-server@latest"]}'

Go to Cursor Settings -> MCP -> Add new MCP Server. Name to your liking, use command type with the command npx @professional-wiki/mediawiki-mcp-server. You can also verify config or add command like arguments via clicking Edit.

{
  "mcpServers": {
    "mediawiki-mcp-server": {
      "command": "npx",
      "args": [
        "@professional-wiki/mediawiki-mcp-server@latest"
      ],
      "env": {
        "CONFIG": "path/to/config.json"
      }
    }
  }
}

Follow the guide, use following configuration:

{
  "mcpServers": {
    "mediawiki-mcp-server": {
      "command": "npx",
      "args": [
        "@professional-wiki/mediawiki-mcp-server@latest"
      ],
      "env": {
        "CONFIG": "path/to/config.json"
      }
    }
  }
}

Follow the Claude Code MCP docs.

Run the below command, optionally with -e flags to specify environment variables.

claude mcp add mediawiki-mcp-server npx @professional-wiki/mediawiki-mcp-server@latest

You should end up with something like the below in your .claude.json config:

"mcpServers": {
  "mediawiki-mcp-server": {
    "type": "stdio",
    "command": "npx",
    "args": [
      "@professional-wiki/mediawiki-mcp-server@latest"
    ],
    "env": {
      "CONFIG": "path/to/config.json"
    }
  }
},

Run:

gemini extensions install https://github.com/ProfessionalWiki/MediaWiki-MCP-Server

This installs the extension from the latest GitHub Release. To pin a specific version, append --ref=<tag> (for example --ref=v0.6.5).

See the Gemini CLI extensions documentation for how to update, list, or uninstall extensions.

Deployment

Running the server as a remote HTTP endpoint for other users has its own configuration requirements — see docs/deployment.md. A pre-built image is published at ghcr.io/professionalwiki/mediawiki-mcp-server. For day-2 operations (logs, /health//ready, metrics, graceful shutdown), see docs/operations.md.

Security

Defaults are safe for single-user use. Before exposing the HTTP transport to others, lock down three things:

• Trust the proxy, not the header. The server forwards any Authorization: Bearer header straight to MediaWiki — authentication is the reverse proxy's job. Terminate TLS there, and don't expose the MCP port directly on an untrusted network. See docs/deployment.md — reverse proxy requirements.
• Pair MCP_BIND with MCP_ALLOWED_HOSTS and MCP_ALLOWED_ORIGINS. The HTTP transport binds to 127.0.0.1 by default. When you open it up with MCP_BIND=0.0.0.0, set MCP_ALLOWED_HOSTS to the hostnames your proxy forwards and MCP_ALLOWED_ORIGINS to the browser origins allowed to call the server — these block DNS-rebinding and cross-origin attacks respectively.
• Uploads are opt-in. upload-file is disabled until you list allowed directories in uploadDirs or MCP_UPLOAD_DIRS. See docs/configuration.md — upload directories.

Report a vulnerability via GitHub's security advisory form — full policy in SECURITY.md.

Contributing

Contributions are welcome — pull requests and issues (bugs, feature requests, suggestions) both work.

• Working on tool code? Start from AGENTS.md for repo layout, commands, and testing patterns.
• Adding or modifying a tool? Read docs/tool-conventions.md — it covers description voice, parameter docs, annotation hints, and MediaWiki terminology conventions.
• Running a release? See docs/releasing.md.

License

This project is licensed under the MIT License. See the LICENSE file for details.