@ppantiru and @MichaelHamann have been working on an MCP server extension for XWiki. There has been some notable progress over the past couple of months.
Version 0.9 of the MCP Server (BETA) extension has support for querying wiki pages through Solr, as well as reading, editing & creating pages. The extension is standalone (it no longer depends on the LLM Application to function). Though, installing the LLM Application does give you access to MCP tools for querying collections.
If you’re willing to build the extension from source, you can also try out MCP tools for page translations, and for working with objects and classes (let AI agents create AWMs).
Please note that the MCP server extension is still under heavy development, therefore things are expected to break, and/or not work properly. You MUST NOT use the extension in a production XWiki instance.
Now that the disclaimer is out of the way, if you’re still interested in trying out the extension, you can find documentation on the following pages:
If you find any problems with the extension, the documentation, or anything else, please report them.
You can report issues by either replying to this forum post, or by opening issues on the LLMAI JIRA.
This is great! Well done. Thx everyone for working on this
PS: @gabrielc Do we have a blog post about it? I checked quickly but didn’t see it (maybe I missed it). The contrib release process includes a blog post normally
PS2: Shouldn’t this be announced in the Help/Discuss category so that xwiki users are aware of it and could try it? (or do you think it’s too early?)
We initially postponed the blog post so that we could finish the documentation, but I forgot to do it after. I’ll make one in a moment, thank you for the reminder .
I’d say it’s still a bit early. What is currently released is minimal, and what’s on the main branch is still being actively developed. I’ll maybe make a new forum post later in the year (after more stuff gets stabilized and released), and I’ll put that under Help/Discuss.
That’s awesome news, thanks for making progress here! I’d like to raise question on a design choice you’ve made, whether it was conscious or not or maybe I misunderstood certain things. @ppantiru and @MichaelHamann tagging you as I’m not sure you’re monitoring this thread.
When writing to the Wiki, users have to authenticate against the MCP server using the configured authentication scheme. That’s great! However, taken from here:
Content an agent saves has the MCP user as its content author.
I would like to question this approach and understand your thought process behind that. My concerns with that are:
The documentation (correctly) warns that you should not give programming rights to the MCP user. That doesn’t prevent all other privilege escalation though:
Users with read-only access could authenticate against the MCP server and suddenly gain write access
There might be complex permissions in place, with page level restrictions. For example, some users may not be able to see certain pages. Even with write access disabled, would they suddenly be able to see / query all those pages through the MCP server, given it runs as its own user?
Any kind of audit capabilities are lost, since we do not know anymore which user changed a certain page (using the agent as a tool).
I’m a strong advocate for considering LLMs as a tool, but the ultimate responsibility lies with the user using them. As such, all actions (through the use of LLM or not) should (a) be executed with the user permissions executing the actions and (b) be attributable to that user from an audit / change management perspective.
I think you might have misunderstood something. There is no dedicated “MCP user” unless you explicitly create one. In the documentation, “MCP user” refers to whatever user account you used when authenticating in your MCP client. While you could create a dedicated account for that, the assumption is that normally, the user who uses the MCP server uses their own account, so any view or edit access is checked against that user’s permissions and all edits can be attributed to that user. The warning in the documentation is regarding the fact that when an admin user with script/programming right uses the MCP server, the MCP client gains all rights of that user which can be dangerous, so in that case, an account without such rights (that could still be a personal account, not a generic “MCP user” account) should be used to authenticate the MCP client.
thanks for coming back. Indeed I misunderstood, and glad that’s the case. May I suggest a bit better phrasing of the documentation then? Currently, it states (without further context)
Security recommendation
Create a dedicated wiki user for MCP access with only the rights the use case requires. Do not grant programming or admin rights to the MCP user.
Now I understand what it means, you can easily read it the way you intended it to be read. It can also be read differently. Maybe something along the lines of:
Security recommendation
The MCP client inherits all permissions from the authenticated user (called MCP user), potentially including the script / programming or admin right. In such cases, we recommend to create a dedicated wiki user for MCP access with only the rights the use case requires. Do not grant programming or admin rights to the MCP user.
