Wiki.js Plugin: Privacy and Security
Privacy and security of the Wiki.js plugin: where the API token is stored, which data goes into the local SQLite database, which connections the plugin makes and which permissions are needed.
Wiki.js Plugin: Privacy and Security
This documentation always describes the latest published version.
Where does data go?
| Target | What | When |
|---|---|---|
Your Wiki.js instance (WIKIJS_API_URL) |
Token as bearer header, page content, titles, descriptions, paths, tags, search terms | on every Wiki.js tool |
| Local SQLite file | Path, language, source project, ref, note, timestamps | when sourceRepo, sourceRef or summary are set, and on wikijs_mark_verified |
| Claude (the model) | Everything a tool returns, including page content that was read | on every tool result |
The server makes no outgoing connections other than the GraphQL requests to the configured URL. There is no telemetry in the plugin code.
API token
- The token sits in plain text in
~/.wikijs-plugin/.env. The setup skill only copies the template and does not set restricted file permissions. - At startup the token is loaded into the environment of the MCP server process and kept for its lifetime.
- It is only sent as an
Authorization: Bearerheader to the configured URL. The plugin does not enforce HTTPS, so make sureWIKIJS_API_URLstarts withhttps://. - The token is written neither to the database nor into page content.
Restrict the file permissions of
~/.wikijs-plugin/.envto your user and never commit the file to a repository.
Required permissions
According to the template the token needs read:pages, write:pages and manage:pages. If you only want to read and write, you can leave out manage:pages and give up deleting and moving. Create a separate token with its own name for the plugin so you can revoke it independently.
Local database
The file ~/.wikijs-plugin/wikijs-plugin.db holds, per entry, page path, language, source project, ref, short note, timestamp, the verified flag and the updatedAt of the page. Page content and credentials are not in it. Source project, ref and note are never written into page content or description, they stay local. The file is per machine and is not synchronised. If you delete it, you lose history and verified markers, the Wiki.js pages stay untouched.
Destructive actions
wikijs_delete_page deletes permanently and is flagged as destructive. wikijs_update_page replaces the entire content. As a safeguard the server refuses updates that cut the content to less than half unless you set confirmContentShrink.
Always have Claude confirm deleting and moving with you before you allow them.