PDF Tools MCP Server

Findings (25)

• highHigh. Something risky that needs a close look before you install.
  secrets issue

  Details are available to the maintainer after claiming this listing.
• highHigh. Something risky that needs a close look before you install.
  secrets issue

  Details are available to the maintainer after claiming this listing.
• highHigh. Something risky that needs a close look before you install.
  secrets issue

  Details are available to the maintainer after claiming this listing.
• highHigh. Something risky that needs a close look before you install.
  dependencies issue

  Details are available to the maintainer after claiming this listing.
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  Contacts a hard-coded IP address instead of a domain name.

  remote/smoke.mjs:21
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  @modelcontextprotocol/sdk@1.30.0: 6 known vulnerabilities

  GHSA-22jm-h49p-29qw, GHSA-46jr-4wx8-v453, GHSA-6prh-2h8m-c8cw, GHSA-6qxp-vccf-f47h, GHSA-f897-62hf-6gxq +1 more

  package-lock.json
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  @modelcontextprotocol/server@2.0.0: 8 known vulnerabilities

  GHSA-46jr-4wx8-v453, GHSA-f897-62hf-6gxq, GHSA-jm63-cq47-j5jp, GHSA-rvq5-wwqv-78pq, GHSA-46jr-4wx8-v453 +3 more

  package-lock.json
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  body-parser@2.3.0: 1 known vulnerability

  GHSA-27r3-jxmh-p828

  package-lock.json
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  nanoid@3.3.16: 1 known vulnerability

  GHSA-2v37-7h3g-55p8

  package-lock.json
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  node-forge@1.4.0: 12 known vulnerabilities

  GHSA-4487-j8r4-4g2f, GHSA-4642-5mcj-2rqw, GHSA-525v-9gp9-w22h, GHSA-5cwg-6vw7-rj6p, GHSA-5x38-2vff-x55p +7 more

  package-lock.json
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  source-map-js@1.2.1: 1 known vulnerability

  GHSA-68fv-2mgg-jv7q

  package-lock.json
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  tmp@0.0.33: 2 known vulnerabilities

  GHSA-52f5-9888-hmc6, GHSA-ph9p-34f9-6g65

  package-lock.json
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  vite@8.1.5: 5 known vulnerabilities

  GHSA-587h-7wmj-h5pm, GHSA-698v-4r3x-3vcv, GHSA-9jrq-w75r-8gcw, GHSA-r825-w8mm-5pxw, GHSA-rq7h-c2jc-7f22

  package-lock.json
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  zod@3.25.76: 1 known vulnerability

  GHSA-mrhx-c7xc-m3w5

  package-lock.json
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  zod@4.4.3: 2 known vulnerabilities

  GHSA-mrhx-c7xc-m3w5, GHSA-mrhx-c7xc-m3w5

  package-lock.json
• lowLow. Minor, or common in normal tools. Shown for information.
  Possible example credential in docs/tests: generic-api-key

  test/encrypted-pdf-password-truth.test.js:41
• lowLow. Minor, or common in normal tools. Shown for information.
  Possible example credential in docs/tests: generic-api-key

  test/remote-loopback-mock-state.test.js:332
• lowLow. Minor, or common in normal tools. Shown for information.
  @hono/node-server@2.1.0: 1 known vulnerability

  GHSA-rmxm-3fg6-px4f

  package-lock.json
• lowLow. Minor, or common in normal tools. Shown for information.
  @vitest/mocker@4.1.10: 2 known vulnerabilities

  GHSA-82fw-gwwq-j7x9, GHSA-qxg6-89mg-rqv8

  package-lock.json
• lowLow. Minor, or common in normal tools. Shown for information.
  fast-uri@3.1.7: 5 known vulnerabilities

  GHSA-333x-w4r6-6crp, GHSA-hrr3-gc8f-f4qj, GHSA-w74x-v6f9-j3xg, GHSA-wjr9-j795-jxcr, GHSA-xhq7-xmqj-769h

  package-lock.json
• lowLow. Minor, or common in normal tools. Shown for information.
  hono@4.13.0: 5 known vulnerabilities

  GHSA-5r4p-p66f-jhc7, GHSA-crvj-82cr-hjcx, GHSA-g6gw-c38x-mqfc, GHSA-gqvv-2mrq-wpjv, GHSA-hxh3-vqpv-xpqv

  package-lock.json
• lowLow. Minor, or common in normal tools. Shown for information.
  ip-address@10.4.0: 5 known vulnerabilities

  GHSA-2vr4-cq9g-pvrc, GHSA-h3mg-xc3c-68pw, GHSA-j6r3-76f7-8jcv, GHSA-rpw4-54j3-4h4q, GHSA-rxp7-6hxx-x8q5

  package-lock.json
• lowLow. Minor, or common in normal tools. Shown for information.
  qs@6.16.0: 1 known vulnerability

  GHSA-6pq8-jhm2-2vcw

  package-lock.json
• lowLow. Minor, or common in normal tools. Shown for information.
  vitest@4.1.10: 1 known vulnerability

  GHSA-82fw-gwwq-j7x9

  package-lock.json
• lowLow. Minor, or common in normal tools. Shown for information.
  No manifest declaring network access and environment variables (agent.json)

Network activity

Tools exposed (64)

• unlock_pdf

  Open a private local window to enter this PDF's password. The password goes directly to PDF Tools and is never a tool argument. Access lasts at most ten minutes for this exact document in this server session. Does not grant modification permissions or remove encryption.

• get_pdf_unlock_status

  Check whether this exact PDF is unlocked in the current PDF Tools session. Returns status only, never a password or unlock link.

• lock_pdf

  Clear this PDF's in-memory password and cancel its pending unlock window. Already completed reads or saved outputs are not removed.

• import_host_pdf

  Import exact PDF bytes explicitly supplied by an app into the already-permitted private plugin workspace. Does not accept or fetch a source path or URI, grant folder access, replace a file, send a document, or sign. Refuses encrypted or unsupported PDFs. Creates a new local copy of at most 16 MiB.

• open_pdf_workspace

  Open the PDF Tools workspace starting screen. No PDF is opened, no folders are scanned, and no document is changed or sent. Choose a task, then identify the PDF in the conversation.

• list_pdfs

  List PDF files in a directory, sorted by name, returning at most 200 paths per call and reporting the true total when more exist. Use offset to page through a folder with more than 200 PDFs. This tool operates on the user's local filesystem — all paths must be absolute paths on the user's machine (e

• read_pdf_fields

  Read all form fields from a PDF file and display them in an interactive viewer. Returns field names, types, and current values. Also renders the PDF visually — no need to also call display_pdf. All paths must be absolute paths on the user's local machine, NOT Claude container paths (/mnt/...). For p

• fill_pdf

  Fill a PDF form with provided data and save it. output_path may be the same as pdf_path for in-place editing; the original is backed up on the first same-path mutation. All paths must be absolute paths on the user's local machine, NOT Claude container paths (/mnt/...). For password-protected PDFs, u

• bulk_fill_from_csv

  Fill multiple PDFs using data from a CSV file. Output filenames must be unique. New outputs need no identity; every existing destination requires one exact entry in expected_output_identities. Any missing, stale, unrelated, or duplicate identity or any row failure aborts the whole batch. For passwor

• save_profile

  Save form data as a reusable profile

• load_profile

  Load a saved profile

• list_profiles

  List all saved profiles

• fill_with_profile

  Fill a PDF using a saved profile For password-protected PDFs, use unlock_pdf and enter the password in its local window before retrying. Never pass passwords in chat or tool arguments.

• extract_to_csv

  Extract form data from filled PDFs to a new CSV file. Publishes atomically, preserves every source PDF, and refuses existing output files. Choose a new output path for each export.

• validate_pdf

  Inspect AcroForm value coverage and the PDF's actual Required flags without mutating the document. Returns explicit complete, partial, no-fields, and indeterminate states plus a narrow required-field claim boundary; it does not determine legal validity, business-rule validity, signature validity, or

• read_pdf_content

  Read PDF text for broad understanding of the document. Returns an explicit extraction_status (complete, partial, or failed); a failed result must not be interpreted as an empty PDF. Best for full-document summarization, question answering, and exploratory analysis when you want a single text-oriente

• read_pdf_pages

  Read a specific page range from a PDF with page-numbered structured output. Use this when the model should inspect or quote a bounded slice of the document instead of loading the whole thing at once. All paths must be absolute paths on the user's local machine, NOT Claude container paths (/mnt/...).

• read_pdf_layout

  Extract a bounded page range into the versioned PDF Tools Extraction IR using the local pinned PDF.js parser. Returns source identity, raw page boxes and rotation when available, PDF.js-authoritative display geometry in physical 1/72-inch points after UserUnit, conservative lines and nonsemantic flo

• convert_pdf_to_markdown

  Convert a bounded page range of a local PDF into deterministic Markdown from the source-validated PDF Tools Extraction IR. Headings and lists require geometry or literal marker evidence. By default, a table requires a complete recurring text grid, a clean ruled-rectangle grid, or a complete closed p

• verify_table_proposal

  Deterministically check an untrusted table-structure proposal against a fresh, independently source-validated parse of the current PDF. The caller supplies only a region/token identity and item-to-cell assignments; text, geometry, header evidence, and packet fields are regenerated from source bytes.

• render_pdf_page

  Render one PDF.js page view to a PNG image for visual reasoning. The source-bound result distinguishes raw MediaBox/CropBox geometry from the rotated, UserUnit-scaled PDF.js view and raster coordinate spaces. Use this when text extraction is weak or visual layout must be inspected. All paths must be

• render_pdf_region

  Render a rectangular region from the rotated, UserUnit-scaled PDF.js page view. Coordinates use a top-left origin in PDF.js viewport points and are not interchangeable with MediaBox-relative detect_signature_zones or signing coordinates. The macOS system renderer preserves this view mapping and repo

• search_pdf_text

  Search extracted PDF text for a literal phrase and return page-numbered snippets. Use this when you need to find mentions of a clause, person, amount, or keyword before deciding which pages to inspect more deeply. All paths must be absolute paths on the user's local machine, NOT Claude container pat

• get_pdf_resource_uri

  Return the PDF's `pdf://...` resource URI so Claude-compatible MCP hosts can reference the binary directly through this server's Resources API. Use this when the host supports MCP resources and you want to hand Claude the document itself rather than only extracted text.

• get_pdf_identity

  Return a stable local artifact identity for a PDF without parsing or decrypting its document structure: canonical path, exact byte length, and SHA-256. Use this to bind plans, approvals, outputs, or provenance to the exact input bytes. The tool reads at most 250 MiB through one race-aware file descr

• display_pdf

  Open the interactive PDF viewer with page navigation, zoom, in-document search, text selection, form-field sidebar, and Sign mode. This is the primary tool for visually working with a PDF. If the user gave you a URL instead of a local path, call fetch_pdf_from_url first, then pass the downloaded loc

• get_active_document

  Return the toolkit's current active PDF document, including its canonical active_path, any backup_path created on first mutation, and the last mutation metadata. Use this when an agent needs to resume work on the current document without guessing which file is canonical.

• set_active_document

  Set or rehydrate the toolkit's active document state from a viewer session. Intended for the viewer to resync the canonical active_path and optional backup_path after MCP/server restarts.

• read_pdf_bytes

  Read PDF file bytes in chunks (for UI rendering)

• merge_pdfs

  Merge multiple PDF files into a single PDF. For multi-input merges, descriptive metadata is preserved only when every input asserts the same value; conflicting, partial, or invalid Title, Author, Subject, and Keywords claims are omitted rather than misattributed. New outputs commit atomically. Repla

• split_pdf

  Split a PDF into multiple files by page ranges (e.g. '1-5,6-10') or at regular intervals (e.g. 'every 5'). New outputs need no identity; every existing destination requires one exact entry in expected_output_identities. Any identity or output failure aborts the whole split set. All paths must be abs

• rotate_pdf_pages

  Rotate pages in a PDF by 90, 180, or 270 degrees. New outputs commit atomically. Replacing a distinct existing output requires its exact current expected_output_identity. All paths must be absolute paths on the user's local machine. For password-protected PDFs, use unlock_pdf and enter the password

• reorder_pdf_pages

  Rearrange the pages of a PDF in a new order. All pages must be included exactly once (strict permutation). New outputs commit atomically. Replacing a distinct existing output requires its exact current expected_output_identity. All paths must be absolute paths on the user's local machine. For passwo

• inspect_pdf_accessibility

  Inspect an unencrypted bounded local PDF for exactly eight shallow catalog-level accessibility signals. Returns exact missing or unavailable observations, a source SHA-256 binding, fixed limitations, and areas requiring qualified human review. This structural review does not run veraPDF, assess tag

• compare_pdfs

  Deterministically compare two complete bounded local PDFs through source-bound parser observations, Extraction IR text geometry, forms, ordinary annotations, metadata, and optional raw-RGBA visual evidence. Page alignment never guesses across unresolved repeated-page ambiguity. Default mode suppress

• get_pdf_info

  Inspect a bounded local PDF through the pinned parser and return source-bound page geometry, Info and XMP metadata, form fields and widgets, and inert ordinary annotations. Every retained observation is tied to the canonical path, byte length, and SHA-256. Caps and parser failures are reported as pa

• apply_page_plan

  Apply a page plan to a PDF: reorder, rotate, and delete pages in one pass. Pages not listed in page_order are excluded (deleted). The source is never modified. Replacing a distinct existing output requires its exact current expected_output_identity. All paths must be absolute. For password-protected

• get_page_analysis

  Analyze a PDF and return per-page metadata with explicit content-analysis provenance: text length, text snippet, image/vector-graphics presence, dimensions, orientation, and blank_status. Only likely_blank pages with complete content measurements are blank candidates, and every candidate still requi

• create_signature

  Save a reusable signature the user can apply to PDFs. Two styles: 'typed' uses the user's display name rendered in italic script on apply, 'image' uses a PNG/JPEG the user provides (a scan or photo of their actual signature, or a drawn signature as a data URL). Signatures are stored locally at ~/.pd

• get_allowed_directories

  Report which folders this server may read and write, which configuration layer supplied them, and where the stored configuration file lives. Answers without touching the filesystem, so it works before anything is configured. Use it to explain a path refusal or to tell the user where to change the bo

• list_signatures

  List all saved signatures in ~/.pdf-toolkit-files/signatures/. Returns each signature's name, style (typed or image), display name (for typed), and creation timestamp.

• load_signature

  Load one saved signature by name. Returns the style, display name, and for image signatures a preview data URL so the viewer can render the selected asset on demand.

• add_signature_field

  Draw a visible 'Sign here' placeholder box on a PDF page and save as a new file. Marks where a signature should go — does NOT sign the document. Useful when preparing a PDF to send to another party for signing. Coordinates are in points (72pt = 1 inch), TOP-LEFT origin: x=distance from left, y=dista

• apply_signature

  NEVER FABRICATE user_intent_statement OR user_confirmed_at. Both values MUST come directly from the user — ask them, get their answer, pass it through verbatim. Fabricating these is a hard violation of the human-intent requirement this tool ships under; every agent calling apply_signature does so on

• prepare_signing_packet

  One-shot local workflow: fill form fields AND add 'Sign here' placeholder boxes to a PDF in a single pass, saving as a new file. Returns the legacy pending-location manifest plus a provider-neutral, source-bound preparation receipt. Does NOT apply a signature, contact a provider, create an agreement

• apply_text

  Stamp a plain text string at a location on a PDF, saving the result as a new file. Use this for date zones (stamp today's date), or any other "put these characters here" operation that isn't a signature. NO user_intent_statement required — text is not a signature. Coordinates use TOP-LEFT origin in

• detect_signature_zones

  Find places in a PDF where a signature, initials, printed name, or date should go. Returns typed zones with top-left coordinates in points. Use this before apply_signature and never guess coordinates. Apply signatures and initials with apply_signature. Apply names and dates with apply_text. Detectio

• fetch_pdf_from_url

  Download a PDF from an HTTP(S) URL to an allowed local directory and return its local path. Enforces download-size, redirect, and network-address checks. Does not provide browser sign-in or accept authentication headers. For sign-in-required files, download through the provider's interface and use t

• reveal_in_finder

  Open the OS file manager with the given file selected (macOS: Finder → Reveal; Windows: Explorer → select; Linux: opens the enclosing folder). Used by the viewer to surface the active PDF or its backup so the user can immediately see the relevant file.

• start_lumin_authorization

  Connect a Lumin account through secure browser login using OAuth PKCE. Follow the returned next_step instructions. Account creation and passwords belong on Lumin's website, never in tool arguments or chat. If this installation is not configured, ask its maintainer to enable the integration rather th

• finish_lumin_authorization

  Finish a browser login started by start_lumin_authorization. The Lumin access token is held only in this running PDF Tools process and is never returned, logged, or written to disk. Restarting PDF Tools requires connecting again.

• prepare_lumin_request

  Prepare and preview a Lumin signing request locally. Requires a provider-ready receipt from prepare_signing_packet. This validates the exact prepared PDF, recipients, and expiry, then returns the disclosure and exact confirmation text required for sending. It does not contact Lumin or send anything.

• send_lumin_request

  NEVER FABRICATE confirmation_statement OR user_confirmed_at. Ask the user to confirm the exact disclosure returned by prepare_lumin_request, then pass their exact confirmation text and timestamp. This makes one nonretryable provider request that uploads the prepared PDF to Lumin and emails the liste

• check_lumin_status

  Check an existing Lumin signing request and retain a local, digest-bound status observation. This cannot create or retry a signing request. A failed read may be retried safely.

• download_lumin_artifact

  Download an existing Lumin signing artifact to an allowed local folder without overwriting a file. The temporary signed download URL is consumed internally and is never returned, logged, or persisted. This cannot create or retry a signing request.

• create_extraction_workspace

  Create a private local workspace bound to the exact PDF bytes and JSON Schema. The server maps every page with the local PDF parser, compiles the schema leaves, and stores no model output. Experimental and model-free.

• inspect_extraction_state

  Inspect the exact current generation and recovery state of a private verified-extraction workspace.

• read_extraction_workspace

  Read a bounded, cursor-bound page of document chunks, pending schema leaves, proposals, verification results, or append-only events.

• read_extraction_chunk

  Rebuild and return one source-bound chunk from the current PDF bytes. The chunk must belong to the workspace's returned inventory; omitted chunks cannot be requested.

• submit_extraction_proposal

  Append one explicitly unverified value proposal for a pending schema leaf, bound to one or more returned chunk IDs. This does not promote or trust the value.

• verify_extraction_proposal

  Deterministically replay one proposal against fresh PDF bytes, the retained schema, and exact cited chunk byte ranges, then append the typed result. No model, network, or numeric confidence.

• verify_extraction_batch

  Replay 1 to 32 pending proposals against one exact current generation and fresh PDF bytes, then atomically append all typed results in one generation. Any invalid item aborts before writes; citation mismatches are retained results. Result order matches item order. Complete means all results retained

• delete_extraction_workspace

  Permanently delete one private workspace only when both its exact identity and exact current generation match. Requires the literal confirmation DELETE.

• review_extraction_workspace

  Open a source-bound Evidence view for a verified-extraction workspace. Shows current values, unresolved leaves, append-only history, replayed citations and page coverage. Read-only; never accepts or approves a proposed value. Subsequent views are bounded to 20 items and pinned to the current workspa