
Security News
GPT-6 Astra Attempts Supply Chain Attacks Against Open Source Maintainers in Testing
GPT-6 Astra hits 100% on ExploitBench and finds zero-days autonomously, while independent tests reveal scope violations and monitoring gaps.
yandex360-mcp
Advanced tools
MCP-сервер для сервисов Яндекс 360 (Вики и далее) — инструменты для AI-ассистентов.
MCP server that gives AI assistants (Claude Code, Claude Desktop, Cursor, VS Code and
any other MCP client) tools to work with Yandex 360
organization services — starting with Yandex Wiki. Transport is stdio, the only
runtime dependency is mcp, and it installs & runs through uvx without cloning.
🇷🇺 Документация на русском — README_ru.md.
Scope: this server covers Yandex 360 services (Wiki, and next Directory, Disk). Yandex Tracker is intentionally out of scope — it already has an excellent, mature server: aikts/yandex-tracker-mcp. Use the two side by side.
uvx straight from GitHub or PyPI.| Module | Status | Description |
|---|---|---|
wiki | ✅ available | Read/edit Yandex Wiki pages (YFM) |
directory | 🔜 planned | Users and org structure (Yandex 360 Directory) |
disk | 🔜 planned | Files and folders (Yandex Disk) |
Install uv (provides uvx):
curl -LsSf https://astral.sh/uv/install.sh | sh
Get a Yandex OAuth token with wiki:read / wiki:write scopes and your Yandex 360
organization ID. Then add the server to your client using one of the blocks below.
Add to your project's .mcp.json (or run claude mcp add):
{
"mcpServers": {
"yandex360": {
"type": "stdio",
"command": "uvx",
"args": ["yandex360-mcp@latest"],
"env": {
"WIKI_TOKEN": "${WIKI_TOKEN}",
"WIKI_ORG_ID": "${WIKI_ORG_ID}"
}
}
}
}
To track the unreleased main branch instead, use
args: ["--from", "git+https://github.com/pa1ch/yandex360-mcp@main", "yandex360-mcp"].
One-click install: download the latest yandex360-mcp-*.mcpb from
Releases, open it in Claude Desktop,
and fill in the token fields — no JSON editing. Requires uv
installed on the machine.
Or configure manually — edit claude_desktop_config.json
(macOS: ~/Library/Application Support/Claude/, Windows: %APPDATA%\Claude\):
{
"mcpServers": {
"yandex360": {
"command": "uvx",
"args": ["yandex360-mcp@latest"],
"env": {
"WIKI_TOKEN": "your-oauth-token",
"WIKI_ORG_ID": "your-org-id"
}
}
}
}
Restart Claude Desktop after saving.
Add to .cursor/mcp.json (project) or ~/.cursor/mcp.json (global):
{
"mcpServers": {
"yandex360": {
"command": "uvx",
"args": ["yandex360-mcp@latest"],
"env": {
"WIKI_TOKEN": "your-oauth-token",
"WIKI_ORG_ID": "your-org-id"
}
}
}
}
Add to .vscode/mcp.json:
{
"inputs": [
{ "id": "wiki_token", "type": "promptString", "description": "Yandex Wiki OAuth token", "password": true },
{ "id": "wiki_org_id", "type": "promptString", "description": "Yandex 360 organization ID" }
],
"servers": {
"yandex360": {
"type": "stdio",
"command": "uvx",
"args": ["yandex360-mcp@latest"],
"env": {
"WIKI_TOKEN": "${input:wiki_token}",
"WIKI_ORG_ID": "${input:wiki_org_id}"
}
}
}
}
Any stdio MCP client works. Point it at the command:
uvx yandex360-mcp@latest
with WIKI_TOKEN and WIKI_ORG_ID in the environment.
| Tool | Description |
|---|---|
wiki_whoami | Current API user — quick access check |
wiki_get_page | Get a page by slug (e.g. homepage, dev/deploy); optional YFM body |
wiki_get_page_by_id | Get a page by numeric page_id; optional YFM body |
wiki_tree | Page tree — descendants of a slug (navigation) |
wiki_search | Full-text search across pages |
wiki_create_page | Create a page (title, slug, YFM content) |
wiki_update_page | Update title and/or content by id (replaces body) |
wiki_append_content | Append YFM content to the end of a page |
wiki_delete_page | Delete a page by id (destructive — confirm first) |
All configuration is via environment variables — nothing sensitive lives in code or config files.
| Variable | Module | Required | Description |
|---|---|---|---|
WIKI_TOKEN | wiki | yes* | Yandex OAuth token with wiki:read / wiki:write |
WIKI_ORG_ID | wiki | yes* | Yandex 360 organization ID (sent as X-Org-Id) |
YANDEX360_ENABLE | — | no | Comma-separated allow-list of modules (e.g. wiki). If unset, every configured module is enabled. |
* A module activates only when all of its variables are set. Unconfigured modules are skipped (the server logs this to stderr and keeps running).
See .env.example for a template.
Every registered tool takes up space in the model's context, so this server exposes only the modules you actually configure — nothing else reaches the model. At startup a module's tools are registered only when both conditions hold:
wiki needs WIKI_TOKEN
and WIKI_ORG_ID), andYANDEX360_ENABLE.Two ways to control the exposed tool surface:
wiki → only the nine
wiki_* tools are exposed, and nothing for directory / disk.YANDEX360_ENABLE to a comma-separated list to pin an
exact subset even when more modules are configured — e.g. YANDEX360_ENABLE=wiki.The server logs which modules are active (and which were skipped) to stderr on startup.
For AI agents installing this server: keep the tool surface minimal — configure only the services the user actually needs. Provide just those modules' tokens (and/or pin
YANDEX360_ENABLE). Do not add tokens for services that won't be used: every extra module loads tools that only waste the model's context.
git clone https://github.com/pa1ch/yandex360-mcp.git
cd yandex360-mcp
uv sync # create venv + install deps
uv run yandex360-mcp # run the server over stdio
uv run pytest # run tests
uv build # wheel + sdist into dist/
uv publish # needs a PyPI token (UV_PUBLISH_TOKEN or --token)
directory module — users, departments, org structure (Yandex 360 Directory API).disk module — file and folder operations (Yandex Disk API).Contributions welcome — a new service is a single module exposing is_configured() and
register(mcp), then one line in the module registry.
FAQs
MCP-сервер для сервисов Яндекс 360 (Вики и далее) — инструменты для AI-ассистентов.
The pypi package yandex360-mcp receives a total of 35 weekly downloads. As such, yandex360-mcp popularity was classified as not popular.
We found that yandex360-mcp demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
GPT-6 Astra hits 100% on ExploitBench and finds zero-days autonomously, while independent tests reveal scope violations and monitoring gaps.

Product
Socket can now send alerts and supply chain attack notifications to Microsoft Teams, with filters that route the right updates to each channel.

Security News
pnpm 12 rewrites the package manager in Rust, cutting install times by up to 90% while preserving pnpm 11 workflows and lockfiles.