mediawiki-mcp
An MCP server for MediaWiki instances with multi-wiki support, providing full read/write access via REST and Action APIs across multiple named wikis.
Caution. Specific findings reduced this grade. They are listed on the page. Grades reflect the full trust pyramid: code, verification depth, and reputation. New projects cap at C until adoption is earned.
How we verified
Verified is a snapshot. Live keeps it current, and builds your track record.
⚡ Connect GitHub → continuous verification on every pushwhy connect →Who stands behind it
ttpears
Source: Glama
Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find. Or connect your repo for our deepest verification, Live Monitored: read-only, revoke anytime. What we access →
Install from
The grade above is for the source repository. Registries can serve a different version, so we mark the ones we were not able to read.
These names and descriptions are the publisher's own, read from the source code. We print them as written. Our assessment is the findings above, not this list.
get-recent-changesGet a feed of recent edits, page creations, and log events across wikis. Returns timestamps, change types, page titles, authors, size deltas, and edit summaries. Useful for monitoring wiki activity.
list-categoriesList all categories on the wiki with page/subcat/file counts. Use prefix to filter by name prefix. Useful for discovering how content is organized.
get-category-membersList all pages, subcategories, or files within a specific category. Returns member titles and IDs. Use type to filter (page/subcat/file).
get-fileGet metadata and download URLs for an uploaded file (image, PDF, etc). Returns dimensions, file size, media type, and both original and preferred-format URLs.
upload-fileUpload a file to the wiki from base64-encoded data. Provide the file content as a base64 string.
upload-file-from-urlUpload a file to the wiki by fetching it from a URL. The wiki server downloads the file directly from the source URL.
get-page-historyGet the revision history of a wiki page. Returns a list of revisions with IDs, timestamps, authors, size changes, and edit summaries. Use older_than to paginate through long histories.
get-revisionGet details for a specific revision by ID. Returns the page title, timestamp, author, size, byte delta, and edit comment.
get-page-linksGet outgoing links from a page (direction="from") or find all pages that link to it (direction="to", i.e. backlinks). Returns link titles and namespaces.
get-pageRetrieve a wiki page's full wikitext source and metadata. Returns the page title, ID, content model, latest revision ID/timestamp, and the raw wikitext source. Call this BEFORE update-page to read the current content you want to edit.
create-pageCreate a new wiki page with wikitext content. The page must not already exist — use update-page to modify existing pages.
update-pageUpdate an existing wiki page. WORKFLOW: First call get-page to read the current wikitext source, then call this tool with your changes. EDIT MODES (use exactly one): • diff: Preferred for targeted edits. Provide a unified diff (with @@ hunk headers and context lines) — the server fetches current co…
delete-pageDelete a wiki page permanently. This requires admin/sysop rights on the wiki.
undelete-pageRestore a previously deleted wiki page. This requires admin/sysop rights on the wiki.
find-pageUnified page locator. Tries exact title (following redirects), then title-prefix match, then full-text search, across all registered wikis by default. Returns a single ranked list where exact/redirect hits come before prefix hits, which come before full-text hits. Use this as the first step whenever…
search-pageFull-text search across wiki pages. Returns matching page titles, IDs, and text excerpts. Use this to find pages when you don't know the exact title.
search-page-by-prefixSearch for pages by title prefix (autocomplete-style). Returns matching page titles and IDs. Faster than full-text search when you know the beginning of the page title.
add-wikiRegister a new MediaWiki instance so you can read and edit its pages. Provide the wiki base URL and optional bot credentials. After adding, use the wiki name in other tools' "wiki" parameter.
remove-wikiUnregister a wiki so it is no longer accessible. Does not affect the wiki itself — only removes it from this session.
set-wikiSet the default wiki. When multiple wikis are registered, this determines which wiki is used when the "wiki" parameter is omitted from other tool calls.
list-wikisList all registered wikis with their URLs, auth status, and which is the default. Call this first if you're unsure which wikis are available.
Disclosed vulnerabilities in this server's declared npm dependencies (via OSV). Whether each is reachable depends on the installed versions.
When Vitest UI server is listening, arbitrary file can be read and executed
@modelcontextprotocol/sdk has cross-client data leak via shared server/transport instance reuse
Anthropic's MCP TypeScript SDK has a ReDoS vulnerability
axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `config.proxy`
axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollution Gadget in Config Merge
Tool annotations
No tools have read-only/destructive annotations
Add readOnlyHint or destructiveHint annotations to every tool so hosts can warn users before invoking.
All four hints declared on every tool
21/21 tools missing one or more hints — get-recent-changes (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); list-categories (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); get-category-members (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint), +18 more. OpenAI's directory rejects tools where any of the four hints are missing or non-boolean.
For every tool, set all four hints (readOnlyHint, destructiveHint, idempotentHint, openWorldHint) to explicit true/false values that match the handler’s actual behaviour.
Tool test coverage
11/21 tools referenced in tests (52%)
Write tests that reference each tool by name so every tool has at least one test.
Production dependencies are patched
0 critical, 13 high severity in production deps — @modelcontextprotocol/sdk@1.25.1 (high), @modelcontextprotocol/sdk@1.25.1 (high)
Run npm audit fix, or upgrade the affected packages to a non-vulnerable version.
Dev dependencies
1 critical/high in dev-only deps (does not ship to users)
Upgrade dev dependencies when convenient.
Claim the listing to review these findings one by one and send us a correction where you disagree, straight to the team. Claiming also means we tell you when the grade moves, and reach you first if we find anything urgent.
[](https://m8ven.ai/mcp/ttpears/mediawiki-mcp)?variant=verified from the URL.Vetting this one by hand? Tool Check is an MCP that scores other MCPs. Add it once and ask Claude, ChatGPT, or any MCP client to grade a server, surface CVEs, check the publisher, and suggest safer alternatives — before you install.
https://m8ven.ai/api/mcp/tool-check