Wiki source code of Configure the MCP Server
Last modified by Eleni Cojocariu on 2026/08/10 23:36
Show last authors
| author | version | line-number | content |
|---|---|---|---|
| 1 | |||
| 2 | In the wiki's administration, under "MCP Server": | ||
| 3 | |||
| 4 | 1. Server name - the name advertised to connecting agents (defaults to the wiki pretty name). | ||
| 5 | 1. Server description - sent as the MCP initialization instructions. A "call man first" hint is appended automatically. | ||
| 6 | 1. Optionally [[enable write tools>>doc:documentation.extensions.admin.llm.mcp-server.enable-write-tools.WebHome]] ({{code}}edit_document{{/code}}, {{code}}write_document{{/code}}), which are off by default. | ||
| 7 | 1. MCP Server is enabled by default. Subwikis have a toggle, the main wiki is controlled from the farm dashboard. | ||
| 8 | |||
| 9 | == Set up authentication == | ||
| 10 | |||
| 11 | The MCP uses XWiki's configured authentication method(s). By default, it doesn't ask for authentication which makes it possible to also query pages that are available to guests. An authentication header, e.g., for basic auth can be used to authenticate the user using the configured authentication method in XWiki. | ||
| 12 | |||
| 13 | When the [[OpenID Connect Provider extension>>doc:extensions:Extension.OpenID Connect.OpenID Connect Provider.WebHome]] is installed: | ||
| 14 | |||
| 15 | * Access for guest users is denied. | ||
| 16 | * The OpenID connect provider is indicated as the authentication method. | ||
| 17 | * The MCP client should trigger an authentication flow to obtain an authentication token. | ||
| 18 | |||
| 19 | For production use, install the [[OpenID Connect Provider>>doc:extensions:Extension.OpenID Connect.OpenID Connect Provider.WebHome]] extension and configure it for token-based authentication: | ||
| 20 | |||
| 21 | 1. Install the [[OpenID Connect Provider>>doc:extensions:Extension.OpenID Connect.OpenID Connect Provider.WebHome]] extension. | ||
| 22 | 1. In Administration > Users & Rights > OpenID Connect, change the clients to "Dynamic mode". | ||
| 23 | 1. In Administration > Users & Rights > Authentication, change the authenticator to "Token based authenticator" (see "[[Select the Authenticator>>doc:documentation.xs.admin.authentication.select-authenticator.WebHome]]"). | ||
| 24 | 1. If needed, set up a fallback authenticator (see the [[OpenID Connect Provider>>doc:extensions:Extension.OpenID Connect.OpenID Connect Provider.WebHome||anchor="HToken-basedaccess"]] documentation). | ||
| 25 | |||
| 26 | {{gallery}} | ||
| 27 | [[image:mcp-auth-step-1||alt="OpenID Connect XWiki configuration page, showing the user has to set Dynamic mode"]] | ||
| 28 | [[image:mcp-auth-step-2||alt="Authentication XWiki configuration page, showing the user has to set Token based authenticator as the authentication service"]] | ||
| 29 | {{/gallery}} | ||
| 30 | |||
| 31 | When OIDC is configured, unauthenticated callers receive HTTP 401 with a {{code}}WWW-Authenticate{{/code}} header pointing at the wiki's OIDC provider metadata. | ||
| 32 | |||
| 33 | == Security recommendation == | ||
| 34 | |||
| 35 | Create a dedicated wiki user for MCP access with only the rights the use case requires. Do not grant programming or admin rights to the MCP user. |
