// SCAN REPORT

Mcp Wikijs Mv

64 tools. 35 can modify or destroy data without limits.

11 destructive tools with no built-in limits. Policy required.

Last updated: 2 Jul 2026

35 can modify or destroy data

29 read-only

64 tools total

Community server · catalogue entry verified 02/07/2026

How to control Mcp Wikijs Mv ↓

TOOL MAP

What Mcp Wikijs Mv exposes to your agents

Read (29) Write / Execute (24) Destructive / Financial (11)

Running more than one server? Check your whole stack →

MOST DANGEROUS TOOLS

Critical Risk

The most dangerous Mcp Wikijs Mv tools

Destructive · High wiki_apikey_revoke Revoking an API key is an irreversible action that permanently invalidates credentials. Destructive · High wiki_asset_delete This tool permanently removes files/assets and cannot be undone. Destructive · High wiki_group_delete This tool irreversibly deletes a group by its ID. Destructive · High wiki_page_delete This tool irreversibly removes data (a wiki page) from the system.

35 of Mcp Wikijs Mv's 64 tools can modify, destroy, or commit something on every call — and an agent calls them with no built-in limits.

POLICY

How to control Mcp Wikijs Mv

PolicyLayer is an MCP gateway — it sits between your AI agents and Mcp Wikijs Mv, and nothing reaches the server without passing your rules. These are the rules we recommend:

Deny destructive operations

{
  "wiki_apikey_revoke": {
    "deny_if": [
      {
        "conditions": [],
        "on_deny": "Blocked by default. Requires approval."
      }
    ]
  }
}

Destructive tools should never be available to autonomous agents without human approval.

Rate limit write operations

{
  "wiki_apikey_create": {
    "limits": [
      {
        "counter": "wiki_apikey_create_per_hour",
        "window": "hour",
        "max": 30,
        "scope": "grant"
      }
    ]
  }
}

Prevents bulk unintended modifications from agents caught in loops.

Cap read operations

{
  "wiki_apikeys_list": {
    "limits": [
      {
        "counter": "wiki_apikeys_list_per_minute",
        "window": "minute",
        "max": 60,
        "scope": "grant"
      }
    ]
  }
}

Controls API costs and prevents retry loops from exhausting upstream rate limits.

Create a free account and register Mcp Wikijs Mv — nothing to install.
Add these rules — paste them, or build them visually. Tune the limits to your setup.
Point your MCP client (Claude, Cursor, anything) at your gateway URL.

ENFORCE POLICY ON MCP WIKIJS MV →

Instant setup, no code required.

FULL CATALOGUE

All 64 Mcp Wikijs Mv tools

DESTRUCTIVE 11 tools

Destructive wiki_apikey_revoke Revoke a Wiki.js API key by id. Destructive wiki_asset_delete Delete an asset (file) by id. Destructive wiki_assets_flush_temp Flush temporary/abandoned uploads. Destructive wiki_comment_delete Delete a comment by id. Destructive wiki_group_delete Delete a group by id. Destructive wiki_page_delete Permanently delete a single page, identified by id OR path+locale. Destructive wiki_pages_delete_batch Delete multiple pages by ids, by paths, and/or by a wildcard path pattern (e.g. Destructive wiki_pages_delete_tree Delete a page subtree under rootPath. mode: Destructive wiki_pages_purge_history Purge page version history older than a duration (e.g. Destructive wiki_tag_delete Delete a tag by id. Destructive wiki_user_delete Delete a user. Content owned by the user is reassigned to replaceId.

EXECUTE 4 tools

Execute wiki_auth_set_api_state Enable or disable the Wiki.js GraphQL API globally. Execute wiki_graphql Run an arbitrary Wiki.js GraphQL query or mutation. Use for any operation not covered by a Execute wiki_page_render Re-render a page (rebuild its cached HTML output). Execute wiki_pages_rebuild_tree Rebuild the internal page tree (repairs folder structure).

WRITE 20 tools

Write wiki_apikey_create Create a new Wiki.js API key. The full secret is only returned once. Write wiki_asset_create_folder Create a new asset folder. Write wiki_asset_rename Rename an asset (file). Write wiki_asset_upload Upload a file/image into an asset folder. Pass the file content base64-encoded in contentBase64. Write wiki_comment_create Post a comment on a page (rate-limited by Wiki.js to ~1 per 15s). Write wiki_comment_update Edit a comment. Write wiki_group_assign_user Add a user to a group. Write wiki_group_create Create a new (empty) group. Write wiki_group_unassign_user Remove a user from a group. Write wiki_group_update Update a group. Only the fields you pass change; permissions and pageRules you omit are preserved (read from t Write wiki_navigation_update_tree REPLACE the entire site navigation with the given tree (array of { locale, items: [...] }, Write wiki_page_convert Convert a page to a different editor/content type (e.g. markdown → html). Write wiki_page_create Create a new page at the given path with markdown content. Write wiki_page_move Move/rename a page (identified by id OR path+locale) to a new path and/or locale. Write wiki_page_restore Restore a page to a previous version. Write wiki_page_update Update a page by id. Either replace the whole content, or apply surgical edits=[{find,replace}] to the existin Write wiki_pages_migrate_locale Migrate all pages from a source locale to a target locale. Write wiki_tag_update Rename / retitle a tag. Write wiki_user_create Create a new user. Write wiki_user_update Update a user (email, name, password, groups, profile fields).

READ 29 tools

Read wiki_apikeys_list List Wiki.js API keys (metadata only — never the secret). Read wiki_asset_folders List sub-folders of an asset folder. Read wiki_assets_list List assets (files/images) inside an asset folder. Read wiki_auth_strategies List active authentication strategies. Read wiki_comment_get Get a single comment by id. Read wiki_comments_list List comments on a page (by path + locale). Read wiki_connection_status Check connectivity and authentication against the configured Wiki.js instance. Safe, read-only. Read wiki_group_get Get a single group including permissions, page rules and members. Read wiki_groups_list List user groups. Read wiki_navigation_get Get the site navigation tree (per locale). Read wiki_page_get Get a single page by numeric id OR by path+locale. Use metadataOnly to skip content. Read wiki_page_history Get the version/edit history trail of a page. Read wiki_page_version Get the full content of one historical version of a page. Read wiki_pages_flush_cache Flush the rendered-pages cache for the whole instance. Read wiki_pages_links List all internal links between pages for a locale (useful for finding broken links). Read wiki_pages_list List pages with optional filtering by locale/tags and ordering. Read wiki_pages_search Full-text search for pages by query string, optionally scoped to a path prefix and locale. Read wiki_pages_tree Get the hierarchical page/folder tree under a path or parent folder id. Read wiki_site_config Get the full site configuration. Read wiki_site_info Get basic site info (title, description, host). May require admin scope on some instances. Read wiki_system_flags List system feature flags. Read wiki_system_info Get system/runtime information (versions, host, database). Read wiki_tags_list List all tags defined in the wiki. Read wiki_tags_search Suggest tags matching a partial query. Read wiki_user_get Get a single user with full profile and group memberships. Read wiki_user_profile Get the profile of the currently authenticated user (the API key owner). Read wiki_users_last_logins List the most recent user logins. Read wiki_users_list List users. Read wiki_users_search Search users by name or email.

EXPLORE

Related servers

Other MCP servers with similar tools — same risk classification, starter policies for each.

FAQ

Questions about Mcp Wikijs Mv

Can an AI agent delete data through the Mcp Wikijs Mv MCP server? +

Yes. The Mcp Wikijs Mv server exposes 11 destructive tools including wiki_apikey_revoke, wiki_asset_delete, wiki_assets_flush_temp. These permanently remove resources with no undo. PolicyLayer blocks destructive tools by default so they never reach the upstream server.

How do I prevent bulk modifications through Mcp Wikijs Mv? +

The Mcp Wikijs Mv server has 20 write tools including wiki_apikey_create, wiki_asset_create_folder, wiki_asset_rename. Set a rate limit in your policy -- for example, 10 calls per hour prevents an agent from making more than 10 modifications per hour. PolicyLayer enforces this at the gateway, before calls reach Mcp Wikijs Mv.

How many tools does the Mcp Wikijs Mv MCP server expose? +

64 tools across 4 categories: Destructive, Execute, Read, Write. 29 are read-only. 35 can modify, create, or delete data.

How do I enforce a policy on Mcp Wikijs Mv? +

Register the Mcp Wikijs Mv MCP server in PolicyLayer, apply the suggested rules above (adjust the limits to your use case), and point your AI client at the PolicyLayer proxy URL instead of the server directly. Your agents keep the same tools; PolicyLayer evaluates every call against policy before it executes. Nothing to install, live in minutes.

Enforce policy on every Mcp Wikijs Mv tool call.

Deterministic rules across all 64 Mcp Wikijs Mv tools. Per-identity grants. Full audit log. Live in minutes. Nothing to install.

ENFORCE POLICY ON MCP WIKIJS MV →

Instant setup, no code required.

64 Mcp Wikijs Mv tools catalogued and risk-classified — across an index of 43,000+ MCP servers.