Connecting Claude Code to the Wikantik MCP Servers

Wikantik exposes two Model Context Protocol servers so an AI agent can use the wiki directly — searching, traversing the Knowledge Graph, reading token-budgeted page projections, and (optionally) curating content. This page is the setup: which URL and which key go in which file, securely, so a Claude Code instance can read — or write — this wiki.

The catch-22. This article explains how to connect an agent to the wiki, but an agent can't read it until it's already connected. So the first connection is a human task: read this directly, wire up Claude Code, and from then on your agent can search, read, and cite this very page — and everything else here — on its own.

The two servers

ServerURLWhat it's forToolsKey scope
Knowledge MCP (read-only)https://wiki.wikantik.com/knowledge-mcpRetrieval: the assemble_bundle context bundle, hybrid search, Knowledge-Graph traversal, structural-spine navigation, the get_page_for_agent projection, sparql_query, get_ontology21, read-onlymcp_read (or higher)
Admin MCP (write / curate)https://wiki.wikantik.com/wikantik-admin-mcpCuration: page writes, KG node/edge curation, proposals, verification stamping, bulk cluster rename29mcp_admin (or all)

Both servers register some tools only when the subsystem behind them is wired (for example the Knowledge Graph tools), so 21 and 29 are the fully-wired counts — a leaner install advertising fewer is not an error. Call tools/list (or run /mcp in Claude Code) to see what your deployment really exposes.

Most people want the read-only Knowledge MCP for a coding agent — it can read and reason but can never change anything. Add the Admin MCP only if you want the agent to maintain the wiki (write pages, curate the graph).

Both servers authenticate the same way: an Authorization: Bearer <API_KEY> header. Keys look like wkk_..., and the key's scope decides which server it can reach:

ScopeKnowledge MCPAdmin MCP
mcp_readyes (read-only)no
mcp_adminyesyes (fully privileged)
allyesyes
toolsnono (it is for the /tools/* OpenAPI endpoints)

Two things to know about what a key can see and do:

Step 1 — Issue an API key

Pick the narrowest scope that does the job. Copy the key — it is shown only once, and treat it like a password. The older scope name mcp is still accepted as an alias for mcp_admin, but use mcp_admin for new keys.

Step 2 — Decide where the key lives (the part that matters)

Never commit the key to version control. Pick one of two safe patterns:

Step 3a — Quick path (CLI, user scope)

claude mcp add \
  --transport http \
  --header "Authorization: Bearer YOUR_KEY_HERE" \
  --scope user \
  wikantik-knowledge \
  https://wiki.wikantik.com/knowledge-mcp

To also give the agent write access, repeat with the admin URL and a distinct name (this needs an mcp_admin or all key; an mcp_read key is refused by this server):

claude mcp add \
  --transport http \
  --header "Authorization: Bearer YOUR_KEY_HERE" \
  --scope user \
  wikantik-admin \
  https://wiki.wikantik.com/wikantik-admin-mcp

Step 3b — Shareable path (.mcp.json + env var)

Create .mcp.json at your project root. Note "type": "http" (Streamable HTTP) and the env-var placeholder for the key:

{
  "mcpServers": {
    "wikantik-knowledge": {
      "type": "http",
      "url": "https://wiki.wikantik.com/knowledge-mcp",
      "headers": { "Authorization": "Bearer ${WIKANTIK_MCP_KEY}" }
    }
  }
}

Put the actual key in your shell environment — e.g. in ~/.zshrc/~/.bashrc, or in a .gitignored file you source:

export WIKANTIK_MCP_KEY="your_key_here"

Then start Claude Code (claude) from that shell. Commit .mcp.json; do not commit the key.

Gotcha: running claude mcp add against a project that already has a .mcp.json will resolve your ${WIKANTIK_MCP_KEY} placeholder into the literal key value (a known bug). If that happens, restore the placeholder: git checkout -- .mcp.json.

Step 4 — Verify

claude mcp list            # expect:  wikantik-knowledge   ✓ Connected
claude mcp get wikantik-knowledge

Or, inside a Claude Code session, run the /mcp command to see each server, its status, and the tools it exposes. A ! Needs authentication or ✗ Failed to connect means the key or URL is wrong. On the wire, HTTP 403 means the key is missing, revoked or has too low a scope for that server; 429 means you were rate-limited; 503 means the server has no API-key service (no datasource), no CIDR allowlist and is not set allowUnrestricted, so it rejects everything (it fails closed).

Step 5 — Use it

Now just ask, and the agent reaches the wiki for you:

Pitfalls

Cluster Hub: Agent Cookbook (agent-cookbook)