wiki-formantBLOCK
The portable half of a wiki: derived taxonomy, a spec-correct MCP transport, markdown twins, and conditional-GET plumbing. Zero runtime dependencies.
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
The portable half of a wiki: derived taxonomy, a spec-correct MCP transport, markdown twins, and the conditional-GET plumbing an agent surface needs.
Zero runtime dependencies. Web-standard Request/Response, so it runs unchanged on Next route handlers, Hono, Bun, Deno and workers.
npm install wiki-formant
What this is, and what it deliberately is not
Every wiki needs a page store, a design system and a set of block types. Those are the parts you must own — they encode your schema, your brand and your content model, and a package that tried to own them would fight you.
What every wiki also needs, rebuilds by hand, and then lets drift, is the layer above: the second browsing axis derived from metadata you are already storing, the HTML→markdown converter behind every .md twin, the JSON-RPC edges that decide whether an MCP client can talk to you at all, and the ETag arithmetic that turns a recrawl into a 304.
This package was extracted from three production wikis that had each grown their own copy. By the time it was lifted, the copies had already diverged — one had lost the alphabetical index and the related-page ranking; one had ToolAnnotations the others lacked; one had MCP prompts the others lacked. Everything here is the union, with tests pinning the specific bugs that shipped.
Taxonomy
tagPath puts a page in exactly one place in a tree. The select-typed metadata it already carries is a cross-cutting axis — and it is almost always stored, rendered once in an infobox as dead text, and never made pressable. The failure mode is a 141-page category rendered as one flat grid while the data to split it sits unread in a JSON column.
The tree is yours; supply getMetadataKeys and the rest is derived.
import { createTaxonomy } from 'wiki-formant/taxonomy';
const taxonomy = createTaxonomy({
getMetadataKeys: tagPath => TAGS[tagPath]?.metadataKeys ?? [],
href: (tagPath, { sort, filters, letter }) => /* you98aab0ad656eOBSERVED · 2026-10-11Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.
claude mcp add wiki-formant --env MCP_REGISTRY_KEY_TYPE=${MCP_REGISTRY_KEY_TYPE} --env MCP_REGISTRY_PUBLIC_KEY=${MCP_REGISTRY_PUBLIC_KEY} -- npx -y [email protected]{
"mcpServers": {
"wiki-formant": {
"command": "npx",
"args": [
"-y",
"[email protected]"
],
"env": {
"MCP_REGISTRY_KEY_TYPE": "${MCP_REGISTRY_KEY_TYPE}",
"MCP_REGISTRY_PUBLIC_KEY": "${MCP_REGISTRY_PUBLIC_KEY}"
}
}
}
}Exposed tools (13)
11 read · 2 write · 0 destructive.
| Tool | Risk | Description |
|---|---|---|
Test | read | x |
W | read | d |
a | read | d |
boom | read | Always fails in a caller-fixable way. |
create_page | write | Write a page. |
edit_page | write | Edit. |
internal_thing | read | Not a skill. |
lookup | read | Returns a shaped answer. |
p | read | d |
read_page | read | Read. |
search | read | Search the corpus. |
search_pages | read | Search. |
t | read | x |
Trust audit
BLOCKgrade D · trust 69/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | FAIL |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- none-observed
- Network
- declared (10 observation(s))
- Shell
- none-observed
- Dependencies
- not all pinned
- Secrets in source
- found
Findings (12)
ssl: { rejectUnauthorized: false },console.log(`check-classes: clean — every className token resolves against ${emitted.size} emitted selectors.`);export interface Beacon {if (BOT.test(headers.get('user-agent') ?? '') || !rateLimit(clientKey('beacon', headers), limit).ok) return done;const body = (await request.json().catch(() => null)) as Partial<Beacon> | null;
export function Beacon({ endpoint = '/api/view' }: { endpoint?: string }): null {{ token: 'Meta-ExternalFetcher', label: 'MetaExternalFetcher', fetches: true },test('collect drops a beacon its site resolver refuses', async () => {const off = await withFetch(redirectTo('http://169.254.169.254/latest'), () =>const off = await withFetch(redirectTo('http://169.254.169.254/latest'), () =>return new TextDecoder().decode(Uint8Array.from(atob(encoded), c => c.charCodeAt(0)));
@simplewebauthn/browser, @simplewebauthn/server, @tiptap/core, @tiptap/extension-code-block, @tiptap/extension-image, @tiptap/extension-link, @tiptap/extension-placeholder, @tiptap/extension-table
Gates applied: no_behavioural_pass.
98aab0ad656efull audit observations/trust-audit/mcp-server/tutmoses__wiki-formant.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-11 | 98aab0ad656e | BLOCK | D | 69 | first audit |
Questions
What is the wiki-formant MCP server?
The portable half of a wiki: derived taxonomy, a spec-correct MCP transport, markdown twins, and conditional-GET plumbing. Zero runtime dependencies.
What tools does wiki-formant expose?
13 in total: 11 read-only, 2 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.
Is wiki-formant safe to connect to an agent?
No — not without reading the findings first. The audit graded it D (69/100) and found 1 critical or high issue in the source. Each one is listed on this page with the file and line it is on.
What credentials does wiki-formant need?
It reads MCP_REGISTRY_KEY_TYPE and MCP_REGISTRY_PUBLIC_KEY from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How does wiki-formant run?
It speaks streamable-http, so it runs as a service you connect to over the network. It is published on npm as wiki-formant at 0.45.0.
How current is this page?
The grade is for one exact copy of the source (98aab0ad656e), read on 2026-10-11. The repository is watched and re-audited when it changes.