.env file or in the process environment. The repository excludes .env files via .gitignore, and .env.example contains only a placeholder.Authorization: Bearer ... header to the configured WIKIJS_API_URL. There are no other network targets, no telemetry and no analytics calls.https:// URL so the token is not transmitted in clear text.Store the
.envwith restricted file permissions (readable by your user only) and do not pass the token on in chats, tickets or commits. If it was exposed, revoke the key in the Wiki.js administration and create a new one.
The server writes to stderr only, so the stdio channel of the MCP protocol stays clean:
[<tool>] Error: <message>Page contents and search queries are not logged. Still, check where your MCP client stores the stderr output of servers.
Everything a tool returns (page contents, titles, descriptions, tags) goes to your MCP client and thus to the model you use. Writing tools send the content the model produces to your wiki. Private pages get no special protection from the server: whatever the API key may read, the model can read.
wikijs_delete_page deletes permanently. The server does not ask; it only marks the tool with destructiveHint: true so a client can require confirmation.wikijs_update_page overwrites the entire page body and replaces tags completely.wikijs_move_page changes URLs that other pages or external references may point to.