MCP User Permissions
Explanation
An MCP client acts as the wiki user it authenticated as, the MCP user, and inherits that account's rights in full. The server adds no permission of its own: tool selection, the space filter and cross-wiki reach can only narrow what an agent reaches, never widen it beyond what the account already allows.
That makes the choice of account the strongest control an administrator has, and it is why a personal admin account is the wrong one to hand to an agent.
Why a dedicated account
An agent is driven by text it reads, and some of that text comes from the wiki itself or from the web. Anything that text persuades it to do, it does with the MCP user's rights. A dedicated account holding only the rights one use case needs bounds that blast radius, and it separates the agent's edits from a person's in the history.
The rights to withhold
Do not grant an MCP user script, programming or admin rights on a production instance. With any of them, a page an agent writes can execute script macros when anyone views it, which turns a prompt injection into code execution: {{velocity}} needs only script right, {{groovy}} needs programming right, and admin and programming both imply script. Write Tools Risk follows that path in detail.
What the wiki records
Content an agent saves carries the MCP user as its content author, and every version comment the server writes starts with [AI]. Saves are minor edits by default, so iterative agent writes do not clutter the default history view; a creation is always a major version, and an agent may ask for a major version explicitly. A dedicated account therefore also makes the agent's changes reviewable as a group.
