wiki_move_page · Wiki Js MCP: Risk & Policy

WHAT IT DOES

What wiki_move_page does on Wiki Js

AI agents use wiki_move_page to create or update resources in Wiki Js — usually the action step of a workflow, after the agent has gathered context. Every call changes real data in your Wiki Js environment.

WHY IT NEEDS A POLICY

Why wiki_move_page needs a policy

Moving or renaming a page is a reversible write operation that changes metadata (path/title) but preserves the underlying content. It can be undone by moving the page back. While it has broader impact than a simple update (affecting navigation, links, and references), it does not meet the threshold for Destructive (which requires irreversibility) nor Execute (which requires code/command execution).

From the tool's definition Tool name and description explicitly state 'Move/rename a wiki page to a new path.' This modifies the location and identity of an existing page but does not delete data or create new independent copies.

Attacks that exploit this kind of access

Recommended rule Ready

Verdict

wiki_move_page Rate-limited

wiki_move_page stays usable, but capped — an agent stuck in a loop can't make hundreds of changes a minute. Everything else on the server is denied unless you say otherwise.

View as policy code

policy.json

{
  "version": "1",
  "default": "deny",
  "tools": {
    "wiki_move_page": {
      "limits": [
        {
          "counter": "wiki_move_page_rate",
          "window": "minute",
          "max": 30,
          "scope": "grant"
        }
      ]
    }
  }
}

LIMIT THIS TOOL →

Instant setup, no code required.

PolicyLayer is an MCP gateway: every tool call is checked against your rule before it reaches Wiki Js, so you can run agents against it safely.

FAQ

Questions about wiki_move_page

What does the wiki_move_page tool do? +

Move/rename a wiki page to a new path. It is categorised as a Write tool in the Wiki Js MCP Server, which means it can create or modify data. Consider rate limits to prevent runaway writes.

How do I enforce a policy on wiki_move_page? +

Register the Wiki Js MCP server in PolicyLayer and add a rule for wiki_move_page: allow, deny, rate-limit, or require approval. Point your MCP client at the PolicyLayer proxy URL and the rule is enforced on every call, before it reaches Wiki Js. Nothing to install.

What risk level is wiki_move_page? +

wiki_move_page is a Write tool with medium risk. Write tools should be rate-limited to prevent accidental bulk modifications.

Can I rate-limit wiki_move_page? +

Yes. Add a rate_limit block to the wiki_move_page rule in your PolicyLayer policy. For example, setting max: 10 and window: 60 limits the tool to 10 calls per minute. Rate limits are tracked per agent session and reset automatically.

How do I block wiki_move_page completely? +

Set action: deny in the PolicyLayer policy for wiki_move_page. The AI agent will receive a policy violation error and cannot call the tool. You can also include a reason field to explain why the tool is blocked.

What MCP server provides wiki_move_page? +

wiki_move_page is provided by the Wiki Js MCP server (osianet/wiki-js-mcp). PolicyLayer sits as a proxy in front of this server to enforce policies before tool calls reach the server.