Wiki source code of MCP User Permissions
Last modified by gabrielc on 2026/10/21 10:53
Show last authors
| author | version | line-number | content |
|---|---|---|---|
| 1 | An MCP client acts as the wiki user it authenticated as, the MCP user, and inherits that account's rights in full. The server adds no permission of its own: tool selection, the space filter and cross-wiki reach can only narrow what an agent reaches, never widen it beyond what the account already allows. | ||
| 2 | |||
| 3 | That makes the choice of account the strongest control an administrator has, and it is why a personal admin account is the wrong one to hand to an agent. | ||
| 4 | |||
| 5 | == The guest user == | ||
| 6 | |||
| 7 | A wiki can allow guest access instead (see [[Configure the MCP Server>>doc:documentation.extensions.admin.llm.mcp-server.configure.WebHome]]). The caller is then the guest user, with exactly the guest's rights, typically view on public pages only. The server serves that caller a variant without any write tool: authoring tools are neither listed nor callable, whatever the wiki's tool selection says. | ||
| 8 | |||
| 9 | == Why a dedicated account == | ||
| 10 | |||
| 11 | An agent is driven by text it reads, and some of that text comes from the wiki itself or from the web. Anything that text persuades it to do, it does with the MCP user's rights. A dedicated account holding only the rights one use case needs bounds that blast radius, and it separates the agent's edits from a person's in the history. | ||
| 12 | |||
| 13 | == The rights to withhold == | ||
| 14 | |||
| 15 | Do not grant an MCP user ##script##, programming or admin rights on a production instance. With any of them, a page an agent writes can execute script macros when anyone views it, which turns a prompt injection into code execution: {{code language="none"}}{{velocity}}{{/code}} needs only ##script## right, {{code language="none"}}{{groovy}}{{/code}} needs programming right, and admin and programming both imply ##script##. [[Write Tools Risk>>doc:documentation.extensions.admin.llm.mcp-server.write-tools-risk.WebHome]] follows that path in detail. | ||
| 16 | |||
| 17 | == What the wiki records == | ||
| 18 | |||
| 19 | Content an agent saves carries the MCP user as its content author, and every version comment the server writes starts with ##[AI]##. A creation is always a major version and a subsequent save is minor unless the agent asks for a major one, so iterative agent writes do not clutter the default history view. ##delete_document## is the exception: a deletion writes no version comment, and the recycle bin entry names the user who deleted the page. A dedicated account therefore also makes the agent's changes reviewable as a group. |
