Deutsche Version

Back to overview

Security

The API token

• The token lives in the .env file or in the process environment. The repository excludes .env files via .gitignore, and .env.example contains only a placeholder.
• The server sends the token only as an Authorization: Bearer ... header to the configured WIKIJS_API_URL. There are no other network targets, no telemetry and no analytics calls.
• The server writes the token neither to logs nor to tool responses.
• The token carries the permissions you gave the API key in Wiki.js. The server does not restrict them any further.
• The server does not enforce HTTPS. Use an https:// URL so the token is not transmitted in clear text.

Store the .env with restricted file permissions (readable by your user only) and do not pass the token on in chats, tickets or commits. If it was exposed, revoke the key in the Wiki.js administration and create a new one.

What gets logged

The server writes to stderr only, so the stdio channel of the MCP protocol stays clean:

• at startup a status line and the hostname of the Wiki.js URL (not the full URL, not the token)
• on every tool error [<tool>] Error: <message>
• on GraphQL errors additionally the complete error list as Wiki.js returned it
• shutdown messages (SIGINT, SIGTERM, unhandled errors)

Page contents and search queries are not logged. Still, check where your MCP client stores the stderr output of servers.

Data flow

Everything a tool returns (page contents, titles, descriptions, tags) goes to your MCP client and thus to the model you use. Writing tools send the content the model produces to your wiki. Private pages get no special protection from the server: whatever the API key may read, the model can read.

Destructive operations

• wikijs_delete_page deletes permanently. The server does not ask; it only marks the tool with destructiveHint: true so a client can require confirmation.
• wikijs_update_page overwrites the entire page body and replaces tags completely.
• wikijs_move_page changes URLs that other pages or external references may point to.

Recommendations

• Create a dedicated API key for the server with as few permissions as possible. If you only need read access, do not grant write permissions.
• Enable confirmation for writing and deleting tools in your MCP client.
• Back up your wiki regularly before you allow bulk changes by a model.
• Rotate the key if machines, backups or configuration files containing the token were handed on.