Content
mcp-yandex-wiki
Minimal MCP server for Wiki](https://wiki.ru/) (read + write).
## Installation
```bash
cd ~/.claude/mcp/yandex-wiki
npm install
```
Registration in `~/.claude.json`:
```json
{
"mcpServers "yandex-wiki "type": "stdio "command": "node",
"args": ["/Users/<user>/.claude/mcp/yiki/index.mjs"],
"env": {
"YW_O": "y0__...",
YW_ORG_ID": "1234567",
"YW_OR": "X-Org-Id"
}
}
}
```
## Environment Variables
| Variable | Required | Description |
|---|---|---|
|_OAUTH_TOKEN` | yes OAuth token with scope `wiki:read` / `wiki:write` `YW_ORG_ID` | yes | Organization ID |
| `YW_ORG_HEADER` | noX-Org-Id` for360 (default), `X-Cloud-Org-Id` for Yandex Cloud Organization |
Yandex Tracker token is suitable if the same application has wiki scopes are common (`OAuth` + organization header). information, see [Scopes of the token](#scopes-of-the-token).
Service account of is not suitable for Wiki API — only user account.
## Tools Tool | API | Description |
|---|---|---|
| `myself` | `GET /users/me` | Current user, organization, home cluster |
| `get_page` | `GET /pages?slug=` / `GET/{id}` | Page by slug or id. Body — only with `fields: ["content"]` |
| `search` | `POST / | Full-text search, up to 10 results |
| `list_descendants` | `GET /pages/{id}/descendants` | |
| `list_resources` | `GET /pages/{id` | Attachments + tables in one list |
| `list_ | `GET /pages/{attachments` | Attachments |
| `list_grids` | `GET /pages/{id}/grids` | Dynamic tables |
| `create_page` | `POST /pages` | Create page (`slug`, `title` are required) |
| `update_page` | `POST /pages/{id}` | Change `title` / `content` / `slug` |
| `delete_page` | `DELETE /pages/{id}` | Delete page (irreversible) |
### `fields` for `get_page`
`redirect`, `breadcrumbs`, `attributes`, `content`, `access_policy`, `access_lists`, `owner`.
Without `fields`, only `id`, `slug`, `title`, `page_type` are returned.
## API Features
- **Search is not paginated.** `total_pages` is1`, up to are returned; `page` / `offset` parameters are ignored. Narrow down your query.
-` and `PUT` are not supported.** Update is done via `pages/{id}`. Allowed methods: `/pages` → `POST, GET`; `/pages/{id `POST, GET, DELETE **Read-only pages return403** on write — see to handle HTTP 403](#-handle-http-403 Status of Checks
| Tool |
|---|---|
| `myself`, `get_page`, ` `list_descendants`,_resources`, `list_attachments`, `list_grids` | tested API |
| `update | tested: round-trip header real page, content unchanged-byte |
| `create_pagedelete_page` | **not tested** — schema restored from API validation errors and `Allow` header |
### Scopes of the Token
Documentationions two scopes](httpsandex.ru/support/wiki/ru/api-ref/access): `wiki:read`-only) and `wiki:write` (create, edit, delete). Additionally, there's a separate gate — user rights: «requests are performed on behalf of the user… the user must have corresponding rights in Wiki**In practice, wiki scopes are not required.** An application token Yandex Tracker scopes and no wiki scopes can read and write to Wiki without errors — tested on live API, including `POST` to a page.
The mechanics behind this are unclear, with two possible explanations:
- Wiki API does not check scopes and allows access based on user identity;
- Tracker scope covers Wiki by design — services in the same.
You can distinguish between these by using a token with a foreign scope (e.g., only `info`): if it passes the first explanation; if it403`, it's the secondforcement at Yandex is **service-specific, not global**: the same tokencloud_api:disk.read returns `HTTP 403 «The application may not have sufficient rights»` for Yandex Disk. This meansDisk checks scopes» does not imply that Wiki checks scopes — do not transfer conclusions from one API to another.
Practical conclusion: **if you already have a Yandex Tracker token, you do not need to issue separate wiki scopes.** The downside is that a «wiki-only» token does not isolate Wiki: a Tracker token can also access it.
### How to Handle HTTP 403
Scopes are likely not the issue here — check user rights the user has no rights page;
- the page-only: `get_page` with `fields: ["attributes"]attributes.is_readonly`. System pages (owned by `y-wiki`) are read-only the home page.
If `403` is returned actions, including reading, check-Org-Id` and token belongs to a user, service account.
### Side Writing
Any `POST/{id}` updates `modified_at`, even if the body has. The page will be changed.
