MCP User Permissions
Explanation
An MCP client acts as the wiki user it authenticated as, the MCP user, and inherits that account's rights in full. The server adds no permission of its own: tool selection, the space filter and cross-wiki reach can only narrow what an agent reaches, never widen it beyond what the account already allows.
That makes the choice of account the strongest control an administrator has, and it is why a personal admin account is the wrong one to hand to an agent.
The guest user
A wiki can allow guest access instead (see Configure the MCP Server). The caller is then the guest user, with exactly the guest's rights, typically view on public pages only. The server serves that caller a variant without any write tool: authoring tools are neither listed nor callable, whatever the wiki's tool selection says.
Why a dedicated account
An agent is driven by text it reads, and some of that text comes from the wiki itself or from the web. Anything that text persuades it to do, it does with the MCP user's rights. A dedicated account holding only the rights one use case needs bounds that blast radius, and it separates the agent's edits from a person's in the history.
The rights to withhold
Do not grant an MCP user script, programming or admin rights on a production instance. With any of them, a page an agent writes can execute script macros when anyone views it, which turns a prompt injection into code execution: {{velocity}} needs only script right, {{groovy}} needs programming right, and admin and programming both imply script. Write Tools Risk follows that path in detail.
What the wiki records
Content an agent saves carries the MCP user as its content author, and every version comment the server writes starts with [AI]. A creation is always a major version and a subsequent save is minor unless the agent asks for a major one, so iterative agent writes do not clutter the default history view. delete_document is the exception: a deletion writes no version comment, and the recycle bin entry names the user who deleted the page. A dedicated account therefore also makes the agent's changes reviewable as a group.
