Back to MCP Trust Indexm8ven
58
/ 100
25 days ago
glama

mcp-wikijs-mv

MCP server for Wiki.js with full GraphQL API coverage, fine-grained permissions, multi-user support, and deployable on Vercel.

→ janschachtschabel/mcp-for-wiki-js· listed on glama
Is this your MCP?

Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find.

Install from

Glama

M8ven verifies MCPs across every public registry — install directly from whichever one you prefer.

// key findings
⚠️
Known vulnerabilities in dependencies: 7 high
Affects packages this MCP installs at runtime. Upgrade or remove the affected dependency.
✅
No credential exfiltration, no sensitive file access, no obfuscation
Static analysis found nothing flowing your secrets to unexpected places.
✅
Open source with a license and README
Anyone can audit the code, the license is declared, and the publisher documents what it does.
🔐
You'll be asked for 1 credential: WIKIJS_TOKEN
These are read from process.env at runtime. Make sure you trust where they’ll be sent.
// known CVEs in dependencies7 high2 medium7 low

Disclosed vulnerabilities in this server's declared npm dependencies (via OSV). Whether each is reachable depends on the installed versions.

high@modelcontextprotocol/sdk@1.25.2GHSA-345p-7cg4-v4c7

@modelcontextprotocol/sdk has cross-client data leak via shared server/transport instance reuse

highmcp-handler@1.0.7GHSA-w2fm-25vw-vh7f

mcp-handler has a tool response leak across concurrent client sessions ('Race Condition')

highnext@14.2.35GHSA-36qx-fr4f-26g5

Next.js has a Middleware / Proxy bypass in Pages Router applications using i18n

highnext@14.2.35GHSA-8h8q-6873-q5fj

Next.js Vulnerable to Denial of Service with Server Components

highnext@14.2.35GHSA-c4j6-fc7j-m34r

Next.js vulnerable to server-side request forgery in applications using WebSocket upgrades

Depend on this server? Get alerted when its CVEs change.Watch this server free →
// required environment variables
This server reads these from process.env. You'll be asked to provide them before it can run.
configWIKIJS_AUDIT— nein true Audit-Log für write/delete/admin (false = aus; nie Secrets)
configWIKIJS_MAX_CONCURRENCY— nein 8 Max. parallele Upstream-Requests (Overload-Schutz; queued/sheddet bei Überlast)
configWIKIJS_MCP_VERBOSE— nein false MCP-Request-Logging (true)
configWIKIJS_PERMISSION_PRESET— Single-Tenant — eine feste Instanz für alle WIKIJS_URL + WIKIJS_TOKEN (+ optional ) nichts (nur die URL …/mcp)
configWIKIJS_PROFILES— Mehrbenutzer (empfohlen) — viele Nutzer, je eigener Key/Rechte (+ optional WIKIJS_PERMISSION_PRESET) ihren geheimen Handle
configWIKIJS_RETRIES— nein 2 Retry nur bei Connection-Fehlern (sicher auch für Mutationen)
configWIKIJS_ROLES— nein – JSON, das die Rollen-Definitionen zur Laufzeit überschreibt (Form wie config/roles.json)
configWIKIJS_TIMEOUT_MS— nein 30000 Timeout pro GraphQL-Request (AbortController)
🔐 secretWIKIJS_TOKEN— .env: WIKIJS_URL + setzen (siehe .env.example)
configWIKIJS_URL— .env: + WIKIJS_TOKEN setzen (siehe .env.example)
configWIKI_URL
// full audit trail
The full breakdown of what we checked, the deductions that landed, the network hosts, the dependency advisories, and concrete fix guidance is available to verified publishers.
// improvement guidance — verified publishers only
We have 2 concrete improvements we can share with the publisher of this MCP. Each comes with specific guidance to raise the trust score.
// embed badge in your README
[![M8ven Score](https://m8ven.ai/badge/mcp/janschachtschabel-mcp-for-wiki-js-1owe60)](https://m8ven.ai/mcp/janschachtschabel-mcp-for-wiki-js-1owe60)
commit: 14ab73d463ab9a3882fd2177538935472add3c14
code hash: dfb6d8639ede15f3751af253df729a6b8cfdd099ce07887fdb192c3edb2c5eb2
verified: 7/6/2026, 10:38:53 AM
view raw JSON →