Manual:$wgInvalidUsernameCharacters

Details
Characters to prevent during new account creations.

The @ sign is prohibited by default, because MediaWiki uses it internally for users that have their account in another wiki (interwiki users). The : sign is prohibited because the validity of usernames in different wikis differs due to different namespace and interwiki configuration. If you allow the "@" in usernames, you should also set . Otherwise you won't be able to give users with an "@" in the username different permissions using the normal way (though permissions can still be set via user ID). However, you are free to allow the ":" in usernames as long as you don't run multiple wikis with shared database or, and you don't create new namespace or interwiki prefixes which make existing username invalid.

This is used in a regular expression character class during registration (regex metacharacters like / are escaped).

Example
In case user names containing several characters should be prevented, the following setting is used: