This note describes where to store the Wiki.js API key used by an MCP server for the local Codex user account (ax_julian) on this host.
/srv/system-documentation, or in any repo working tree.Store secrets in a user-only env file (local to this host, not versioned):
/home/ax_julian/.codex/secrets/wikijs.env0600 (user read/write only)Create it:
mkdir -p /home/ax_julian/.codex/secrets
umask 077
cat > /home/ax_julian/.codex/secrets/wikijs.env <<'EOT'
WIKIJS_URL=https://your-wikijs.example
WIKIJS_API_KEY=REDACTED
EOT
chmod 700 /home/ax_julian/.codex/secrets
chmod 600 /home/ax_julian/.codex/secrets/wikijs.env
Avoid passing secrets directly on the command line (they can end up in shell history, tooling logs, or process listings).
Use a tiny wrapper that sources the env file and launches the MCP server:
/home/ax_julian/.local/bin/wikijs-mcp-server#!/usr/bin/env bash
set -euo pipefail
# Local-only secrets file. Must be 0600.
source /home/ax_julian/.codex/secrets/wikijs.env
# Start your chosen MCP server here.
# Example placeholders:
# exec npx -y wikijs-mcp
# exec python -m wiki_js_mcp
exec "$@"
Notes:
The configured host wrapper is /home/ax_julian/.local/bin/wikijs-mcp; the generic wrapper above is illustrative, not the active command. The non-root profile wires it in /home/ax_julian/.codex/config.toml under [mcp_servers.wikijs]. Credentials stay in the restricted location documented above; do not print or copy their values into instructions, logs, or temporary workspaces.
The former host instructions recorded Wiki.js MCP as available on 2026-02-07. That is historical evidence, not a lasting availability guarantee. During this 2026-09-11 documentation migration, page listing and retrieval succeeded. Before a future documentation change, verify current access with a read-only page query, perform only the authorized API edit, and read the saved page back. If access fails, retain the source guidance until its destination is saved and verified.