89
/ 100
7 days ago
smithery
MediaWiki
Enable Large Language Model clients to interact seamlessly with any MediaWiki wiki. Perform actions such as creating, updating, and searching wiki pages, as well as retrieving file and page history information. Securely connect using OAuth 2.0 tokens to manage wiki content efficiently.
Is this your MCP?
Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find.
Install from
M8ven verifies MCPs across every public registry — install directly from whichever one you prefer.
// key findings
✅
No credential exfiltration, no sensitive file access, no obfuscation
Static analysis found nothing flowing your secrets to unexpected places.
✅
Open source with a license and README
Anyone can audit the code, the license is declared, and the publisher documents what it does.
// known CVEs in dependencies1 medium
Disclosed vulnerabilities in this server's declared npm dependencies (via OSV). Whether each is reachable depends on the installed versions.
ajv has ReDoS when using `$data` option
Depend on this server? Get alerted when its CVEs change.Watch this server free →
// required environment variables
This server reads these from
process.env. You'll be asked to provide them before it can run.config
CONFIG— Path to your configuration file config.jsonconfig
MCP_ALLOWED_HOSTSconfig
MCP_ALLOWED_ORIGINSconfig
MCP_ALLOW_STATIC_FALLBACK— Set to true to allow HTTP startup when config.json has static credentials. See [docs/deployment.md — security checklist](docs/deployment.md#security-checklist). unsetconfig
MCP_BINDconfig
MCP_CONTENT_MAX_BYTES— Byte cap for content bodies (wikitext, rendered HTML, diffs). Tune to the target LLM client's tool-response budget. 50000config
MCP_FILE_DATA_MAX_BYTES— Hard cap on the base64-encoded size of a get-file-data response. A transport/safety backstop; tune the actual size per call with the tool's width. Over-cap calls error rather than truncate. 1000000config
MCP_LOG_LEVEL— Minimum severity for logger output. One of debug, info, notice, warning, error, critical, alert, emergency, or silent. debugconfig
MCP_MAX_REQUEST_BODY— Maximum HTTP request body size (StreamableHTTP transport). Accepts size strings like 512kb or 1mb. Oversize requests get a JSON-RPC 413. 1mbconfig
MCP_METRICS— Set to true to expose Prometheus metrics at GET /metrics on the HTTP transport. unsetconfig
MCP_OAUTH2_CLIENT_IDconfig
MCP_OAUTH_CREDENTIALS_FILE— Override the default credentials store path. Default: ~/.config/mediawiki-mcp/credentials.json (Linux/macOS) or %APPDATA%\mediawiki-mcp\credentials.json (Windows). unsetconfig
MCP_OAUTH_NO_BROWSER— Set to 1 to skip launching a browser during the OAuth flow; the auth URL is logged to stderr instead. Useful in headless environments. unsetconfig
MCP_PUBLIC_URL— Override the request-derived public URL used in OAuth protected-resource discovery. Useful for reverse-proxy setups that rewrite the Host header. unsetconfig
MCP_SESSION_IDLE_TIMEOUT— Seconds an HTTP session may sit idle before it is closed and removed (StreamableHTTP transport). Any request resets the timer. 0 disables expiry. 1800config
MCP_TRANSPORT— Type of MCP server transport (stdio or http) stdioconfig
MCP_TRUSTED_HOSTSconfig
MCP_UPLOAD_DIRS— Uploads are opt-in. upload-file is disabled until you list allowed directories in uploadDirs or . See [docs/configuration.md — upload directories](docs/configuration.md#upload-directories).config
MCP_UPLOAD_MAX_BYTESconfig
PORT— Port used for StreamableHTTP transport 3000config
XDG_CONFIG_HOME// full audit trail
The full breakdown of what we checked, the deductions that landed, the network hosts, the dependency advisories, and concrete fix guidance is available to verified publishers.
// improvement guidance — verified publishers only
We have 2 concrete improvements we can share with the publisher of this MCP. Each comes with specific guidance to raise the trust score.
// embed badge in your README
[](https://m8ven.ai/mcp/professionalwiki-mediawiki-mcp-server-11b53m)commit: d297c463e61fc1ee78a6727fc74280321df3d485
code hash: ed6693fe57bc39bbf281e99b5f85e191f332782777cdb73d242d613a76150b97
verified: 7/14/2026, 8:42:56 AM