MediaWiki MCP Server

An MCP (Model Context Protocol) server that enables Large Language Model (LLM) clients to interact with any MediaWiki wiki.

Features

Tools

Every tool that operates on a wiki accepts an optional `wiki` argument naming the wiki to act on (the wiki-management and OAuth tools do not) — pass a wiki key (e.g. `en.wikipedia.org`) or the full `mcp://wikis/{wikiKey}` URI. Omit it to use the configured default wiki (see Configuration). Each tool response reports the wiki the call ran against.

Page reads

Page writes

Wiki management

OAuth

Extension packs

Each pack's tools register only on wikis where its extension is installed.

**NeoWiki**

**Semantic MediaWiki**

**Bucket**

**Cargo**

**Wikibase**

Resources

`mcp://wikis/{wikiKey}` — per-wiki resource exposing `sitename`, `server` (the wiki's public address), `articlepath`, `scriptpath`, and the `private` and `readOnly` flags.

• Those fields are the whole of it: the resource publishes a fixed list, so credentials and server-side settings in your configuration file are never exposed in resource content.
• After `add-wiki` or `remove-wiki`, the server sends `notifications/resources/list_changed` so clients refresh.

Example read result

{
  "contents": [
    {
      "uri": "mcp://wikis/en.wikipedia.org",
      "mimeType": "application/json",
      "text": "{ \"sitename\":\"Wikipedia\",\"server\":\"https://en.wikipedia.org\",\"articlepath\":\"/wiki\",\"scriptpath\":\"/w\",\"private\":false }"
    }
  ]
}

Environment variables

The variables below are relevant to any setup. Variables that only apply when self-hosting the HTTP transport (ports, timeouts, Host/Origin and SSRF guards) or running the hosted OAuth proxy are in docs/deployment.md — environment variables. Config-file substitution and upload-directory variables are in docs/configuration.md.

Configuration

> [!NOTE]

> Config is only required when interacting with a private wiki or using authenticated tools.

Create a `config.json` file to configure wiki connections. Use the `config.example.json` as a starting point.

{
  "defaultWiki": "en.wikipedia.org",
  "wikis": {
    "en.wikipedia.org": {
      "sitename": "Wikipedia",
      "server": "https://en.wikipedia.org",
      "articlepath": "/wiki",
      "scriptpath": "/w"
    }
  }
}

Internal vs public address. The `server` you configure may be an internal hostname (e.g. `http://mediawiki` in Docker); URLs handed back to the caller are built from the wiki's public address, so internal hostnames don't leak into links. See docs/configuration.md — per-wiki fields.

For the full field reference, env-var substitution, secret sources, change tags, upload directories, and authentication options, see docs/configuration.md.

Authentication

Tools marked 🔐 require authentication. Write tools (including extension-pack writes) are hidden from `tools/list` when the configured default wiki has `readOnly: true` — see Deployment.

• Browser-based OAuth (recommended). Sign in through a browser tab the first time a tool needs auth. Set `oauth2ClientId` and `oauth2CallbackPort` per wiki — see docs/configuration.md — OAuth (browser-based).
• Per-request bearer token (HTTP), deprecated. Each request carries `Authorization: Bearer ` and the server forwards it to MediaWiki. Off by default, because an MCP server must not accept tokens that were not issued for it. See docs/deployment.md — per-request bearer token.
• Hosted OAuth proxy (HTTP). The server fronts one MediaWiki consumer as an OAuth 2.1 Authorization Server, so an OAuth-aware client signs each user in — no manual tokens. Point it at `https:///mcp`; anonymous read still works. See docs/deployment.md — hosted OAuth sign-in.
• Manual OAuth2 access token. Paste a long-lived token into `config.json`. See docs/configuration.md — manual OAuth2 access token.
• Bot password. Fallback when Extension:OAuth isn't installed. See docs/configuration.md — bot password.

The Cargo tools (`cargo-query`, `cargo-list-tables`, `cargo-describe-table`) call API actions gated by the `runcargoqueries` user right. Most wikis grant this to all users by default; wikis that restrict it require the `Create, query and delete data through the Cargo extension` grant on the bot password or OAuth consumer. The Cargo extension is also detected on wiki.gg-hosted wikis (Helldivers, Terraria, Ark, etc.), where it ships under the rebranded name `LIBRARIAN`.

Installation

Pick your client below, or use the standard configuration if it is not listed. `CONFIG` is optional; without it the server targets English Wikipedia. To point it at your own wiki and set up authentication for writes, see docs/configuration.md.

Claude Code

Add this repository as a plugin marketplace, then install the bundled server:

/plugin marketplace add ProfessionalWiki/MediaWiki-MCP-Server
/plugin install mediawiki-mcp-server@professional-wiki

The plugin takes an optional configuration file, which points the server at your own wiki. Set it from the prompt when enabling the plugin, or at any time with `/plugin configure mediawiki-mcp-server@professional-wiki`. A command-line install takes the same value via `claude plugin install mediawiki-mcp-server@professional-wiki --config configPath=path/to/config.json`.

When installed as a plugin, the tools are namespaced `mcp__plugin_mediawiki-mcp-server_mediawiki__`; update any tool allowlists or hooks accordingly.

To configure the server directly instead, see the Claude Code MCP docs. The short version:

claude mcp add mediawiki-mcp-server -- npx -y @professional-wiki/mediawiki-mcp-server@latest
# Environment variables go before the `--`:
claude mcp add mediawiki-mcp-server -e CONFIG=path/to/config.json -- npx -y @professional-wiki/mediawiki-mcp-server@latest

Codex

Add this repository as a plugin marketplace, then install the bundled server:

codex plugin marketplace add ProfessionalWiki/MediaWiki-MCP-Server
codex plugin add mediawiki-mcp-server@professional-wiki

To point the plugin at your own wiki, set `CONFIG` in the shell you launch Codex from, for example `export CONFIG=path/to/config.json`. Codex has no per-plugin configuration; if you would rather not set an environment variable, `codex mcp add mediawiki --env CONFIG=path/to/config.json -- npx -y @professional-wiki/mediawiki-mcp-server@latest` registers the server directly and takes precedence over the plugin's copy.

See the Codex plugins documentation for how to list, update, or remove plugins.

Claude Desktop

Download MediaWiki-MCP-Server.mcpb and double-click it to install the extension, which prompts for a configuration file path so you can point it at your own wiki instead of English Wikipedia.

VS Code and Cursor

Or add the standard configuration by hand.

Antigravity

Add the standard configuration to Antigravity's MCP config, either globally in `~/.gemini/config/mcp_config.json` or per-workspace in `.agents/mcp_config.json`.

If you previously installed the Gemini CLI extension, Antigravity's setup wizard offers to import your existing Gemini CLI configuration.

OpenCode

OpenCode uses its own configuration shape rather than `mcpServers`; add this to `opencode.json` in your project root, or `~/.config/opencode/opencode.json` for a global install.

{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "mediawiki-mcp-server": {
      "type": "local",
      "command": ["npx", "-y", "@professional-wiki/mediawiki-mcp-server@latest"],
      "environment": {
        "CONFIG": "path/to/config.json"
      }
    }
  }
}

Standard configuration

Most clients read the same server block. Paste it into the file listed for your client, replacing `mcpServers` with that client's root key:

{
  "mcpServers": {
    "mediawiki-mcp-server": {
      "command": "npx",
      "args": ["-y", "@professional-wiki/mediawiki-mcp-server@latest"],
      "env": {
        "CONFIG": "path/to/config.json"
      }
    }
  }
}

For any other client, `npx add-mcp @professional-wiki/mediawiki-mcp-server` may work: add-mcp is a community CLI that writes your client's configuration file for you. It sets the launch command only; add `CONFIG` yourself to point at your own wiki.

Deployment

Running the server as a remote HTTP endpoint for other users has its own configuration requirements — see docs/deployment.md. A pre-built image is published at `ghcr.io/professionalwiki/mediawiki-mcp-server`. For day-2 operations (logs, `/health`/`/ready`, metrics, graceful shutdown), see docs/operations.md.

Security

Defaults are safe for single-user use. Before exposing the HTTP transport to others, lock down three things:

• Terminate TLS at your reverse proxy. Don't expose the MCP port directly on an untrusted network. See docs/deployment.md — security checklist.
• Pair `MCP_BIND` with `MCP_ALLOWED_HOSTS` and `MCP_ALLOWED_ORIGINS`. The HTTP transport binds to `127.0.0.1` by default. When you open it up with `MCP_BIND=0.0.0.0`, set `MCP_ALLOWED_HOSTS` to the hostnames your proxy forwards and `MCP_ALLOWED_ORIGINS` to the browser origins allowed to call the server — these block DNS-rebinding and cross-origin attacks respectively.
• Uploads are opt-in. `upload-file` is disabled until you list allowed directories in `uploadDirs` or `MCP_UPLOAD_DIRS`. See docs/configuration.md — upload directories.
• Internal destinations need `MCP_TRUSTED_HOSTS`. Outbound fetches are SSRF-guarded: a destination resolving to a private or loopback address (e.g. a Docker-network alias like `mediawiki.svc`) is refused until you list its host in `MCP_TRUSTED_HOSTS`. See docs/deployment.md — outbound SSRF guard.

Report a vulnerability via GitHub's security advisory form — full policy in SECURITY.md.

Contributing

Contributions are welcome — pull requests and issues (bugs, feature requests, suggestions) both work.

• Working on tool code? Start from AGENTS.md for repo layout, commands, and testing patterns.
• Adding or modifying a tool? Read docs/tool-conventions.md — it covers description voice, parameter docs, annotation hints, and MediaWiki terminology conventions.
• Running a release? See docs/releasing.md.

License

This project is licensed under the MIT License. See the LICENSE file for details.