MCP User Permissions
Explanation
An MCP client acts as the wiki user it authenticated as, the MCP user, and inherits that account's rights in full. The server adds no permission of its own: tool selection, the space filter and cross-wiki reach can only narrow what an agent reaches, never widen it beyond what the account already allows.
That makes the choice of account the strongest control an administrator has, and it is why a personal admin account is the wrong one to hand to an agent.
Why a dedicated account
An agent is driven by text it reads, and some of that text comes from the wiki itself or from the web. Anything that text persuades it to do, it does with the MCP user's rights. A dedicated account holding only the rights one use case needs bounds that blast radius, and it separates the agent's edits from a person's in the history.
The rights to withhold
Do not grant an MCP user programming or admin rights on a production instance. With them, a page an agent writes can execute script macros with those rights when anyone views it, which turns a prompt injection into code execution. Write Tools Risk follows that path in detail.
What the wiki records
Content an agent saves carries the MCP user as its content author, and every save the server makes is a minor edit whose comment starts with [AI]. A dedicated account therefore also makes the agent's changes reviewable as a group.
