Connect AI agents to your BookHost wiki (MCP)

What it is

A team wiki is where people write down how things work. Agents are now doing part of that work too: answering questions from the documentation, drafting runbooks after a change, keeping a page in step with the code. Agent access makes your BookStack workspace a shared place for both, with humans in control of what gets published.

• Endpoint: https://<your-workspace>.bookhost.co/mcp (Model Context Protocol, Streamable HTTP).
• Authentication: Authorization: Bearer <token id>:<token secret> — a BookStack API token of a user in that workspace.
• Identity: every call runs as that BookStack user. BookStack’s roles and book, chapter and page permissions apply exactly as they do for a person.
• Writes: by default, agent edits become proposals that an owner or admin approves in the review queue.

Two-minute setup

1. Create an agent user. In the BookHost dashboard, open Agents (owners and admins only), create an agent, give it a name and pick the BookStack role that should limit what it can read and change. BookHost creates a dedicated BookStack user with API access and shows its token once. Copy it now; you can revoke it at any time.
2. Add the server to your client. Copy the configuration for your client below and replace your-team with your workspace address. Keep the token in an environment variable or your client’s secret store, not in a file you commit.
3. Try it. Ask the agent: “List the books in our wiki.” It should answer with the books its BookStack user can see.

You can also use an API token of an existing BookStack user, as long as that user’s role has the Access system API permission. A dedicated agent user is easier to audit and to switch off.

Client configuration

The examples use https://your-team.bookhost.co/mcp. Your dashboard shows the same snippets with your own address.

export BOOKHOST_TOKEN="<token id>:<token secret>"
claude mcp add --transport http --scope user bookhost https://your-team.bookhost.co/mcp \
  --header "Authorization: Bearer $BOOKHOST_TOKEN"

{
  "mcpServers": {
    "bookhost": {
      "url": "https://your-team.bookhost.co/mcp",
      "headers": {
        "Authorization": "Bearer ${env:BOOKHOST_TOKEN}"
      }
    }
  }
}

{
  "inputs": [
    {
      "type": "promptString",
      "id": "bookhost-token",
      "description": "BookHost agent token (token id:token secret)",
      "password": true
    }
  ],
  "servers": {
    "bookhost": {
      "type": "http",
      "url": "https://your-team.bookhost.co/mcp",
      "headers": {
        "Authorization": "Bearer ${input:bookhost-token}"
      }
    }
  }
}

export BOOKHOST_TOKEN="<token id>:<token secret>"
codex mcp add bookhost --url https://your-team.bookhost.co/mcp --bearer-token-env-var BOOKHOST_TOKEN

# or in ~/.codex/config.toml:
# [mcp_servers.bookhost]
# url = "https://your-team.bookhost.co/mcp"
# bearer_token_env_var = "BOOKHOST_TOKEN"

{
  "mcpServers": {
    "bookhost": {
      "command": "npx",
      "args": ["mcp-remote", "https://your-team.bookhost.co/mcp", "--header", "Authorization:${AUTH_HEADER}"],
      "env": { "AUTH_HEADER": "Bearer <token id>:<token secret>" }
    }
  }
}

Test without an AI client

The official MCP Inspector lists the tools your token can use:

npx @modelcontextprotocol/inspector --cli https://your-team.bookhost.co/mcp --transport http \
  --header "Authorization: Bearer $BOOKHOST_TOKEN" --method tools/list

Tools

Read tools are always available. Write tools appear only when the workspace allows writes (see write modes below).

Write modes

An owner or admin sets one write mode per workspace in the dashboard. It applies to every agent of that workspace.

• Off: Agents can only read.
• Propose only (default): Agent edits arrive as drafts in the document intake review queue, clearly marked as agent proposals. An owner or admin approves or rejects each one; nothing changes before that.
• Direct: Agent edits are written straight to BookStack as the agent's own BookStack user, so they appear in the page's revision history under that name. BookStack permissions still decide what the agent may change.

BookStack permissions decide what an agent can read and what it can change directly. A proposal needs only read access to the page or book; whether it is applied is the reviewing owner’s or admin’s decision.

Security and privacy

• Permissions are inherited. The agent sees and changes exactly what its BookStack user may. Give it a role with access only to the books it needs. Admin and guest roles cannot be assigned to dashboard-created agents.
• Dashboard tokens work only through BookHost. The token of an agent created in the dashboard is accepted on the MCP endpoint only; BookStack’s own API rejects it. So the write mode, revocation and the kill switch always apply to it. A personal BookStack API token is different: it is that user’s own key and also works on BookStack’s API directly, where BookHost’s write mode and kill switch do not apply. Use dashboard agents when those controls matter.
• One token, one workspace. The workspace is chosen by the address you connect to, and a token only works on the workspace it belongs to.
• Page content is data, not instructions. A wiki page can contain text written to manipulate an AI (prompt injection). The server marks page content as untrusted, but your agent decides what to do with it. Review what an agent does with wiki content before you let it act on other systems, and keep the default review queue for writes.
• Rate limits per token: 120 requests per minute, 1,500 per hour and 60 writes per hour.
• Metadata-only activity log. Owners and admins see which agent called which tool, on which page id, with what result and how long it took. The log never contains page content, search terms or tokens. Entries are deleted after 90 days.
• Kill switch. Revoke a single agent token, or switch agent access off for the whole workspace. Both take effect on the next request.
• No AI processing by BookHost. For this feature, BookHost does not send your page content to any AI model. Content goes only to the MCP client you connect. That client and the AI provider behind it are your choice, and you are responsible for that transfer under your own agreements with them.
• Hosting unchanged. Your wiki, its database and backups stay on Hetzner infrastructure in Germany or Finland.

The binding German texts are in the privacy policy and the data processing agreement.

llms.txt

llms.txt is a plain-text map of a site for language models. There are two:

• bookhost.co/llms.txt describes BookHost itself, and /llms-full.txt contains this documentation in full.
• https://<your-workspace>.bookhost.co/llms.txt lists the MCP endpoint, how to authenticate and a link to this page. It lists books and pages only if your workspace allows logged-out (guest) access, and then only what a logged-out visitor can already see.

Troubleshooting

Not available yet

These are plans, not features. There is no committed release date.

• OAuth 2.1 sign-in, which claude.ai web connectors and ChatGPT connectors require. Until then those two cannot connect.
• A listing in the MCP registry.
• Per-agent scopes beyond BookStack roles, such as limiting one agent to certain tools.
• Events or webhooks that notify agents about wiki changes.

Background and a comparison with self-hosted options are in our guide Give Claude, Cursor and ChatGPT access to your team wiki.