wikijs-mcp-http

Native HTTP/SSE MCP server for Wiki.js. A clean, production-oriented replacement for supergateway-based setups.

This fork exists because the original transport layer was janky. We replaced it with Wiki.js's built-in --http / SSE support so you get a proper, stable, long-lived MCP server you can actually run behind a reverse proxy.

Features

• 29 tools (19 read + 10 write) covering pages, comments, tags, assets, users, navigation, and system info

• Full-text search, page tree browsing, link graphs, and version history

• Complete comment system (list, read, create, update, delete)

• Asset and folder management

• Tag management

• System diagnostics and site config

• Optional mutations with multiple safety layers (WIKI_MUTATIONS_ENABLED, dry-run mode, confirm tokens, path prefix restrictions)

• Built-in resources: wikijs://markdown-guide, wikijs://mermaid-guide, wikijs://api-permissions-guide

• Typed errors with LLM-friendly messages

• GraphQL client with timeout + exponential backoff

• Sensitive field filtering and input hardening

Related MCP server: requarks-wiki-mcp

Quick Start (HTTP/SSE Mode)

cp .env.example .env
npm install
npm run build

Edit .env:

WIKI_BASE_URL=https://your-server
WIKI_API_TOKEN=your_wikijs_jwt_token
MCP_TRANSPORT=http
MCP_HOST=0.0.0.0
MCP_PORT=3200
WIKI_MUTATIONS_ENABLED=false          # set true only when you need writes
WIKI_MUTATION_DRY_RUN=true

Run it:

npm start

Connect your MCP client to:

https://your-server:3200/sse

Recommended Production Setup (systemd + Caddy)

See the full systemd service and Caddyfile examples in the repo (or the one running at 666temple.love right now).

Basic pattern:

• Run as a dedicated user

• Bind to localhost only

• Put Caddy (or nginx) in front with HTTPS + subdomain (e.g. mcp.website.com)

• Use a strong WIKI_MUTATION_CONFIRM_TOKEN if you enable writes

Environment Variables

Full reference is in .env.example.

Wiki.js Setup

1. Go to Administration → API in Wiki.js and enable API access

2. Create an API key (JWT) with appropriate permissions

3. Paste it into WIKI_API_TOKEN

For heavy read usage you usually only need read:pages + read:source + read:comments.

Mutation Safety

Write tools are disabled by default. When enabled they still have multiple guardrails:

• WIKI_MUTATION_DRY_RUN=true (default) → tools only preview

• WIKI_MUTATION_CONFIRM_TOKEN → forces you to pass a matching confirm argument on every write

• WIKI_ALLOWED_MUTATION_PATH_PREFIXES → scope writes to specific path prefixes

• All mutation attempts are logged to stderr with structured audit info

MCP Client Config

HTTP/SSE (recommended)

{
  "mcpServers": {
    "wikijs": {
      "command": "node",
      "args": ["/path/to/wikijs-mcp-http/dist/index.js"],
      "env": {
        "WIKI_BASE_URL": "https://website.com",
        "WIKI_API_TOKEN": "your_token",
        "MCP_TRANSPORT": "http",
        "MCP_PORT": "3200"
      }
    }
  }
}

Stdio (local only)

Still supported if you prefer the classic style.

Development

npm run dev          # HTTP dev server with hot reload
npm run dev:stdio    # stdio dev mode
npm run build

License

CC0. Do whatever the fuck you want with it.

Maintained as part of the 666 Grimoire stack.