pdfnative-mcp

Annotate PDF (markup / drawing)

annotate_pdf

Idempotent

Add highlights, notes, shapes, lines, and free text to existing PDFs as a non-destructive overlay. Preserve original file bytes while inserting ISO-standard markup annotations.

Instructions

Append markup annotations (ISO 32000-1 §12.5) to an existing PDF as a non-destructive incremental update (original bytes preserved). Types: text (sticky note), highlight | underline | strikeout | squiggly, square | circle, line (needs start/end), freetext. Each needs a 0-based page and rect [x1,y1,x2,y2]; optional contents, color, opacity, title and type-specific fields. VISUAL OVERLAY ONLY — nothing is removed or redacted (covered text stays extractable). Encrypted sources → ENCRYPTED_SOURCE (decrypt_pdf first).

Input Schema

TableJSON Schema

Name	Required	Description	Default
`pdfBase64`	Yes	Base64-encoded source PDF to annotate.
`outputMode`	No	'base64' (default) returns the PDF inline; 'file' writes it inside the PDFNATIVE_MCP_OUTPUT_DIR sandbox (SECURITY_VIOLATION when the sandbox is not configured).	base64
`outputPath`	No	Required when outputMode='file'. Relative path inside the sandbox; must end with .pdf (no absolute paths, no '..').
`annotations`	Yes	Markup / drawing annotations to add. Each is attached to a 0-based page index.

Output Schema

TableJSON Schema

Name	Required	Description
`mode`	Yes
`summary`	No	Tool-specific summary, when produced.
`filePath`	No	Sandboxed absolute path (file mode).
`sizeBytes`	Yes
`diagnostics`	No	PDF/A diagnostics (when includeDiagnostics=true).

Schema Changelog

Changes observed during successful MCP inspections.

Changed6 schema fields changedAug 24, 2026

addedInput schema / properties / outputMode / description

Added value: +"'base64' (default) returns the PDF inline; 'file' writes it inside the PDFNATIVE_MCP_OUTPUT_DIR sandbox (SECURITY_VIOLATION when the sandbox is not configured)."

addedInput schema / properties / outputPath / description

Added value: +"Required when outputMode='file'. Relative path inside the sandbox; must end with .pdf (no absolute paths, no '..')."

changedOutput schema / description

Previous value: -"Structured result of a PDF-producing tool. In base64 mode the PDF bytes are delivered out-of-band as an embedded `resource` content block (data: URI), NOT duplicated here, to keep responses token-frugal. In file mode `filePath` is the sandboxed absolute path."New value: +"Result of a PDF-producing tool. base64 mode: the PDF arrives as an embedded `resource` content block (not duplicated here); file mode: `filePath`."

addedOutput schema / properties / diagnostics

Added value: +{
+  "description": "PDF/A diagnostics (when includeDiagnostics=true).",
+  "items": {
+    "additionalProperties": false,
+    "properties": {
+      "code": {
+        "type": "string"
+      },
+      "message": {
+        "type": "string"
+      },
+      "severity": {
+        "enum": [
+          "warning"
+        ],
+        "type": "string"
+      }
+    },
+    "required": [
+      "code",
+      "message",
+      "severity"
+    ],
+    "type": "object"
+  },
+  "type": "array"
+}

changedOutput schema / properties / filePath / description

Previous value: -"Absolute sandboxed file path (when mode='file')."New value: +"Sandboxed absolute path (file mode)."

addedOutput schema / properties / summary

Added value: +{
+  "additionalProperties": true,
+  "description": "Tool-specific summary, when produced.",
+  "type": "object"
+}

Addedv1.4.0Jul 5, 2026

TDQS

A4.9/5.0

Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations declare readOnlyHint: false, destructiveHint: false, and idempotentHint: true, but the description significantly adds behavior beyond these: the PDF is modified non-destructively as an incremental update, original bytes are preserved, and content is never removed or redacted. It also warns about encrypted sources and sandbox file output. This is much stronger than the annotations alone.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is compact yet information-dense, structured as a sentence listing current valid types, then a sentence covering required parameters, then a warning. Major constraints and warnings are uppercase and front-loaded within each sentence. No filler or repetition of the schema is present.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the rich input schema that already documents every parameter and an existing output schema, the prose description still covers all operational facts an agent needs: non-destructive behavior, required coordinate parameters, encrypted-source handling, and sandbox file writing. There are no missing behavioral warnings or usage caveats that an agent would need to know before making a safe call.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema already documents every parameter with useful descriptions, so the schema itself carries most semantics. The description enriches understanding by explaining the coordinate system (PDF user-space points), showing which parameters go with which annotation types (e.g. start/end for line, icon/open for text, quadPoints for markup types), and by stating that type-specific fields are optional. The one weak area is that outputMode/outputPath semantics are mostly schema-covered, but the description does reinforce the sandbox requirement.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly identifies the resource (existing PDF) and the precise action (append markup annotations as a non-destructive incremental update), listing supported annotation types and the standard it follows. It distinguishes itself from sibling tools like sign_pdf, encrypt_pdf, and merge_pdfs without needing detailed inspection.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly states what it is not for: 'VISUAL OVERLAY ONLY — nothing is removed or redacted (covered text stays extractable).' It explicitly advises that encrypted sources require decrypt_pdf first. This provides clear when-to-use and when-not-to-use guidance relative to sibling tools.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.