Write Tools Risk
Explanation
Detailed explanation of the security implications of enabling write tools (edit_document, write_document) on the MCP server.
Script execution risk
Content an agent saves has the user of the MCP Server as its content author. If that content contains {{groovy}} or {{velocity}} script macros, those macros execute with the MCP user's rights when the page is viewed.
This is not an MCP-specific vulnerability - it is XWiki's normal edit semantics. MCP widens who can trigger it: any content the agent ingests (a web page, a file, another wiki page) could carry a prompt injection that causes the agent to write a page containing a script macro.
Prompt injection amplification
The MCP server's design makes the agent read content from the wiki and from external sources, then potentially write that content back. A malicious actor who can place content the agent will read (by editing any page the agent searches, for example) can inject instructions into the agent's context that tell it to craft a page containing a script macro.
If the MCP user has programming rights, this becomes a code-execution vector: the script macro runs with those rights when any user views the page.
Mitigations
| Mitigation | Effectiveness |
|---|---|
| Do not give the MCP user programming or admin rights | Prevents script execution entirely |
| Keep write tools off (default) | Eliminates the write surface unless explicitly needed |
| Use space filters to restrict agent edits | Contains agent writes to a controlled area |
Audit through [AI] history stamps | Enables detection and rollback |
| Run agents as a dedicated, scoped user | Limits potential damage to that user's rights |
Built-in protections
write_documentrequiresbase_versionfor overwrites - the agent must have read the page first and supply the version it read. The refusal does not reveal the current version, so an agent cannot blindly overwrite a page it never inspected.edit_documentuses exact string matching for edits. If the page changed between reading and editing, the edit fails cleanly with "re-read and retry".- Every save is a single version in the history, stamped
[AI], allowing for easy version comparison.
