Wiki source code of Enable Write Tools
Last modified by gabrielc on 2026/07/14 12:31
Show last authors
| author | version | line-number | content |
|---|---|---|---|
| 1 | 1. In the wiki's administration, open the "MCP Server" section (Administer Wiki > Other > MCP Server). | ||
| 2 | 1. In the tool checkbox tree, check {{code}}edit_document{{/code}}, {{code}}write_document{{/code}}, or both. | ||
| 3 | 1. Save the configuration. | ||
| 4 | |||
| 5 | Changes take effect immediately, no restart needed. | ||
| 6 | |||
| 7 | |||
| 8 | == Risks of Write Tools == | ||
| 9 | |||
| 10 | Content an agent saves has the MCP user as its content author. If that content contains {{code}}{{groovy}}{{/code}} or {{code}}{{velocity}}{{/code}} scripts, those scripts execute with the MCP user's rights. If the MCP user has programming rights, a prompt-injected agent that writes a script macro into a page becomes a code-execution vector. See [[Write Tools Risk>>doc:documentation.extensions.admin.llm.mcp-server.write-tools-risk.WebHome]]. | ||
| 11 | |||
| 12 | == Mitigations == | ||
| 13 | |||
| 14 | Apply these mitigations in order of importance: | ||
| 15 | |||
| 16 | 1. Do not grant the MCP user programming or admin rights. | ||
| 17 | 1. Keep write tools off unless the use case explicitly needs them. They are off by default. | ||
| 18 | 1. Audit every AI save through the {{code}}[AI]{{/code}} comment prefix in the document history and the server audit log. | ||
| 19 | |||
| 20 | == Built-in guardrails == | ||
| 21 | |||
| 22 | * {{code}}write_document{{/code}} enforces read-before-overwrite: overwriting an existing document requires the version the agent read first, and the refusal does not reveal the current version. An agent cannot blindly modify a page it never looked at. | ||
| 23 | * {{code}}edit_document{{/code}} uses exact string matching for find-and-replace. A stale edit fails with "re-read and retry" rather than silently corrupting a page. | ||
| 24 | * Every save is marked with {{code}}[AI]{{/code}} in the page history. |
