How do I install Wiki.js?

Copy the stdio config for Cursor, Claude Desktop, Claude Code, or VS Code on this page. It uses the publisher's install, not a PlugMCP proxy.

Does Wiki.js need an API key?

The publisher lists these environment variables: WIKIJS_URL, WIKIJS_TOKEN, WIKIJS_LOCALE, WIKIJS_READ_ONLY, WIKIJS_ALLOWED_PATHS, WIKIJS_ALLOW_TOOLS, WIKIJS_DENY_TOOLS, WIKIJS_INSECURE_TLS.

What transport does Wiki.js use?

Wiki.js runs locally over stdio.

When was Wiki.js last checked?

Last checked 2026-11-10. Search, read and edit Wiki.js pages, and manage its assets, users, groups and comments

Wiki.js MCP server

Power your agent

Add this server

The publisher's own command. Not a PlugMCP endpoint.

Add to Cursor Add to VS Code Run on PlugMCP

Host a copy with our keys and logs.

Local command

npx -y @ni-c/[email protected]

Credentials from the publisher

WIKIJS_URL — Base URL of the Wiki.js instance, e.g. https://wiki.example.com
WIKIJS_TOKEN — API key from Administration → API Access. WIKIJS_API_KEY is accepted as an alias
WIKIJS_LOCALE — Locale assumed by page tools that are not given one; part of a page's identity (default: en)
WIKIJS_READ_ONLY — Set to true to register only the read tools (default: false)
WIKIJS_ALLOWED_PATHS — Comma-separated page path prefixes the write tools are confined to, matched by path segment
WIKIJS_ALLOW_TOOLS — Comma-separated tool names or list_* prefixes to register; 'essential' selects a curated preset (default: all tools)
WIKIJS_DENY_TOOLS — Comma-separated tool names or list_* prefixes to remove from whatever the allow list left
WIKIJS_INSECURE_TLS — Set to true to accept a self-signed certificate from a self-hosted instance (default: false)

Claude Code has no install link for a local command. Copy the command below and run it in a terminal.

shClaude Code

1WIKIJS_URL=<value> WIKIJS_TOKEN=<secret> WIKIJS_LOCALE=<value> WIKIJS_READ_ONLY=<value> WIKIJS_ALLOWED_PATHS=<value> WIKIJS_ALLOW_TOOLS=<value> WIKIJS_DENY_TOOLS=<value> WIKIJS_INSECURE_TLS=<value> claude mcp add io.github.ni-c-wikijs-mcp -- npx -y @ni-c/wikijs-mcp@0.3.0

Run in a terminal.

jsonClaude Desktop

1{2  "mcpServers": {3    "io.github.ni-c-wikijs-mcp": {4      "command": "npx",5      "args": [6        "-y",7        "@ni-c/[email protected]"8      ],9      "env": {10        "WIKIJS_URL": "<value>",11        "WIKIJS_TOKEN": "<secret>",12        "WIKIJS_LOCALE": "<value>",13        "WIKIJS_READ_ONLY": "<value>",14        "WIKIJS_ALLOWED_PATHS": "<value>",15        "WIKIJS_ALLOW_TOOLS": "<value>",16        "WIKIJS_DENY_TOOLS": "<value>",17        "WIKIJS_INSECURE_TLS": "<value>"18      }19    }20  }21}

claude_desktop_config.json

Local · npmPublisher installStep-by-step: add this in Claude

Remote URL or a command on your machine? How the two installs differ

Run on PlugMCP

Host a copy with our keys and logs.

A new server you create. It is not this listing's official endpoint. Use the publisher install when you want their URL and their credentials.

Launch

Server facts

Local

Tools

No tool list yet. Remote servers get one after the first health check.

FAQ

Questions

wikijs-mcp

A Model Context Protocol (MCP) server for Wiki.js, the self-hosted wiki that keeps its pages as markdown and exposes everything through one GraphQL endpoint.

Lets MCP clients like Claude Code, Claude Desktop or Codex search, read and edit wiki pages — and, if you let them, manage its assets, comments, users, groups and maintenance jobs.

Sixty-two tools is the ceiling, not the floor: WIKIJS_ALLOW_TOOLS=essential registers a curated seven instead, and a model picks the right tool far more reliably from seven than from sixty-two — see choosing which tools load.

What makes it different

Finds text search cannot. Wiki.js' default engine indexes titles and descriptions only — so search_pages says which engine is running, and grep_pages searches the actual text of pages.

Will not clobber a colleague. update_page compares against the moment you read the page and refuses to overwrite an edit saved in between. Surgical edits must match exactly once.

Writes can be confined to part of the wiki. WIKIJS_ALLOWED_PATHS limits the writing page and asset tools to path prefixes, matched by path segment, while reads stay unrestricted.

Requirements

Node.js ≥ 22
A running Wiki.js instance and an API token

Configuration

Variable	Required	Description
`WIKIJS_URL`	yes	Base URL of the wiki, e.g. `https://wiki.example.com`. A trailing `/graphql` is trimmed
`WIKIJS_TOKEN`	yes	API key from Administration → API Access. `WIKIJS_API_KEY` is accepted as an alias
`WIKIJS_LOCALE`	no	Locale assumed by page tools that are not given one (default `en`)
`WIKIJS_READ_ONLY`	no	`true`, `1` or `yes` registers only the read tools
`WIKIJS_ALLOWED_PATHS`	no	Comma-separated page path prefixes the write tools are confined to, e.g. `docs,team/notes`
`WIKIJS_ALLOW_TOOLS`	no	Comma-separated tool names, `list_*` prefixes, or `essential` for a curated preset
`WIKIJS_DENY_TOOLS`	no	Same syntax; removed from whatever `WIKIJS_ALLOW_TOOLS` left
`ELICITATION`	no	`false` replaces the approval dialog with the two-call token. Not prefixed
`WIKIJS_INSECURE_TLS`	no	`true` accepts self-signed certificates (scoped to this connection)

The locale is part of a page's identity, not a display preference: the same path under en and de is two different pages. On a wiki set up in another language, set WIKIJS_LOCALE or every lookup by path answers "not found". list_locales reports what is installed.

API keys are administrative. Wiki.js offers "full access" or a group, and a full-access key can rewrite every page and every account. WIKIJS_READ_ONLY, WIKIJS_ALLOWED_PATHS and the key's own group permissions are three independent ways to narrow that — see SECURITY.md.

Use https://. Over plain http the token travels unencrypted; the server prints a warning unless the host is local. For self-signed certificates prefer a proper internal CA over WIKIJS_INSECURE_TLS.

Without credentials the server still starts and lists its tools (so registries and inspectors can introspect it), but every call fails with setup instructions instead of reaching the API.

Choosing which tools load

WIKIJS_ALLOW_TOOLS and WIKIJS_DENY_TOOLS take comma-separated tool names; a trailing * matches a whole family. essential is a curated preset — search_pages, grep_pages, get_page, list_pages, get_page_tree, create_page and update_page, which is what it takes to find, read and write a wiki page end to end — marked as such in the tool reference.

WIKIJS_ALLOW_TOOLS=essential
WIKIJS_ALLOW_TOOLS=get_page,search_pages,list_*
WIKIJS_DENY_TOOLS=delete_*,purge_page_history,set_api_state

An entry that matches no tool aborts startup and names it, so a typo cannot silently hide a tool — an absent tool is not something anyone traces back to an environment variable. A filtered tool is never registered, so it is absent from tools/list and unknown to tools/call alike, exactly like a write tool under WIKIJS_READ_ONLY.

If you run several of these servers at once, mcp-hub is the other answer — its /hub endpoint replaces every server's tools with six meta-tools.

Confining writes to part of the wiki

WIKIJS_ALLOWED_PATHS limits the writing page and asset tools to a set of path prefixes. Reads stay unrestricted, deliberately: a scope on reads turns a wiki into a confusing half-wiki, and the API key's own page rules are the right place to hide pages outright — they hide them from the web UI too.

WIKIJS_ALLOWED_PATHS=docs,team/notes

Matching is by path segment, so docs covers docs/setup and not docs-archive/old. move_page checks both ends, so a page cannot be moved out of the allowed area or into a protected one.

Asset writes are checked against the asset folder tree, which is a separate namespace. The operations that cannot be confined to a prefix at all — all six instance-wide maintenance tools, the tag tools, and comment edits, because Wiki.js does not say which page a comment is on — refuse while the variable is set rather than making a silent exception. That includes flush_page_cache, rebuild_page_tree and rebuild_search_index, which lose nothing but still act on the whole wiki.

Installation

Claude Code

claude mcp add wikijs-mcp -- npx -y @ni-c/wikijs-mcp

Claude Desktop

{
  "mcpServers": {
    "wikijs-mcp": {
      "command": "npx",
      "args": ["-y", "@ni-c/wikijs-mcp"],
      "env": {
        "WIKIJS_URL": "https://wiki.example.com",
        "WIKIJS_TOKEN": "…"
      }
    }
  }
}

Codex

[mcp_servers.wikijs-mcp]
command = "npx"
args = ["-y", "@ni-c/wikijs-mcp"]
env = { WIKIJS_URL = "https://wiki.example.com", WIKIJS_TOKEN = "…" }

Docker

docker run --rm -i \
  -e WIKIJS_URL=https://wiki.example.com \
  -e WIKIJS_TOKEN=… \
  ghcr.io/ni-c/wikijs-mcp

Through mcp-hub

A client that cannot spawn a local process — ChatGPT connectors, Claude on the web, Cursor, LibreChat — reaches wikijs-mcp through mcp-hub: one container serves many stdio MCP servers over Streamable HTTP, with an OAuth 2.1 login behind a single password and long-lived tokens for the clients that cannot do OAuth. Its /hub endpoint puts every server behind six meta-tools, so one connector reaches all of them without N×tool schemas in the model's context, and it speaks both protocol revisions — a question this server asks travels through it to the person at the far end.

Its /config/mcp.json uses Claude Code's format, so the entry is the one you already have:

{
  "mcpServers": {
    "wikijs-mcp": {
      "command": "npx",
      "args": ["-y", "@ni-c/wikijs-mcp"],
      "env": {
        "WIKIJS_URL": "https://wiki.example.com",
        "WIKIJS_TOKEN": "…",
        "WIKIJS_ALLOW_TOOLS": "essential"
      },
      "denyTools": ["delete_*,purge_page_history,set_api_state"]
    }
  }
}

allowTools and denyTools there are the hub's own per-server filter, which is not the same thing as *_ALLOW_TOOLS in env — the difference, and the mistake it invites, are in the client guide.

Tools

62 tools. ★ marks the essential preset; ⚠ marks a tool that asks a person through MCP elicitation — a dialog the model cannot answer on its behalf, falling back to a two-call confirm_token where the client cannot show one. See Asking a person.

Every tool declares an outputSchema and answers with structuredContent alongside the text block, so a client can use the result without parsing prose. Twenty-nine tools that answered with a sentence — "Deleted page 5 (path)." — now answer with the fields as well, and the sentence stays where a reader wants it.

The tools that report wiki content carry untrusted: true and source: "wikijs" as fields; page text, titles, descriptions and comments are written by anyone with edit rights. The list follows the call sites: a tool is marked exactly when it already routed its answer through the untrusted wrapper.

update_page's stale-read refusal keeps its shape as a deliberate exception — it stays an ordinary result rather than an error, because it is an instruction for recovering rather than a failure, and it now says written: false with both timestamps in fields.

Tool	Description
`list_pages`	★ Lists pages with their metadata, newest first by default.
`get_page`	★ Reads one page, addressed by page_id or by path plus locale.
`search_pages`	★ Full-text search — but read this first: on a default Wiki.js the search engine is "Database - Basic", which only indexes page titles and descriptions, NOT the text inside pages.
`grep_pages`	★ Searches the actual text of pages with a regular expression, by fetching them and matching locally.
`get_page_tree`	★ Lists the pages and folders directly under a path — the structural view a wiki has and a search does not.
`list_page_links`	Returns every page together with the internal links it contains — the wiki’s link graph for one locale.
`create_page`	★ Creates a page.
`update_page`	★ Changes a page.
`move_page`	Moves a page to another path, another locale, or both.
`delete_page`	⚠ Deletes a page and its history.
`convert_page_editor`	Changes the storage format of a page.
`list_page_history`	Lists the stored versions of a page, newest first, with who changed what and when.
`get_page_version`	Returns a single historical version of a page, including its full body as it was then.
`diff_page_versions`	Returns a unified diff between two versions of a page — or between one version and the page as it is now, if to_version is omitted.
`get_page_conflict`	Returns the version of a page that is newer than the one you read — what update_page points at when it refuses to write.
`restore_page_version`	Rolls a page back to a stored version.
`list_tags`	Every tag in the wiki, with its display title and when it was last used.

The full reference, with every parameter, is at wikijs-mcp.ni-c.de/reference/tools.

Two things worth knowing before you use `search_pages`

Wiki.js' default search engine does not index page content. "Database - Basic" matches titles and descriptions only, so searching for a phrase written inside a page returns nothing at all. search_pages reports which engine is active and says so; grep_pages fetches pages and matches their text locally, which is slower and actually finds things. Switching the wiki to the PostgreSQL or Elasticsearch engine and running rebuild_search_index fixes it properly.

update_page refuses to overwrite somebody else's edit. It compares the page against the moment you read it, not against its own read a millisecond earlier, so an edit saved from the web UI while the model was thinking is caught rather than silently discarded. get_page_conflict shows the newer version; force: true overwrites on purpose.

Not exposed, on purpose

No tool that creates an API key. Wiki.js can do it over GraphQL, and this server deliberately cannot: a model able to mint a full-access key could grant itself everything the three narrowing mechanisms above take away.

Reads are never path-scoped. WIKIJS_ALLOWED_PATHS confines writes only — a scope on reads turns a wiki into a confusing half-wiki, and the key's own group and page rules are the right place to hide pages, because they apply to everything else using that key too.

Safety

Destructive and administrative tools ask a person. Where the client supports MCP elicitation they raise a real dialog that the model cannot answer on its behalf. Where it does not, the first call returns a short-lived token bound to the exact target and only a second call carrying it performs the operation — which proves the call was made twice with the same arguments and nothing more, and the text says so. The binding includes everything that decides what is touched — an approval for migrate_pages_locale from de to en will not run en to de. ELICITATION=false takes the fallback deliberately; it never removes the guard.
Three maintenance tools are deliberately not gated. flush_page_cache, rebuild_page_tree and rebuild_search_index cost time, not content. A dialog in front of an operation that loses nothing is how people learn to tick without reading.
Confirmation prompts never quote content from Wiki.js. Page titles and descriptions are written by anyone with edit rights, and that text is read by a model. Only ids, paths and server-side values appear, and a path is checked to be an identifier before it is interpolated.
Returned page content is marked as untrusted data, because a wiki is exactly a place where text is stored to be read later.
There is no tool that creates an API key, although the Wiki.js API offers one: a model able to mint a full-access key could grant itself administrative access that outlives this session. list_api_keys and revoke_api_key are here so keys can be audited and taken away.
Credentials are deleted from the environment after startup, secrets in API responses are redacted, error bodies are truncated and HTML error pages dropped.
WIKIJS_READ_ONLY=true does not register the write tools at all, and WIKIJS_DENY_TOOLS cuts finer along the same line — a filtered tool is never built, not refused at call time.

Documentation

The full guide, tool reference and security notes live at wikijs-mcp.ni-c.de (source in docs/).

Development

npm install
npm run lint && npm run typecheck && npm run build && npm test

The unit suite drives the built server over the real MCP protocol against a fake Wiki.js, so no instance is needed; npm run test:integration is the separate suite that brings a real Wiki.js up in Docker and exercises every tool against it. The architecture diagram and social card are generated — edit docs/assets/architecture.source.svg and run npm run assets, never the rendered copies — and npm run docs:tools regenerates the tool reference from the catalogue.

Releasing

Add the CHANGELOG entry and bump package.json.
npm run lint && npm run build && npm run test:coverage
Commit, then push a signed tag: git tag -s vX.Y.Z -m "vX.Y.Z" && git push origin main vX.Y.Z

The release workflow publishes to npm (Trusted Publishing, with provenance), creates the GitHub release from the CHANGELOG section and updates the MCP Registry entry.

Contributing

Issues, discussions and pull requests are welcome — see CONTRIBUTING.md. For vulnerabilities please use private reporting rather than a public issue; the policy is in SECURITY.md.

Add this server

Host a copy with our keys and logs.

Server facts

Tools

Questions

How do I install Wiki.js?

Does Wiki.js need an API key?

What transport does Wiki.js use?

When was Wiki.js last checked?

Documentation

wikijs-mcp

What makes it different

Requirements

Configuration

Choosing which tools load

Confining writes to part of the wiki

Installation

Claude Code

Claude Desktop

Codex

Docker

Through mcp-hub

Tools

Two things worth knowing before you use search_pages

Not exposed, on purpose

Safety

Documentation

Development

Releasing

Contributing

License

Two things worth knowing before you use `search_pages`